Subject: [ntpwg] Minor correction on draft-aanchal4-ntp-mac

From: "Scott Fluhrer (sfluhrer)" <[email-masked]>
Date: Fri, 28 Apr 2017 19:12:03 +0000

The draft claims that

2.  The other three algorithms evaluated here do not suffer from
       nonce reuse vulnerabilities where an adversary can recover the
       authentication key if the nonce is reused just once.

Actually, this is not true; if you use the same nonce to MAC two different messages with Poly1305(ChaCha20) (specifically, the RFC7539 version), an attacker will be able to forge (just with that nonce, however since the attacker gets to select the nonce, that doesn't help much).

Now, this doesn't change the conclusion of the draft, which is to use CMAC (which I agree with); I just wanted to make sure that, should you reevaluate things and reconsider Poly1305, that you would be aware of the issues.
_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg