XChaCha20-Poly1305 / AES-GCM-SIV / XAES-GCM

[bakkot]

(First let me express great excitement about this proposal! I don't have experience with this specifica standard, but I do have experience with web specs in general in the form of the JS standard. If you're looking for help with anything please ping me.)

This provides ChaCha20-Poly1305. My understanding is that in longer-lived applications you want XChaCha20-Poly1305, which uses a longer nonce. This page lists it in the most preferred tier, above ChaCha20-Poly1305. The extended-nonce variant is a straightforward extension.

As long as I'm suggesting variants constructions with more straightforward nonce analysis, the above page also recommends AES-GCM-SIV above AES-GCM, and Filippo Valsorda recommends something he calls XAES-GCM, the latter of which is easily implementable on top of the existing AES-GCM support. This page discusses tradeoffs around AES-GCM-SIV, XAES-GCM, and various other alternatives.

[dchest]

NIST is currently considering endorsing an expanded nonce AES-GCM (XAES-GCM is one of the considered methods), so I guess it's better to wait for their call on this.

XChaChaPoly would be useful indeed.

[emanjon]

My understanding is that in longer-lived applications you want XChaCha20-Poly1305, which uses a longer nonce.

I don't think it has to do with longer-lived applications. It is about random nonces. I don't think you should ever use ChaCha20-Poly1305 with a fixed key and random nonces. Period. XChaCha20-Poly1305 is fine to use with a fixed key and random nonces.

https://eprint.iacr.org/2024/1111.pdf

https://csrc.nist.gov/files/pubs/sp/800/38/d/r1/upd/iprd/docs/sp800-38d-pre-draft-public-comments.pdf