-
Notifications
You must be signed in to change notification settings - Fork 203
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
36609c2
commit b0f00ed
Showing
1 changed file
with
11 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -1048,21 +1048,26 @@ When AEAD_CHACHA20_POLY1305 is in use, header protection uses the raw ChaCha20 | |
function as defined in Section 2.4 of {{!CHACHA}}. This uses a 256-bit key and | ||
16 bytes sampled from the packet protection output. | ||
|
||
The first 4 bytes of the sampled ciphertext are interpreted as a 32-bit number | ||
in little-endian order and are used as the block count; a ChaCha20 | ||
implementation might instead take the 4 bytes as an opaque sequence of bytes. | ||
The remaining 12 bytes are used as the nonce. | ||
The first 4 bytes of the sampled ciphertext are the block counter. A ChaCha20 | ||
implementation could take a 32-bit integer in place of a byte sequence, in | ||
which case the byte sequence is interpreted as a little-endian value. | ||
This comment has been minimized.
Sorry, something went wrong.
This comment has been minimized.
Sorry, something went wrong.
martinthomson
Author
Member
|
||
|
||
The remaining 12 bytes are used as the nonce. A ChaCha20 implementation might | ||
take an array of three 32-bit integers in place of a byte sequence, in which | ||
case the nonce bytes are interpreted as a sequence of 32-bit little-endian | ||
integers. | ||
|
||
The encryption mask is produced by invoking ChaCha20 to protect 5 zero bytes. In | ||
pseudocode: | ||
|
||
~~~ | ||
counter = DecodeLE(sample[0..3]) | ||
nonce = sample[4....15] | ||
counter = sample[0..3] | ||
nonce = sample[4..15] | ||
mask = ChaCha20(hp_key, counter, nonce, {0,0,0,0,0}) | ||
~~~ | ||
|
||
|
||
|
||
## Receiving Protected Packets | ||
|
||
Once an endpoint successfully receives a packet with a given packet number, it | ||
|
Don't you mean the opposite?
implementation could take a byte sequence in place of a 32-bit integer, in
What happened to the suggest change?