Poly1305 v0.3.0 Poly1305

Poly1305 message authentication

https://tools.ietf.org/html/rfc7539

Summary

Types

Encryption key

Per-message nonce

MAC tag

Functions

authenticated encryption with additional data - decryption

authenticated encryption with additional data - encryption

compare two HMACs in constant time

Compute a Message authentication code

Types

key :: <<_::32 * 8>>

Encryption key

nonce :: <<_::12 * 8>>

Per-message nonce

By convention, the first 4 bytes should be sender-specific. The trailing 8 bytes may be as simple as a counter.

tag :: <<_::16 * 8>>

MAC tag

Functions

aead_decrypt(c, k, n, a \\ "", t)

Specs

aead_decrypt(binary, key, nonce, binary, tag) ::
  binary |
  :error

authenticated encryption with additional data - decryption

  • encrypted message
  • shared secret key
  • one-time use nonce
  • additional authenticated data
  • MAC

    On success, returns the plaintext message. If the message cannot be authenticated :error is returned.

aead_encrypt(m, k, n, a \\ "")

Specs

aead_encrypt(binary, key, nonce, binary) :: {binary, tag}

authenticated encryption with additional data - encryption

  • message to be encrypted
  • shared secret key
  • one-time use nonce
  • additional authenticated data

    The return value will be a tuple of {ciphertext, MAC}

    The algorithm is applied as described in RFC7539:

  • The key and nonce are used to encrypt the message with ChaCha20.
  • The one-time MAC key is derived from the cipher key and nonce.
  • The ciphertext and additional data are authenticated with the MAC
compare(a, b)

Specs

compare(binary, binary) :: boolean

compare two HMACs in constant time

This particular implementation should work for all cases related to these HMACs. We assume they already know the length of the “unknown” string

hmac(m, k)

Specs

hmac(binary, key) :: tag

Compute a Message authentication code

The one-time key should never be reused.