Rotate nonces

[felinira]

Rotate nonces

[felinira]

I actually don't think this is a security issue since the entire file is encrypted at once. So it's one nonce & one pass. The AEAD_CHACHA20_POLY1305 RFC states:

a nonce value cannot be used securely more than once with the same key.

You might be right. As long as "using once" means one invocation of the algorithm which it probably does?

[landhb]

I actually don't think this is a security issue since the entire file is encrypted at once. So it's one nonce & one pass. The AEAD_CHACHA20_POLY1305 RFC states:

a nonce value cannot be used securely more than once with the same key.

Which fits the current use case. Since the nonce + key are both only used once to encrypt the entire file, and never used again.

For performance I think I did have it encrypt per chunk during development at one point and it was actually slower than a single call to encrypt_in_place_detached. But it would be worth creating & running some benchmarks to see if there is any speedup.

[piegamesde]

@felinira You appear to be reworking the protocol at the moment. May I suggest you to have a deep look at croc and Magic Wormhole first (if not already done so)? A lot of valuable lessons were learned in the making of there w.r.t to security, features and backwards compatibility. I wouldn't want you to learn these the hard way …

[felinira]

@felinira You appear to be reworking the protocol at the moment. May I suggest you to have a deep look at croc and Magic Wormhole first (if not already done so)? A lot of valuable lessons were learned in the making of there w.r.t to security, features and backwards compatibility. I wouldn't want you to learn these the hard way …

I was only trying things out for fun. But I will definitely look more in depth there, thanks.

[landhb]

Going to close the issue for now since currently the nonce is only used once. If we move to per-chunk encryption later on we'll need to generate a nonce per-chunk.

For the new metadata PR, since it's encrypted separately it uses an entirely different nonce: https://github.com/landhb/portal/blob/encmetadata/lib/src/lib.rs#L381

[landhb]

Per-chunk encryption has now been implemented in #11, so unique nonces per-chunk are now generated via NonceSequence