ChaCha20 without Poly1305 on nRF Connect

[Bilal]

Hey,

Does nRFConnect SDK support the ChaCha20 encryption library without Poly1305? 

We are currently using the mbedTLS PSA Crypto library to perform encryption/decryption but it only works if we use the 16 byte authentication tag that is part of the Poly1305 implementation, is it possible on nRFConnect to use ChaCha20 without the Poly tag?

Thanks

[Einar Thorsrud]

Hi,

Using PSA API's, it should be possible to use PSA_ALG_STREAM_CIPHER as algorithm and PSA_KEY_TYPE_CHACHA20 as key type.

[Bilal]

I am trying to do this but what PSA function should I be using. 

We were using "psa_aead_encrypt" before w/ the algorithm set to PSA_ALG_CHACHA20_POLY1305 but with PSA_ALG_STREAM_CIPHER what API should be used?

I tried "psa_cipher_encrypt" but I can't find the source code for this function - I just see in the crypto.h header

With that, I also am not sure how to specify the nonce to use for the encryption.

Any help? Thanks

[Einar Thorsrud]

There is a test that demonstrate how this should work from an API perspective, specifically psa_cipher_rfc7539_test() from modules/tee/tf-m/tf-m-tests/test/secure_fw/suites/crypto/crypto_tests_common.c. This is not Nordic code though, and I am not able to get it to work myself. I am checking with our crypto team to see if there is a way to make it work. I will update here when I know more.

[Bilal]

Any updates? We are trying to upgrade a product that is already in production to nrf Connect SDK and it would be really helpful if we can keep using chacha20 without the poly1305 tag as that would cause alot of reworking and effort on our part.

[Einar Thorsrud]

Hi,

Sorry for the delay. You can find an unofficial sample that demonstrate ChaCha20 only here. This is basically the test code I referred to in my previous post, with some minor changes. I tested this on the nRF52840 DK on nRF Connect SDK 2.2.0 and 2.3.0-rc2.

Einar

[Bilal]

Thanks for that code - Ill try it out.

Could u help me understand how the length array is decided in the example code you linked? what is the limitation of doing the entire encryption in one big chunk?

[Einar Thorsrud]

Hi,

ChaCha20 is a stream cipher that works on single bytes, so the length of the array does not matter. Also, if you pass a huge array, or several smaller chunks will not matter. The resulting encrypted text will be the same regardless. And as you see in the test code, different chunk sizes are used for decryption, and that is also fine. Again, a stream cipher is byte based (rather than block based), so it does not matter.

The code I uploaded was based on test code as mentioned, so I assume the reason for using different lengths there is to verify that it works with different combinations of chunk sizes.