use ChaCha⊕AES encryption

[zooko]

In order to protect against weaknesses in AES (such as timing or side-channel attacks, or cryptanalysis, possibly far in the future and applied against old ciphertexts), want to use a combined encryption of AES-128 and XSalsa20. Yu Xue (Student) and Jack Lloyd (Mentor) are working on implementing that mode for GSoC 2010:

https://tahoe-lafs.org/trac/pycryptopp/ticket/46

This ticket is to integrate that encryption mode into Tahoe-LAFS. The steps are to define new capability versions, such as by inserting an X into the cap type designator:

https://tahoe-lafs.org/pipermail/tahoe-dev/2010-August/004878.html https://tahoe-lafs.org/pipermail/tahoe-dev/2010-August/004879.html

And to make it so that caps of that new type get encrypted/decrypted with XSalsa20+AES-128 instead of with AES-256. For the first release of Tahoe-LAFS which includes that functionality, it will still by default create new caps using the old encryption of only AES-256. It is important that people feel free to upgrade to new versions of Tahoe-LAFS without having to take any steps to ensure backward-compatibility, and that means that the new version of Tahoe-LAFS must not, by default, produce caps that older versions of Tahoe-LAFS (such as v1.8.0) can't read.

This tahoe-dev letter lists all the places where the current source code (which is Tahoe-LAFS v1.8.0c1) uses encryption:

• trunk/src/allmydata/dirnode.py?annotate=blame&rev=35f37cc5b86465407a0eb85a7760f8442f5a969f#L175​
• trunk/src/allmydata/dirnode.py?annotate=blame&rev=35f37cc5b86465407a0eb85a7760f8442f5a969f#L294​
• trunk/src/allmydata/immutable/filenode.py?annotate=blame&rev=0ef593947755a8b81edc73d033219724268faf80#L185​
• trunk/src/allmydata/immutable/upload.py?annotate=blame&rev=196bd583b6c4959c60d3f73cdcefc9edda6a38ae#L620​
• trunk/src/allmydata/immutable/upload.py?annotate=blame&rev=196bd583b6c4959c60d3f73cdcefc9edda6a38ae#L756​
• trunk/src/allmydata/mutable/filenode.py?annotate=blame&rev=4563ba456b1b2d640551956374b0cfbfc602dcec#L161​
• trunk/src/allmydata/mutable/filenode.py?annotate=blame&rev=4563ba456b1b2d640551956374b0cfbfc602dcec#L166​
• trunk/src/allmydata/mutable/publish.py?annotate=blame&rev=45adde71808bc27d41b5bc77a963184957e9b247#L693​
• trunk/src/allmydata/mutable/retrieve.py?annotate=blame&rev=7956e22d2149b0fb7f3014d6f43d01fb520c1b81#L621​
• trunk/src/allmydata/util/fileutil.py?annotate=blame&rev=c85060c436834b58cf7f1876811762d53c81ff90#L118​

This is inspired by The One-Hundred-Year Cryptography Project.

[zooko]

Upon Samuel Neves's questioning, I added some notes about AES-128 vs. AES-256 for this:

​http://tahoe-lafs.org/trac/pycryptopp/ticket/46#comment:2

I would be interested in the feedback of Jack, Yu Xue, David-Sarah, or Brian about this issue.

[zooko]

Yu Xue contributed a patch to pycryptopp to make it support XSalsa20 and XSalsa20⊕AES-128: ​http://tahoe-lafs.org/trac/pycryptopp/ticket/46

[davidsarah]

It's not clear to me that this should go into 1.10, which is going to focus primarily on bug fixes (especially robustifying mutable files and repair behaviour) and accounting. However, I may be persuadable.

[davidsarah]

Hmm, I see this is explicitly listed as one of the goals for the 1.10 milestone. So, I'll leave it in.

[zooko]

I currently intend to get this landed in trunk for Tahoe-LAFS v1.11.

[davidsarah]

Replying to zooko:

I currently intend to get this landed in trunk for Tahoe-LAFS v1.11.

+1.

[daira]

We pushed many goals back a release when we decided to have release 1.10 just based on features and bugfixes that were already on trunk. So it is now 1.11 that is going to focus primarily on robustifying share placement and repair behaviour. I suggest that XSalsa+AES support go into 1.12, unless it is ready for 1.11 without slipping the schedule. Note that some design issues about cap format etc. have not been resolved yet.

[zooko]

Replying to daira:

I suggest that XSalsa+AES support go into 1.12, unless it is ready for 1.11 without slipping the schedule.

+1

[zooko]

Because of the fact that ChaCha looks like it might become a standard cipher in TLS soon (​http://tools.ietf.org/html/draft-agl-tls-chacha20poly1305-01), then this makes me think we should use ChaCha instead of XSalsa20 for this.

[zooko]

I opened pycryptopp ticket #94 to track adding ChaCha into pycryptopp.