Re: Re: XChaCha20 decryption issue.
Lucas Marchetti <[email protected]> Tue, 7 Nov 2023 00:21:30 -0800 (PST)
| Newsgroups | gmane.comp.encryption.cryptopp |
|---|---|
| Message-ID | <[email protected]> |
------=_Part_33348_2042138835.1699345290254
Content-Type: multipart/alternative;
boundary="----=_Part_33349_465201276.1699345290254"
------=_Part_33349_465201276.1699345290254
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
I've just took a look into chachapoly1305 library's source files and I=20
found *Seal* and *Open*=20
functions: https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.14.0:cha=
cha20poly1305/chacha20poly1305_generic.go=20
.
You're right: the 16 bytes are a Poly1305 authentication tag and here is=20
how it's generated:
func writeWithPadding(p *poly1305.MAC, b []byte) {=20
p.Write(b)=20
if rem :=3D len(b) % 16; rem !=3D 0 {=20
var buf [16]byte=20
padLen :=3D 16 - rem=20
p.Write(buf[:padLen])=20
}=20
}=20
func writeUint64(p *poly1305.MAC, n int) {=20
var buf [8]byte=20
binary.LittleEndian.PutUint64(buf[:], uint64(n))=20
p.Write(buf[:])=20
}
func (c *chacha20poly1305) sealGeneric(dst, nonce, plaintext,=20
additionalData []byte) []byte {=20
ret, out :=3D sliceForAppend(dst, len(plaintext)+poly1305.TagSize)=20
ciphertext, tag :=3D out[:len(plaintext)], out[len(plaintext):]=20
if alias.InexactOverlap(out, plaintext) {=20
panic("chacha20poly1305: invalid buffer overlap")=20
}=20
var polyKey [32]byte=20
s, _ :=3D chacha20.NewUnauthenticatedCipher(c.key[:], nonce)=20
s.XORKeyStream(polyKey[:], polyKey[:])=20
s.SetCounter(1) // set the counter to 1, skipping 32 bytes=20
s.XORKeyStream(ciphertext, plaintext)=20
p :=3D poly1305.New(&polyKey)=20
writeWithPadding(p, additionalData)=20
writeWithPadding(p, ciphertext)=20
writeUint64(p, len(additionalData))=20
writeUint64(p, len(plaintext))=20
p.Sum(tag[:0])=20
return ret=20
}
Any suggestions about how to replicate the same thing with Crypto++?
On Monday, November 6, 2023 at 11:53:29=E2=80=AFPM UTC+1 Lucas Marchetti wr=
ote:
> You're right, pics are not helpful.
> I've also followed the advise about using test vectors instead of message=
s.
>
> That's a remake of what I need to implement in my application.
>
> *test.cpp*
>
> #include <cryptopp/cryptlib.h>
> #include <cryptopp/chachapoly.h>
> #include <cryptopp/filters.h>
> #include <cryptopp/files.h>
> #include <cryptopp/hex.h>
>
>
> int main(int argc, char* argv[])
> {
> using namespace CryptoPP;
>
> const byte pt[] =3D {
> =20
> 0x4c,0x61,0x64,0x69,0x65,0x73,0x20,0x61,0x6e,0x64,0x20,0x47,0x65,0x6e,0x7=
4,0x6c,
> =20
> 0x65,0x6d,0x65,0x6e,0x20,0x6f,0x66,0x20,0x74,0x68,0x65,0x20,0x63,0x6c,0x6=
1,0x73,
> =20
> 0x73,0x20,0x6f,0x66,0x20,0x27,0x39,0x39,0x3a,0x20,0x49,0x66,0x20,0x49,0x2=
0,0x63,
> =20
> 0x6f,0x75,0x6c,0x64,0x20,0x6f,0x66,0x66,0x65,0x72,0x20,0x79,0x6f,0x75,0x2=
0,0x6f,
> =20
> 0x6e,0x6c,0x79,0x20,0x6f,0x6e,0x65,0x20,0x74,0x69,0x70,0x20,0x66,0x6f,0x7=
2,0x20,
> =20
> 0x74,0x68,0x65,0x20,0x66,0x75,0x74,0x75,0x72,0x65,0x2c,0x20,0x73,0x75,0x6=
e,0x73,
> =20
> 0x63,0x72,0x65,0x65,0x6e,0x20,0x77,0x6f,0x75,0x6c,0x64,0x20,0x62,0x65,0x2=
0,0x69,
> 0x74,0x2e
> };
>
> const byte aad[] =3D {
> 0x50,0x51,0x52,0x53,0xc0,0xc1,0xc2,0xc3,0xc4,0xc5,0xc6,0xc7
> };
>
> const byte key[] =3D {
> =20
> 0x80,0x81,0x82,0x83,0x84,0x85,0x86,0x87,0x88,0x89,0x8a,0x8b,0x8c,0x8d,0x8=
e,0x8f,
> =20
> 0x90,0x91,0x92,0x93,0x94,0x95,0x96,0x97,0x98,0x99,0x9a,0x9b,0x9c,0x9d,0x9=
e,0x9f
> };
>
> const byte iv[] =3D {
> 0x07,0x00,0x00,0x00, // Common
> 0x40,0x41,0x42,0x43,0x44,0x45,0x46,0x47 // IV
> };
>
> byte ct[sizeof(pt)], rt[sizeof(ct)], mac[16];
>
> ChaCha20Poly1305::Encryption enc;
> enc.SetKeyWithIV(key, sizeof(key), iv, sizeof(iv));
> enc.EncryptAndAuthenticate(ct, mac, sizeof(mac), iv, sizeof(iv), aad,=
=20
> sizeof(aad), (const byte*)pt, sizeof(pt));
>
> std::cout << "Plain: \n";
> StringSource((const byte*)pt, sizeof(pt), true, new HexEncoder(new=20
> FileSink(std::cout)));
> std::cout << "\n" << std::endl;
>
> std::cout << "Cipher: \n";
> =20
> for (int i =3D 0; i < sizeof(ct); ++i) {
>
> std::cout << (uint)ct[i] << " ";
>
> }
>
> std::cout << std::endl;
> =20
> std::cout << "\nMAC: \n";
> StringSource(mac, sizeof(mac), true, new HexEncoder(new=20
> FileSink(std::cout)));
> std::cout << "\n" << std::endl;
>
> ChaCha20Poly1305::Decryption dec;
> dec.SetKeyWithIV(key, sizeof(key), iv, sizeof(iv));
> dec.DecryptAndVerify(rt, mac, sizeof(mac), iv, sizeof(iv), aad,=20
> sizeof(aad), ct, sizeof(ct));
>
> std::cout << "Recover: ";
>
> StringSource(rt, sizeof(rt), true, new HexEncoder(new=20
> FileSink(std::cout)));
>
> std::cout << std::endl;
>
> return 0;
> }
>
> *test.go*
>
> package main
>
> import (
> "crypto/cipher"
>
> "fmt"
>
> "golang.org/x/crypto/chacha20poly1305"
> )
>
> // Encryption.
> var (
>
> key []byte
> encryptedMsg []byte
> aead cipher.AEAD
>
> )
>
> func remove(slice []byte, s int) []byte {
> return append(slice[:s], slice[s+1:]...)
> }
>
> func EncrytionWithChaChaPoly() {
>
> msg :=3D make([]byte, 0)
> msg =3D append(msg,=20
>
>
> 0x4c,0x61,0x64,0x69,0x65,0x73,0x20,0x61,0x6e,0x64,0x20,0x47,0x65,0x6e,0x7=
4,0x6c,
> =20
> 0x65,0x6d,0x65,0x6e,0x20,0x6f,0x66,0x20,0x74,0x68,0x65,0x20,0x63,0x6c,0x6=
1,0x73,
> =20
> 0x73,0x20,0x6f,0x66,0x20,0x27,0x39,0x39,0x3a,0x20,0x49,0x66,0x20,0x49,0x2=
0,0x63,
> =20
> 0x6f,0x75,0x6c,0x64,0x20,0x6f,0x66,0x66,0x65,0x72,0x20,0x79,0x6f,0x75,0x2=
0,0x6f,
> =20
> 0x6e,0x6c,0x79,0x20,0x6f,0x6e,0x65,0x20,0x74,0x69,0x70,0x20,0x66,0x6f,0x7=
2,0x20,
> =20
> 0x74,0x68,0x65,0x20,0x66,0x75,0x74,0x75,0x72,0x65,0x2c,0x20,0x73,0x75,0x6=
e,0x73,
> =20
> 0x63,0x72,0x65,0x65,0x6e,0x20,0x77,0x6f,0x75,0x6c,0x64,0x20,0x62,0x65,0x2=
0,0x69,
> 0x74,0x2e,
>
> )
>
> // Select a random nonce, and leave capacity for the ciphertext.
> nonce :=3D make([]byte, 0)
> nonce =3D append(nonce, 0x07,0x00,0x00,0x00, // Comm=
on
> 0x40,0x41,0x42,0x43,0x44,0x45,0x46,0x47)
>
> fmt.Println("Nonce:")
> fmt.Println(nonce)
>
> // Encrypt the message and append the ciphertext to the nonce.
> encryptedMsg =3D aead.Seal(nonce, nonce, msg, nil)
>
> fmt.Println("\nCipher:")
> fmt.Println(encryptedMsg)
>
> }
>
> // Decryption.
> func DecryptionWithChaChaPoly(){
>
> if len(encryptedMsg) < aead.NonceSize() {
> panic("ciphertext too short")
> }
>
> // Split nonce and ciphertext.
> nonce, ciphertext :=3D encryptedMsg[:aead.NonceSize()],=20
> encryptedMsg[aead.NonceSize():]
>
> // Decrypt the message and check it wasn't tampered with.
> plaintext, err :=3D aead.Open(nil, nonce, ciphertext, nil)
> if err !=3D nil {
> panic(err)
> }
>
> fmt.Println("\nRecover:")
> fmt.Printf("%s\n", plaintext)
>
> }
>
> func main(){
>
> var err error
>
> key =3D make([]byte, 0)
> key =3D append(key,=20
> 0x80,0x81,0x82,0x83,0x84,0x85,0x86,0x87,0x88,0x89,0x8a,0x8b,0x8c,0x8d,0x8=
e,0x8f,
> =20
> 0x90,0x91,0x92,0x93,0x94,0x95,0x96,0x97,0x98,0x99,0x9a,0x9b,0x9c,0x9d,0x9=
e,0x9f)
>
> aead, err =3D chacha20poly1305.New(key)
> if err !=3D nil {
> panic(err)
> }
>
> EncrytionWithChaChaPoly()
>
> DecryptionWithChaChaPoly()
>
> }
>
> Here you are the output.
> The highlighted text is the same of the Crypto++ output.
>
> [image: Screenshot 2023-11-06 234054.png]
>
> I think the 16 bytes at the end are part of the *Seal* function and=20
> corresponds to the *additionalData *parameter as shown in the next pic.
> Maybe the function still do something with a null pointer, so it will=20
> append those bytes to the ciphertext anyway.
>
> [image: Screenshot 2023-11-06 234437.png]
>
> Looks like *Seal *is doing something like this: *Nonce *+ *Ciphertext *+=
=20
> *AdditionalData(?)*
> Any ideas?
> On Sunday, November 5, 2023 at 8:26:27=E2=80=AFPM UTC+1 Jeffrey Walton wr=
ote:
>
>> On Sun, Nov 5, 2023 at 4:38=E2=80=AFAM Lucas Marchetti <lmarch...@gmail.=
com>=20
>> wrote:
>>
>>> Sorry, seeing now that I've linked the wrong Golang library, here it is=
:=20
>>> https://pkg.go.dev/golang.org/x/crypto/chacha20poly1305
>>>
>>> On Sunday, November 5, 2023 at 10:10:44=E2=80=AFAM UTC+1 Lucas Marchett=
i wrote:
>>>
>>>> I've just made a test encrypting the string "Hello World!" with both=
=20
>>>> client and server functions and these are the results.
>>>>
>>>> [image: Screenshot 2023-11-05 100312.png]
>>>>
>>>> Both green-highlighted bytes corresponds to the input string but, as=
=20
>>>> you can see, there is a different padding that I'm 100% sure is the so=
urce=20
>>>> of the problem.
>>>>
>>>> On Saturday, November 4, 2023 at 7:39:31=E2=80=AFPM UTC+1 Lucas Marche=
tti wrote:
>>>>
>>>>> Good evening.
>>>>>
>>>>> I'm building a client-server application and I want to implement a=20
>>>>> XChaCha20 communication over TCP after performing key exchange.
>>>>>
>>>>> What I'm issuing is a bad decryption output like the one shown in the=
=20
>>>>> pic.
>>>>>
>>>>> [image: Screenshot 2023-11-04 193625.png]
>>>>>
>>>>> I'm currently using crypto++ 8.9 in the client-side and=20
>>>>> https://pkg.go.dev/golang.org/x/crypto/chacha20 in the server-side.
>>>>>
>>>>> Is that something related to sealing or authentication implemented in=
=20
>>>>> the Golang library?
>>>>>
>>>>> Functions that I'm using:
>>>>>
>>>>> [image: Screenshot 2023-11-04 193751.png]
>>>>>
>>>>> [image: Screenshot 2023-11-04 193832.png]
>>>>>
>>>>> Thanks in advance.
>>>>>
>>>> If you want help, then you should provide source code and post a link=
=20
>> to a minimal reproducer. Pictures are not helpful.
>>
>> The wiki is full of little working examples. For example, <
>> https://www.cryptopp.com/wiki/XChaCha20> and <
>> https://www.cryptopp.com/wiki/XChaCha20Poly1305>.
>>
>> You should also probably start with test vectors, and then move onto=20
>> arbitrary messages once things work with test vectors. Here are the ones=
=20
>> Crypto++ uses for XChaCha: <
>> https://github.com/weidai11/cryptopp/blob/master/TestVectors/chacha.txt>=
.=20
>> And here are the ones for ChaCha20/Poly1305: <
>> https://github.com/weidai11/cryptopp/blob/master/TestVectors/chacha20pol=
y1305.txt#L4669
>> >.
>>
>> I'm just guessing, but the 16-bytes of garbage at the end of the=20
>> [encrypted] message may be a Poly1305 authentication tag. But it is just=
a=20
>> guess. The go documentation should tell you what you have.
>>
>> Jeff
>>
>
--=20
You received this message because you are subscribed to the Google Groups "=
Crypto++ Users" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/=
cryptopp-users/455def34-d321-4f2c-a297-197b96410d72n%40googlegroups.com.
------=_Part_33349_465201276.1699345290254
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
I've just took a look into chachapoly1305 library's source files and I foun=
d <i>Seal</i> and <i>Open</i> functions:=C2=A0https://cs.opensource.google/=
go/x/crypto/+/refs/tags/v0.14.0:chacha20poly1305/chacha20poly1305_generic.g=
o .<div><br />You're right: the 16 bytes are a Poly1305 authentication tag =
and here is how it's generated:</div><div><br /></div><div><br /></div><div=
><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; color: rg=
b(0, 0, 0); font-family: monospace; font-size: medium; white-space: pre;"><=
span style=3D"margin: 0px; padding: 0px; box-sizing: border-box; color: rgb=
(119, 0, 136);">func</span> writeWithPadding(p *poly1305.MAC, b []byte) {
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> p.Write(b)
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> <span style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(119, 0, 136);">if</span> rem :=3D len(b) % <span style=3D"margin: 0p=
x; padding: 0px; box-sizing: border-box; color: rgb(17, 102, 68);">16</span=
>; rem !=3D <span style=3D"margin: 0px; padding: 0px; box-sizing: border-bo=
x; color: rgb(17, 102, 68);">0</span> {
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> <span style=3D"margin: 0px; padding: 0px; box-sizing: border-box; col=
or: rgb(119, 0, 136);">var</span> buf [<span style=3D"margin: 0px; padding:=
0px; box-sizing: border-box; color: rgb(17, 102, 68);">16</span>]byte
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> padLen :=3D <span style=3D"margin: 0px; padding: 0px; box-sizing: bor=
der-box; color: rgb(17, 102, 68);">16</span> - rem
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> p.Write(buf[:padLen])
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> }
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;">}
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;">
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"><span style=3D"margin: 0px; padding: 0px; box-sizing: border-box; color=
: rgb(119, 0, 136);">func</span> writeUint64(p *poly1305.MAC, n int) {
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> <span style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(119, 0, 136);">var</span> buf [<span style=3D"margin: 0px; padding: =
0px; box-sizing: border-box; color: rgb(17, 102, 68);">8</span>]byte
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> binary.LittleEndian.PutUint64(buf[:], uint64(n))
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> p.Write(buf[:])
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;">}</div></div><div><br /></div><div><div style=3D"margin: 0px; padding: =
0px; box-sizing: border-box; color: rgb(0, 0, 0); font-family: monospace; f=
ont-size: medium; white-space: pre;"><span style=3D"margin: 0px; padding: 0=
px; box-sizing: border-box; color: rgb(119, 0, 136);">func</span> (c *chach=
a20poly1305) sealGeneric(dst, nonce, plaintext, additionalData []byte) []by=
te {
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> ret, out :=3D sliceForAppend(dst, len(plaintext)+poly1305.TagSize)
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> ciphertext, tag :=3D out[:len(plaintext)], out[len(plaintext):]
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> <span style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(119, 0, 136);">if</span> alias.InexactOverlap(out, plaintext) {
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> panic(<span style=3D"margin: 0px; padding: 0px; box-sizing: border-bo=
x; color: rgb(19, 115, 51);">"chacha20poly1305: invalid buffer overlap"</sp=
an>)
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> }
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;">
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> <span style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(119, 0, 136);">var</span> polyKey [<span style=3D"margin: 0px; paddi=
ng: 0px; box-sizing: border-box; color: rgb(17, 102, 68);">32</span>]byte
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> s, _ :=3D chacha20.NewUnauthenticatedCipher(c.key[:], nonce)
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> s.XORKeyStream(polyKey[:], polyKey[:])
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> s.SetCounter(<span style=3D"margin: 0px; padding: 0px; box-sizing: bor=
der-box; color: rgb(17, 102, 68);">1</span>) <span style=3D"margin: 0px; pa=
dding: 0px; box-sizing: border-box; color: rgb(136, 0, 0);">// set the coun=
ter to 1, skipping 32 bytes</span>
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> s.XORKeyStream(ciphertext, plaintext)
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;">
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> p :=3D poly1305.New(&polyKey)
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> writeWithPadding(p, additionalData)
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> writeWithPadding(p, ciphertext)
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> writeUint64(p, len(additionalData))
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> writeUint64(p, len(plaintext))
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> p.Sum(tag[:<span style=3D"margin: 0px; padding: 0px; box-sizing: borde=
r-box; color: rgb(17, 102, 68);">0</span>])
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;">
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;"> <span style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(119, 0, 136);">return</span> ret
</div><div style=3D"margin: 0px; padding: 0px; box-sizing: border-box; colo=
r: rgb(0, 0, 0); font-family: monospace; font-size: medium; white-space: pr=
e;">}</div></div><div style=3D"margin: 0px; padding: 0px; box-sizing: borde=
r-box; color: rgb(0, 0, 0); font-family: monospace; font-size: medium; whit=
e-space: pre;"><br /></div><div style=3D"margin: 0px; padding: 0px; box-siz=
ing: border-box; color: rgb(0, 0, 0); font-family: monospace; font-size: me=
dium; white-space: pre;"><br /></div><div style=3D"margin: 0px; padding: 0p=
x; box-sizing: border-box; color: rgb(0, 0, 0); white-space: pre;"><font fa=
ce=3D"Arial" size=3D"2">Any suggestions about how to replicate the same thi=
ng with Crypto++?</font></div><div class=3D"gmail_quote"><div dir=3D"auto" =
class=3D"gmail_attr">On Monday, November 6, 2023 at 11:53:29=E2=80=AFPM UTC=
+1 Lucas Marchetti wrote:<br/></div><blockquote class=3D"gmail_quote" style=
=3D"margin: 0 0 0 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding=
-left: 1ex;">You're right, pics are not helpful.<div>I've also foll=
owed the advise about using test vectors instead of messages.<br><br>That&#=
39;s a remake of what I need to implement in my application.<br><br><u><b>t=
est.cpp</b></u><br><br><font color=3D"#008000">#include <cryptopp/cryptl=
ib.h><br>#include <cryptopp/chachapoly.h><br>#include <cryptopp=
/filters.h><br>#include <cryptopp/files.h><br>#include <cryptop=
p/hex.h><br><br><br>int main(int argc, char* argv[])<br>{<br>=C2=A0 =C2=
=A0 using namespace CryptoPP;<br><br>=C2=A0 =C2=A0 const byte pt[] =3D {<br=
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 0x4c,0x61,0x64,0x69,0x65,0x73,0x20,0x61,0x6e,0=
x64,0x20,0x47,0x65,0x6e,0x74,0x6c,<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 0x65,0x6d=
,0x65,0x6e,0x20,0x6f,0x66,0x20,0x74,0x68,0x65,0x20,0x63,0x6c,0x61,0x73,<br>=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 0x73,0x20,0x6f,0x66,0x20,0x27,0x39,0x39,0x3a,0x=
20,0x49,0x66,0x20,0x49,0x20,0x63,<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 0x6f,0x75,=
0x6c,0x64,0x20,0x6f,0x66,0x66,0x65,0x72,0x20,0x79,0x6f,0x75,0x20,0x6f,<br>=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 0x6e,0x6c,0x79,0x20,0x6f,0x6e,0x65,0x20,0x74,0x=
69,0x70,0x20,0x66,0x6f,0x72,0x20,<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 0x74,0x68,=
0x65,0x20,0x66,0x75,0x74,0x75,0x72,0x65,0x2c,0x20,0x73,0x75,0x6e,0x73,<br>=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 0x63,0x72,0x65,0x65,0x6e,0x20,0x77,0x6f,0x75,0x=
6c,0x64,0x20,0x62,0x65,0x20,0x69,<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 0x74,0x2e<=
br>=C2=A0 =C2=A0 };<br><br>=C2=A0 =C2=A0 const byte aad[] =3D {<br>=C2=A0 =
=C2=A0 =C2=A0 =C2=A0 0x50,0x51,0x52,0x53,0xc0,0xc1,0xc2,0xc3,0xc4,0xc5,0xc6=
,0xc7<br>=C2=A0 =C2=A0 };<br><br>=C2=A0 =C2=A0 const byte key[] =3D {<br>=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 0x80,0x81,0x82,0x83,0x84,0x85,0x86,0x87,0x88,0x=
89,0x8a,0x8b,0x8c,0x8d,0x8e,0x8f,<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 0x90,0x91,=
0x92,0x93,0x94,0x95,0x96,0x97,0x98,0x99,0x9a,0x9b,0x9c,0x9d,0x9e,0x9f<br>=
=C2=A0 =C2=A0 };<br><br>=C2=A0 =C2=A0 const byte iv[] =3D {<br>=C2=A0 =C2=
=A0 =C2=A0 =C2=A0 0x07,0x00,0x00,0x00, =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0// Common<br>=C2=A0 =C2=A0 =C2=A0 =
=C2=A0 0x40,0x41,0x42,0x43,0x44,0x45,0x46,0x47 =C2=A0 // IV<br>=C2=A0 =C2=
=A0 };<br><br>=C2=A0 =C2=A0 byte ct[sizeof(pt)], rt[sizeof(ct)], mac[16];<b=
r><br>=C2=A0 =C2=A0 ChaCha20Poly1305::Encryption enc;<br>=C2=A0 =C2=A0 enc.=
SetKeyWithIV(key, sizeof(key), iv, sizeof(iv));<br>=C2=A0 =C2=A0 enc.Encryp=
tAndAuthenticate(ct, mac, sizeof(mac), iv, sizeof(iv), aad, sizeof(aad), (c=
onst byte*)pt, sizeof(pt));<br><br>=C2=A0 =C2=A0 std::cout << "P=
lain: \n";<br>=C2=A0 =C2=A0 StringSource((const byte*)pt, sizeof(pt), =
true, new HexEncoder(new FileSink(std::cout)));<br>=C2=A0 =C2=A0 std::cout =
<< "\n" << std::endl;<br><br>=C2=A0 =C2=A0 std::cout =
<< "Cipher: \n";<br>=C2=A0 =C2=A0 <br>=C2=A0 =C2=A0 for (in=
t i =3D 0; i < sizeof(ct); ++i) {<br><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 std=
::cout << (uint)ct[i] << " ";<br><br>=C2=A0 =C2=A0 }<=
br><br>=C2=A0 =C2=A0 std::cout << std::endl;<br>=C2=A0 =C2=A0 <br>=C2=
=A0 =C2=A0 std::cout << "\nMAC: \n";<br>=C2=A0 =C2=A0 Strin=
gSource(mac, sizeof(mac), true, new HexEncoder(new FileSink(std::cout)));<b=
r>=C2=A0 =C2=A0 std::cout << "\n" << std::endl;<br><b=
r>=C2=A0 =C2=A0 ChaCha20Poly1305::Decryption dec;<br>=C2=A0 =C2=A0 dec.SetK=
eyWithIV(key, sizeof(key), iv, sizeof(iv));<br>=C2=A0 =C2=A0 dec.DecryptAnd=
Verify(rt, mac, sizeof(mac), iv, sizeof(iv), aad, sizeof(aad), ct, sizeof(c=
t));<br><br>=C2=A0 =C2=A0 std::cout << "Recover: ";<br><br>=
=C2=A0 =C2=A0 StringSource(rt, sizeof(rt), true, new HexEncoder(new FileSin=
k(std::cout)));<br><br>=C2=A0 =C2=A0 std::cout << std::endl;<br><br>=
=C2=A0 =C2=A0 return 0;<br>}</font><br><br><div><u><b>test.go</b></u></div>=
<div><u><br></u></div><div><font color=3D"#008000">package main<br><br>impo=
rt (<br><span style=3D"white-space:pre"> </span>"crypto/cipher"<b=
r><br><span style=3D"white-space:pre"> </span>"fmt"<br><br><span =
style=3D"white-space:pre"> </span>"<a href=3D"http://golang.org/x/cryp=
to/chacha20poly1305" target=3D"_blank" rel=3D"nofollow" data-saferedirectur=
l=3D"https://www.google.com/url?hl=3Den&q=3Dhttp://golang.org/x/crypto/=
chacha20poly1305&source=3Dgmail&ust=3D1699431246378000&usg=3DAO=
vVaw2Z1C_qQFRaQF8EhZdGwm8Y">golang.org/x/crypto/chacha20poly1305</a>"<=
br>)<br><br>// Encryption.<br>var (<br><br><span style=3D"white-space:pre">=
</span>key []byte<br><span style=3D"white-space:pre"> </span>encryptedMsg =
[]byte<br><span style=3D"white-space:pre"> </span>aead cipher.AEAD<br><br>)=
<br><br>func remove(slice []byte, s int) []byte {<br>=C2=A0 =C2=A0 return a=
ppend(slice[:s], slice[s+1:]...)<br>}<br><br>func EncrytionWithChaChaPoly()=
{<br><br><span style=3D"white-space:pre"> </span>msg :=3D make([]byte, 0)<=
br><span style=3D"white-space:pre"> </span>msg =3D append(msg, <br><span st=
yle=3D"white-space:pre"> </span><br><span style=3D"white-space:pre"> </sp=
an>0x4c,0x61,0x64,0x69,0x65,0x73,0x20,0x61,0x6e,0x64,0x20,0x47,0x65,0x6e,0x=
74,0x6c,<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 0x65,0x6d,0x65,0x6e,0x20,0x6f,0x66,=
0x20,0x74,0x68,0x65,0x20,0x63,0x6c,0x61,0x73,<br>=C2=A0 =C2=A0 =C2=A0 =C2=
=A0 0x73,0x20,0x6f,0x66,0x20,0x27,0x39,0x39,0x3a,0x20,0x49,0x66,0x20,0x49,0=
x20,0x63,<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 0x6f,0x75,0x6c,0x64,0x20,0x6f,0x66=
,0x66,0x65,0x72,0x20,0x79,0x6f,0x75,0x20,0x6f,<br>=C2=A0 =C2=A0 =C2=A0 =C2=
=A0 0x6e,0x6c,0x79,0x20,0x6f,0x6e,0x65,0x20,0x74,0x69,0x70,0x20,0x66,0x6f,0=
x72,0x20,<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 0x74,0x68,0x65,0x20,0x66,0x75,0x74=
,0x75,0x72,0x65,0x2c,0x20,0x73,0x75,0x6e,0x73,<br>=C2=A0 =C2=A0 =C2=A0 =C2=
=A0 0x63,0x72,0x65,0x65,0x6e,0x20,0x77,0x6f,0x75,0x6c,0x64,0x20,0x62,0x65,0=
x20,0x69,<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 0x74,0x2e,<br><span style=3D"white=
-space:pre"> </span><br><span style=3D"white-space:pre"> </span>)<br><br><s=
pan style=3D"white-space:pre"> </span>// Select a random nonce, and leave c=
apacity for the ciphertext.<br><span style=3D"white-space:pre"> </span>nonc=
e :=3D make([]byte, 0)<br><span style=3D"white-space:pre"> </span>nonce =3D=
append(nonce, 0x07,0x00,0x00,0x00, =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0// Common<br>=C2=A0 =C2=A0 =C2=A0 =C2=
=A0 0x40,0x41,0x42,0x43,0x44,0x45,0x46,0x47)<br><br><span style=3D"white-sp=
ace:pre"> </span>fmt.Println("Nonce:")<br><span style=3D"white-sp=
ace:pre"> </span>fmt.Println(nonce)<br><br><span style=3D"white-space:pre">=
</span>// Encrypt the message and append the ciphertext to the nonce.<br><=
span style=3D"white-space:pre"> </span>encryptedMsg =3D aead.Seal(nonce, no=
nce, msg, nil)<br><br><span style=3D"white-space:pre"> </span>fmt.Println(&=
quot;\nCipher:")<br><span style=3D"white-space:pre"> </span>fmt.Printl=
n(encryptedMsg)<br><br>}<br><br>// Decryption.<br>func DecryptionWithChaCha=
Poly(){<br><br><span style=3D"white-space:pre"> </span>if len(encryptedMsg)=
< aead.NonceSize() {<br><span style=3D"white-space:pre"> </span>panic(=
"ciphertext too short")<br><span style=3D"white-space:pre"> </spa=
n>}<br><br><span style=3D"white-space:pre"> </span>// Split nonce and ciphe=
rtext.<br><span style=3D"white-space:pre"> </span>nonce, ciphertext :=3D en=
cryptedMsg[:aead.NonceSize()], encryptedMsg[aead.NonceSize():]<br><br><span=
style=3D"white-space:pre"> </span>// Decrypt the message and check it wasn=
't tampered with.<br><span style=3D"white-space:pre"> </span>plaintext,=
err :=3D aead.Open(nil, nonce, ciphertext, nil)<br><span style=3D"white-sp=
ace:pre"> </span>if err !=3D nil {<br><span style=3D"white-space:pre"> </s=
pan>panic(err)<br><span style=3D"white-space:pre"> </span>}<br><br><span st=
yle=3D"white-space:pre"> </span>fmt.Println("\nRecover:")<br><spa=
n style=3D"white-space:pre"> </span>fmt.Printf("%s\n", plaintext)=
<br><br>}<br><br>func main(){<br><br><span style=3D"white-space:pre"> </spa=
n>var err error<br><br><span style=3D"white-space:pre"> </span>key =3D make=
([]byte, 0)<br><span style=3D"white-space:pre"> </span>key =3D append(key, =
0x80,0x81,0x82,0x83,0x84,0x85,0x86,0x87,0x88,0x89,0x8a,0x8b,0x8c,0x8d,0x8e,=
0x8f,<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 <span style=3D"white-space:pre"> </s=
pan>=C2=A0 0x90,0x91,0x92,0x93,0x94,0x95,0x96,0x97,0x98,0x99,0x9a,0x9b,0x9c=
,0x9d,0x9e,0x9f)<br><br><span style=3D"white-space:pre"> </span>aead, err =
=3D chacha20poly1305.New(key)<br><span style=3D"white-space:pre"> </span>if=
err !=3D nil {<br><span style=3D"white-space:pre"> </span>panic(err)<br><=
span style=3D"white-space:pre"> </span>}<br><br><span style=3D"white-space:=
pre"> </span>EncrytionWithChaChaPoly()<br><br><span style=3D"white-space:pr=
e"> </span>DecryptionWithChaChaPoly()<br><br>}</font><u><br></u></div><div>=
<font color=3D"#008000"><br></font></div><div><font color=3D"#000000">Here =
you are the output.<br>The highlighted text is the same of the Crypto++ out=
put.<br><br><img alt=3D"Screenshot 2023-11-06 234054.png" width=3D"1532px" =
height=3D"384px" src=3D"https://groups.google.com/group/cryptopp-users/atta=
ch/63b465d2dad90/Screenshot%202023-11-06%20234054.png?part=3D0.2&view=
=3D1"><br></font></div></div><div><font color=3D"#000000"><br></font></div>=
<div><font color=3D"#000000">I think the 16 bytes at the end are part of th=
e <i>Seal</i> function and corresponds to the <i>additionalData </i>paramet=
er as shown in the next pic.<br>Maybe the function still do something with =
a null pointer, so it will append those bytes to the ciphertext anyway.</fo=
nt></div><div><font color=3D"#000000"><br></font></div><div><font color=3D"=
#000000"><img alt=3D"Screenshot 2023-11-06 234437.png" width=3D"1281px" hei=
ght=3D"213px" src=3D"https://groups.google.com/group/cryptopp-users/attach/=
63b465d2dad90/Screenshot%202023-11-06%20234437.png?part=3D0.1&view=3D1"=
><br></font></div><div><font color=3D"#000000"><br></font></div><div><font =
color=3D"#000000">Looks like <i>Seal </i>is doing something like this: <b>N=
once </b>+ <b>Ciphertext </b>+ <b>AdditionalData(?)</b></font></div><div><f=
ont color=3D"#000000">Any ideas?</font></div><div></div><div class=3D"gmail=
_quote"><div dir=3D"auto" class=3D"gmail_attr">On Sunday, November 5, 2023 =
at 8:26:27=E2=80=AFPM UTC+1 Jeffrey Walton wrote:<br></div><blockquote clas=
s=3D"gmail_quote" style=3D"margin:0 0 0 0.8ex;border-left:1px solid rgb(204=
,204,204);padding-left:1ex"><div dir=3D"ltr"><div class=3D"gmail_quote"><di=
v dir=3D"ltr" class=3D"gmail_attr">On Sun, Nov 5, 2023 at 4:38=E2=80=AFAM L=
ucas Marchetti <<a rel=3D"nofollow">[email protected]</a>> wrote:<b=
r></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex=
;border-left:1px solid rgb(204,204,204);padding-left:1ex">Sorry, seeing now=
that I've linked the wrong Golang library, here it is:=C2=A0<a href=3D=
"https://pkg.go.dev/golang.org/x/crypto/chacha20poly1305" rel=3D"nofollow" =
target=3D"_blank" data-saferedirecturl=3D"https://www.google.com/url?hl=3De=
n&q=3Dhttps://pkg.go.dev/golang.org/x/crypto/chacha20poly1305&sourc=
e=3Dgmail&ust=3D1699431246378000&usg=3DAOvVaw10Tblr9W2OOcyliIEHPx9M=
">https://pkg.go.dev/golang.org/x/crypto/chacha20poly1305</a><br><br><div c=
lass=3D"gmail_quote"><div dir=3D"auto" class=3D"gmail_attr">On Sunday, Nove=
mber 5, 2023 at 10:10:44=E2=80=AFAM UTC+1 Lucas Marchetti wrote:<br></div><=
blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-l=
eft:1px solid rgb(204,204,204);padding-left:1ex">I've just made a test =
encrypting the string "Hello World!" with both client and server =
functions and these are the results.<div><br></div><div><img alt=3D"Screens=
hot 2023-11-05 100312.png" width=3D"726px" height=3D"111px" src=3D"https://=
groups.google.com/group/cryptopp-users/attach/5b1bbc5faec59/Screenshot%2020=
23-11-05%20100312.png?part=3D0.1&view=3D1"></div><div><br></div><div>Bo=
th green-highlighted bytes corresponds to the input string but, as you can =
see, there is a different padding that I'm 100% sure is the source of t=
he problem.<br><br></div><div class=3D"gmail_quote"><div dir=3D"auto" class=
=3D"gmail_attr">On Saturday, November 4, 2023 at 7:39:31=E2=80=AFPM UTC+1 L=
ucas Marchetti wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"m=
argin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left=
:1ex">Good evening.<br><br>I'm building a client-server application and=
I want to implement a XChaCha20 communication over TCP after performing ke=
y exchange.<br><br>What I'm issuing is a bad decryption output like the=
one shown in the pic.<br><br><img alt=3D"Screenshot 2023-11-04 193625.png"=
width=3D"266px" height=3D"19px" src=3D"https://groups.google.com/group/cry=
ptopp-users/attach/58230e8ec9c5a/Screenshot%202023-11-04%20193625.png?part=
=3D0.1&view=3D1"><br><div><br></div><div>I'm currently using crypto=
++ 8.9 in the client-side and=C2=A0<a href=3D"https://pkg.go.dev/golang.org=
/x/crypto/chacha20" rel=3D"nofollow" target=3D"_blank" data-saferedirecturl=
=3D"https://www.google.com/url?hl=3Den&q=3Dhttps://pkg.go.dev/golang.or=
g/x/crypto/chacha20&source=3Dgmail&ust=3D1699431246378000&usg=
=3DAOvVaw0xAshajaImFyv6bxsWJ8SX">https://pkg.go.dev/golang.org/x/crypto/cha=
cha20</a> in the server-side.<div><br></div><div>Is that something related =
to sealing or authentication implemented in the Golang library?</div></div>=
<div><br></div><div>Functions that I'm using:</div><div><br></div><div>=
<img alt=3D"Screenshot 2023-11-04 193751.png" width=3D"534px" height=3D"197=
px" src=3D"https://groups.google.com/group/cryptopp-users/attach/58230e8ec9=
c5a/Screenshot%202023-11-04%20193751.png?part=3D0.3&view=3D1"><br></div=
><div><br></div><div><img alt=3D"Screenshot 2023-11-04 193832.png" width=3D=
"534px" height=3D"197px" src=3D"https://groups.google.com/group/cryptopp-us=
ers/attach/58230e8ec9c5a/Screenshot%202023-11-04%20193832.png?part=3D0.2&am=
p;view=3D1"><br></div><div><br></div><div>Thanks in advance.</div></blockqu=
ote></div></blockquote></div>
<p></p></blockquote></div></div><div dir=3D"ltr"><div class=3D"gmail_quote"=
><div>If you want help, then you should provide source code and post a link=
to a minimal reproducer. Pictures are not helpful.</div><div><br></div><di=
v>The wiki is full of little working examples. For example, <<a href=3D"=
https://www.cryptopp.com/wiki/XChaCha20" rel=3D"nofollow" target=3D"_blank"=
data-saferedirecturl=3D"https://www.google.com/url?hl=3Den&q=3Dhttps:/=
/www.cryptopp.com/wiki/XChaCha20&source=3Dgmail&ust=3D1699431246378=
000&usg=3DAOvVaw0GhCWrhCMGInbTPxJycJHK">https://www.cryptopp.com/wiki/X=
ChaCha20</a>> and <<a href=3D"https://www.cryptopp.com/wiki/XChaCha20=
Poly1305" rel=3D"nofollow" target=3D"_blank" data-saferedirecturl=3D"https:=
//www.google.com/url?hl=3Den&q=3Dhttps://www.cryptopp.com/wiki/XChaCha2=
0Poly1305&source=3Dgmail&ust=3D1699431246378000&usg=3DAOvVaw3X9=
KIxpY5_zY9cuxOYATuO">https://www.cryptopp.com/wiki/XChaCha20Poly1305</a>>=
;.</div><div><br></div><div>You should also probably start with test vector=
s, and then move onto arbitrary messages once things work with test vectors=
. Here are the ones Crypto++ uses for XChaCha: <<a href=3D"https://githu=
b.com/weidai11/cryptopp/blob/master/TestVectors/chacha.txt" rel=3D"nofollow=
" target=3D"_blank" data-saferedirecturl=3D"https://www.google.com/url?hl=
=3Den&q=3Dhttps://github.com/weidai11/cryptopp/blob/master/TestVectors/=
chacha.txt&source=3Dgmail&ust=3D1699431246378000&usg=3DAOvVaw3M=
eXhHZttAMKs24euHFcl-">https://github.com/weidai11/cryptopp/blob/master/Test=
Vectors/chacha.txt</a>>. And here are the ones for ChaCha20/Poly1305: &l=
t;<a href=3D"https://github.com/weidai11/cryptopp/blob/master/TestVectors/c=
hacha20poly1305.txt#L4669" rel=3D"nofollow" target=3D"_blank" data-saferedi=
recturl=3D"https://www.google.com/url?hl=3Den&q=3Dhttps://github.com/we=
idai11/cryptopp/blob/master/TestVectors/chacha20poly1305.txt%23L4669&so=
urce=3Dgmail&ust=3D1699431246378000&usg=3DAOvVaw3liy90rISmW8ztGMMFU=
yHb">https://github.com/weidai11/cryptopp/blob/master/TestVectors/chacha20p=
oly1305.txt#L4669</a>>.</div><div><br></div><div>I'm just guessing, =
but the 16-bytes of garbage at the end of the=20
[encrypted] message may be a Poly1305 authentication tag. But it is just
a guess. The go documentation should tell you what you have.</div><div><br=
></div><div>Jeff<br></div></div></div>
</blockquote></div></blockquote></div>
<p></p>
-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;Crypto++ Users" group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:[email protected]">cryp=
[email protected]</a>.<br />
To view this discussion on the web visit <a href=3D"https://groups.google.c=
om/d/msgid/cryptopp-users/455def34-d321-4f2c-a297-197b96410d72n%40googlegro=
ups.com?utm_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/d=
/msgid/cryptopp-users/455def34-d321-4f2c-a297-197b96410d72n%40googlegroups.=
com</a>.<br />
------=_Part_33349_465201276.1699345290254--
------=_Part_33348_2042138835.1699345290254--