Re: Re: XChaCha20 decryption issue.
Lucas Marchetti <[email protected]> Wed, 8 Nov 2023 07:25:07 -0800 (PST)
| Newsgroups | gmane.comp.encryption.cryptopp |
|---|---|
| Message-ID | <[email protected]> |
------=_Part_19394_1949197546.1699457107615
Content-Type: multipart/alternative;
boundary="----=_Part_19395_1390267647.1699457107615"
------=_Part_19395_1390267647.1699457107615
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Hi Jeff, thanks for the reply.
I've deleted the other messages cause I've found the solution by my own.
So, I've tested the whole thing with a test vector as you said and I found=
=20
out, looking to Golang library's source code, that the output given to me=
=20
was: *Nonce + Ciphertext + MAC*.
You were right: the last one was actually an authentication tag.
I decided to reimplement manually the *Seal *and *Open* functions removing=
=20
the MAC generation and append.
I think I'm gonna implement it back in a bit: I prefer to go without=20
authenticated encryption at the moment.
With a custom function I'm now able to remove the Nonce too and get the=20
clear ciphertext that I can finally decrypt using Crypto++.
Here is the source code of the changed functions.
func sliceForAppend(in []byte, n int) (head, tail []byte) {
if total :=3D len(in) + n; cap(in) >=3D total {
head =3D in[:total]
} else {
head =3D make([]byte, total)
copy(head, in)
}
tail =3D head[len(in):]
return
}
func sealGeneric(dst, nonce, plaintext []byte) []byte {
ret, out :=3D sliceForAppend(dst, len(plaintext))
ciphertext, _ :=3D out[:len(plaintext)], out[len(plaintext):]
var polyKey [32]byte
s, _ :=3D chacha20.NewUnauthenticatedCipher(key[:], nonce)
s.XORKeyStream(polyKey[:], polyKey[:])
s.SetCounter(1) // set the counter to 1, skipping 32 bytes
s.XORKeyStream(ciphertext, plaintext)
return ret
}
func openGeneric(dst, nonce, ciphertext []byte) ([]byte, error) {
var polyKey [32]byte
s, _ :=3D chacha20.NewUnauthenticatedCipher(key[:], nonce)
s.XORKeyStream(polyKey[:], polyKey[:])
s.SetCounter(1) // set the counter to 1, skipping 32 bytes
ret, out :=3D sliceForAppend(dst, len(ciphertext))
s.XORKeyStream(out, ciphertext)
return ret, nil
}
That's how I call encryption and decryption:
func EncrytionWithChaChaPoly() {
msg :=3D make([]byte, 0)
msg =3D append(msg,
0x4c,0x61,0x64,0x69,0x65,0x73,0x20,0x61,0x6e,0x64,0x20,0x47,0x65,0x6e,0x74,=
0x6c,
=20
0x65,0x6d,0x65,0x6e,0x20,0x6f,0x66,0x20,0x74,0x68,0x65,0x20,0x63,0x6c,0x61,=
0x73,
=20
0x73,0x20,0x6f,0x66,0x20,0x27,0x39,0x39,0x3a,0x20,0x49,0x66,0x20,0x49,0x20,=
0x63,
=20
0x6f,0x75,0x6c,0x64,0x20,0x6f,0x66,0x66,0x65,0x72,0x20,0x79,0x6f,0x75,0x20,=
0x6f,
=20
0x6e,0x6c,0x79,0x20,0x6f,0x6e,0x65,0x20,0x74,0x69,0x70,0x20,0x66,0x6f,0x72,=
0x20,
=20
0x74,0x68,0x65,0x20,0x66,0x75,0x74,0x75,0x72,0x65,0x2c,0x20,0x73,0x75,0x6e,=
0x73,
=20
0x63,0x72,0x65,0x65,0x6e,0x20,0x77,0x6f,0x75,0x6c,0x64,0x20,0x62,0x65,0x20,=
0x69,
0x74,0x2e,
)
nonce :=3D make([]byte, 0)
nonce =3D append(nonce,=20
0x07,0x00,0x00,0x00,0x40,0x41,0x42,0x43,0x44,0x45,0x46,0x47,0x07,0x00,0x00,=
0x00,0x40,0x41,0x42,0x43,0x44,0x45,0x46,0x47)
fmt.Println("Nonce:")
fmt.Println(nonce)
// Encrypt the message and append the ciphertext to the nonce.
encryptedMsg =3D sealGeneric(nonce, nonce, msg)
fmt.Println("\nCipher:")
fmt.Println(encryptedMsg)
fmt.Println(len(encryptedMsg))
}
func DecryptionWithChaChaPoly(){
if len(encryptedMsg) < aead.NonceSize() {
panic("ciphertext too short")
}
// Split nonce and ciphertext.
nonce, ciphertext :=3D encryptedMsg[:aead.NonceSize()],=20
encryptedMsg[aead.NonceSize():]
// Decrypt the message and check it wasn't tampered with.
plaintext, err :=3D openGeneric(nil, nonce, ciphertext)
if err !=3D nil {
panic(err)
}
fmt.Println("\nRecover:")
fmt.Printf("%s\n", plaintext)
}
Tell me if I did something wrong.
Thanks in advance.
On Sunday, November 5, 2023 at 8:26:27=E2=80=AFPM UTC+1 Jeffrey Walton wrot=
e:
> On Sun, Nov 5, 2023 at 4:38=E2=80=AFAM Lucas Marchetti <[email protected]=
om>=20
> wrote:
>
>> Sorry, seeing now that I've linked the wrong Golang library, here it is:=
=20
>> https://pkg.go.dev/golang.org/x/crypto/chacha20poly1305
>>
>> On Sunday, November 5, 2023 at 10:10:44=E2=80=AFAM UTC+1 Lucas Marchetti=
wrote:
>>
>>> I've just made a test encrypting the string "Hello World!" with both=20
>>> client and server functions and these are the results.
>>>
>>> [image: Screenshot 2023-11-05 100312.png]
>>>
>>> Both green-highlighted bytes corresponds to the input string but, as yo=
u=20
>>> can see, there is a different padding that I'm 100% sure is the source =
of=20
>>> the problem.
>>>
>>> On Saturday, November 4, 2023 at 7:39:31=E2=80=AFPM UTC+1 Lucas Marchet=
ti wrote:
>>>
>>>> Good evening.
>>>>
>>>> I'm building a client-server application and I want to implement a=20
>>>> XChaCha20 communication over TCP after performing key exchange.
>>>>
>>>> What I'm issuing is a bad decryption output like the one shown in the=
=20
>>>> pic.
>>>>
>>>> [image: Screenshot 2023-11-04 193625.png]
>>>>
>>>> I'm currently using crypto++ 8.9 in the client-side and=20
>>>> https://pkg.go.dev/golang.org/x/crypto/chacha20 in the server-side.
>>>>
>>>> Is that something related to sealing or authentication implemented in=
=20
>>>> the Golang library?
>>>>
>>>> Functions that I'm using:
>>>>
>>>> [image: Screenshot 2023-11-04 193751.png]
>>>>
>>>> [image: Screenshot 2023-11-04 193832.png]
>>>>
>>>> Thanks in advance.
>>>>
>>> If you want help, then you should provide source code and post a link t=
o=20
> a minimal reproducer. Pictures are not helpful.
>
> The wiki is full of little working examples. For example, <
> https://www.cryptopp.com/wiki/XChaCha20> and <
> https://www.cryptopp.com/wiki/XChaCha20Poly1305>.
>
> You should also probably start with test vectors, and then move onto=20
> arbitrary messages once things work with test vectors. Here are the ones=
=20
> Crypto++ uses for XChaCha: <
> https://github.com/weidai11/cryptopp/blob/master/TestVectors/chacha.txt>.=
=20
> And here are the ones for ChaCha20/Poly1305: <
> https://github.com/weidai11/cryptopp/blob/master/TestVectors/chacha20poly=
1305.txt#L4669
> >.
>
> I'm just guessing, but the 16-bytes of garbage at the end of the=20
> [encrypted] message may be a Poly1305 authentication tag. But it is just =
a=20
> guess. The go documentation should tell you what you have.
>
> Jeff
>
--=20
You received this message because you are subscribed to the Google Groups "=
Crypto++ Users" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/=
cryptopp-users/a8864354-51a6-4b4e-8763-24202c79a1e7n%40googlegroups.com.
------=_Part_19395_1390267647.1699457107615
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Hi Jeff, thanks for the reply.<br /><br />I've deleted the other messages c=
ause I've found the solution by my own.<div><br /></div><div>So, I've teste=
d the whole thing with a test vector as you said and I found out, looking t=
o Golang library's source code, that the output given to me was: <b>Nonce +=
Ciphertext + MAC</b>.</div><div>You were right: the last one was actually =
an authentication tag.</div><div><br /></div><div>I decided to reimplement =
manually the <i>Seal </i>and <i>Open</i>=C2=A0functions removing the MAC ge=
neration and append.</div><div>I think I'm gonna implement it back in a bit=
: I prefer to go without authenticated encryption at the moment.</div><div>=
<br /></div><div>With a custom function I'm now able to remove the Nonce to=
o and get the clear ciphertext that I can finally decrypt using Crypto++.</=
div><div><br /></div><div>Here is the source code of the changed functions.=
</div><div><br /></div><div><font color=3D"#008000">func sliceForAppend(in =
[]byte, n int) (head, tail []byte) {<br /><br /><span style=3D"white-space:=
pre;"> </span>if total :=3D len(in) + n; cap(in) >=3D total {<br /><br =
/><span style=3D"white-space: pre;"> </span>head =3D in[:total]<br /><br /=
><span style=3D"white-space: pre;"> </span>} else {<br /><br /><span style=
=3D"white-space: pre;"> </span>head =3D make([]byte, total)<br /><span sty=
le=3D"white-space: pre;"> </span>copy(head, in)<br /><br /><span style=3D"=
white-space: pre;"> </span>}<br /><br /><span style=3D"white-space: pre;"> =
</span>tail =3D head[len(in):]<br /><span style=3D"white-space: pre;"> </sp=
an>return<br /><br />}</font><br /></div><div><br /></div><div><font color=
=3D"#008000">func sealGeneric(dst, nonce, plaintext []byte) []byte {<br /><=
br /><span style=3D"white-space: pre;"> </span>ret, out :=3D sliceForAppend=
(dst, len(plaintext))<br /><span style=3D"white-space: pre;"> </span>cipher=
text, _ :=3D out[:len(plaintext)], out[len(plaintext):]<br /><br /><span st=
yle=3D"white-space: pre;"> </span>var polyKey [32]byte<br /><span style=3D"=
white-space: pre;"> </span>s, _ :=3D chacha20.NewUnauthenticatedCipher(key[=
:], nonce)<br /><span style=3D"white-space: pre;"> </span>s.XORKeyStream(po=
lyKey[:], polyKey[:])<br /><span style=3D"white-space: pre;"> </span>s.SetC=
ounter(1) // set the counter to 1, skipping 32 bytes<br /><span style=3D"wh=
ite-space: pre;"> </span>s.XORKeyStream(ciphertext, plaintext)<br /><br /><=
span style=3D"white-space: pre;"> </span>return ret<br /><br />}<br /><br /=
>func openGeneric(dst, nonce, ciphertext []byte) ([]byte, error) {<br /><br=
/><span style=3D"white-space: pre;"> </span>var polyKey [32]byte<br /><spa=
n style=3D"white-space: pre;"> </span>s, _ :=3D chacha20.NewUnauthenticated=
Cipher(key[:], nonce)<br /><span style=3D"white-space: pre;"> </span>s.XORK=
eyStream(polyKey[:], polyKey[:])<br /><span style=3D"white-space: pre;"> </=
span>s.SetCounter(1) // set the counter to 1, skipping 32 bytes<br /><br />=
<span style=3D"white-space: pre;"> </span>ret, out :=3D sliceForAppend(dst,=
len(ciphertext))<br /><br /><span style=3D"white-space: pre;"> </span>s.XO=
RKeyStream(out, ciphertext)<br /><br /><span style=3D"white-space: pre;"> <=
/span>return ret, nil<br /><br />}<br /></font></div><div><br /></div><div>=
That's how I call encryption and decryption:</div><div><br /></div><div><fo=
nt color=3D"#008000">func EncrytionWithChaChaPoly() {<br /><br /><span styl=
e=3D"white-space: pre;"> </span>msg :=3D make([]byte, 0)<br /><span style=
=3D"white-space: pre;"> </span>msg =3D append(msg,<br /><span style=3D"whit=
e-space: pre;"> </span><br /><span style=3D"white-space: pre;"> </span>0x=
4c,0x61,0x64,0x69,0x65,0x73,0x20,0x61,0x6e,0x64,0x20,0x47,0x65,0x6e,0x74,0x=
6c,<br />=C2=A0 =C2=A0 =C2=A0 =C2=A0 0x65,0x6d,0x65,0x6e,0x20,0x6f,0x66,0x2=
0,0x74,0x68,0x65,0x20,0x63,0x6c,0x61,0x73,<br />=C2=A0 =C2=A0 =C2=A0 =C2=A0=
0x73,0x20,0x6f,0x66,0x20,0x27,0x39,0x39,0x3a,0x20,0x49,0x66,0x20,0x49,0x20=
,0x63,<br />=C2=A0 =C2=A0 =C2=A0 =C2=A0 0x6f,0x75,0x6c,0x64,0x20,0x6f,0x66,=
0x66,0x65,0x72,0x20,0x79,0x6f,0x75,0x20,0x6f,<br />=C2=A0 =C2=A0 =C2=A0 =C2=
=A0 0x6e,0x6c,0x79,0x20,0x6f,0x6e,0x65,0x20,0x74,0x69,0x70,0x20,0x66,0x6f,0=
x72,0x20,<br />=C2=A0 =C2=A0 =C2=A0 =C2=A0 0x74,0x68,0x65,0x20,0x66,0x75,0x=
74,0x75,0x72,0x65,0x2c,0x20,0x73,0x75,0x6e,0x73,<br />=C2=A0 =C2=A0 =C2=A0 =
=C2=A0 0x63,0x72,0x65,0x65,0x6e,0x20,0x77,0x6f,0x75,0x6c,0x64,0x20,0x62,0x6=
5,0x20,0x69,<br />=C2=A0 =C2=A0 =C2=A0 =C2=A0 0x74,0x2e,<br /><span style=
=3D"white-space: pre;"> </span><br /><span style=3D"white-space: pre;"> </s=
pan>)<br /><br /><span style=3D"white-space: pre;"> </span>nonce :=3D make(=
[]byte, 0)<br /><span style=3D"white-space: pre;"> </span>nonce =3D append(=
nonce, 0x07,0x00,0x00,0x00,0x40,0x41,0x42,0x43,0x44,0x45,0x46,0x47,0x07,0x0=
0,0x00,0x00,0x40,0x41,0x42,0x43,0x44,0x45,0x46,0x47)<br /><br /><span style=
=3D"white-space: pre;"> </span>fmt.Println("Nonce:")<br /><span style=3D"wh=
ite-space: pre;"> </span>fmt.Println(nonce)<br /><br /><span style=3D"white=
-space: pre;"> </span>// Encrypt the message and append the ciphertext to t=
he nonce.<br /><span style=3D"white-space: pre;"> </span>encryptedMsg =3D s=
ealGeneric(nonce, nonce, msg)<br /><br /><span style=3D"white-space: pre;">=
</span>fmt.Println("\nCipher:")<br /><span style=3D"white-space: pre;"> </=
span>fmt.Println(encryptedMsg)<br /><span style=3D"white-space: pre;"> </sp=
an>fmt.Println(len(encryptedMsg))<br /><br />}<br /><br />func DecryptionWi=
thChaChaPoly(){<br /><br /><span style=3D"white-space: pre;"> </span>if len=
(encryptedMsg) < aead.NonceSize() {<br /><span style=3D"white-space: pre=
;"> </span>panic("ciphertext too short")<br /><span style=3D"white-space: =
pre;"> </span>}<br /><br /><span style=3D"white-space: pre;"> </span>// Spl=
it nonce and ciphertext.<br /><span style=3D"white-space: pre;"> </span>non=
ce, ciphertext :=3D encryptedMsg[:aead.NonceSize()], encryptedMsg[aead.Nonc=
eSize():]<br /><br /><span style=3D"white-space: pre;"> </span>// Decrypt t=
he message and check it wasn't tampered with.<br /><span style=3D"white-spa=
ce: pre;"> </span>plaintext, err :=3D openGeneric(nil, nonce, ciphertext)<b=
r /><br /><span style=3D"white-space: pre;"> </span>if err !=3D nil {<br />=
<span style=3D"white-space: pre;"> </span>panic(err)<br /><span style=3D"w=
hite-space: pre;"> </span>}<br /><br /><span style=3D"white-space: pre;"> <=
/span>fmt.Println("\nRecover:")<br /><span style=3D"white-space: pre;"> </s=
pan>fmt.Printf("%s\n", plaintext)<br /><br />}</font><br /></div><div><br /=
></div><div>Tell me if I did something wrong.<br /></div><div><br /></div><=
div>Thanks in advance.</div><div class=3D"gmail_quote"><div dir=3D"auto" cl=
ass=3D"gmail_attr">On Sunday, November 5, 2023 at 8:26:27=E2=80=AFPM UTC+1 =
Jeffrey Walton wrote:<br/></div><blockquote class=3D"gmail_quote" style=3D"=
margin: 0 0 0 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-lef=
t: 1ex;"><div dir=3D"ltr"><div class=3D"gmail_quote"><div dir=3D"ltr" class=
=3D"gmail_attr">On Sun, Nov 5, 2023 at 4:38=E2=80=AFAM Lucas Marchetti <=
<a href data-email-masked rel=3D"nofollow">[email protected]</a>> wrot=
e:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0=
.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Sorry, seeing=
now that I've linked the wrong Golang library, here it is:=C2=A0<a hre=
f=3D"https://pkg.go.dev/golang.org/x/crypto/chacha20poly1305" target=3D"_bl=
ank" rel=3D"nofollow" data-saferedirecturl=3D"https://www.google.com/url?hl=
=3Den&q=3Dhttps://pkg.go.dev/golang.org/x/crypto/chacha20poly1305&s=
ource=3Dgmail&ust=3D1699542599121000&usg=3DAOvVaw2A3quFG0km4lbK4Qet=
z7A-">https://pkg.go.dev/golang.org/x/crypto/chacha20poly1305</a><br><br><d=
iv class=3D"gmail_quote"><div dir=3D"auto" class=3D"gmail_attr">On Sunday, =
November 5, 2023 at 10:10:44=E2=80=AFAM UTC+1 Lucas Marchetti wrote:<br></d=
iv><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bord=
er-left:1px solid rgb(204,204,204);padding-left:1ex">I've just made a t=
est encrypting the string "Hello World!" with both client and ser=
ver functions and these are the results.<div><br></div><div><img alt=3D"Scr=
eenshot 2023-11-05 100312.png" width=3D"726px" height=3D"111px" src=3D"http=
s://groups.google.com/group/cryptopp-users/attach/5b1bbc5faec59/Screenshot%=
202023-11-05%20100312.png?part=3D0.1&view=3D1"></div><div><br></div><di=
v>Both green-highlighted bytes corresponds to the input string but, as you =
can see, there is a different padding that I'm 100% sure is the source =
of the problem.<br><br></div><div class=3D"gmail_quote"><div dir=3D"auto" c=
lass=3D"gmail_attr">On Saturday, November 4, 2023 at 7:39:31=E2=80=AFPM UTC=
+1 Lucas Marchetti wrote:<br></div><blockquote class=3D"gmail_quote" style=
=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding=
-left:1ex">Good evening.<br><br>I'm building a client-server applicatio=
n and I want to implement a XChaCha20 communication over TCP after performi=
ng key exchange.<br><br>What I'm issuing is a bad decryption output lik=
e the one shown in the pic.<br><br><img alt=3D"Screenshot 2023-11-04 193625=
.png" width=3D"266px" height=3D"19px" src=3D"https://groups.google.com/grou=
p/cryptopp-users/attach/58230e8ec9c5a/Screenshot%202023-11-04%20193625.png?=
part=3D0.1&view=3D1"><br><div><br></div><div>I'm currently using cr=
ypto++ 8.9 in the client-side and=C2=A0<a href=3D"https://pkg.go.dev/golang=
.org/x/crypto/chacha20" rel=3D"nofollow" target=3D"_blank" data-saferedirec=
turl=3D"https://www.google.com/url?hl=3Den&q=3Dhttps://pkg.go.dev/golan=
g.org/x/crypto/chacha20&source=3Dgmail&ust=3D1699542599121000&u=
sg=3DAOvVaw126qo5RyTcMEy_3z_9mNdP">https://pkg.go.dev/golang.org/x/crypto/c=
hacha20</a> in the server-side.<div><br></div><div>Is that something relate=
d to sealing or authentication implemented in the Golang library?</div></di=
v><div><br></div><div>Functions that I'm using:</div><div><br></div><di=
v><img alt=3D"Screenshot 2023-11-04 193751.png" width=3D"534px" height=3D"1=
97px" src=3D"https://groups.google.com/group/cryptopp-users/attach/58230e8e=
c9c5a/Screenshot%202023-11-04%20193751.png?part=3D0.3&view=3D1"><br></d=
iv><div><br></div><div><img alt=3D"Screenshot 2023-11-04 193832.png" width=
=3D"534px" height=3D"197px" src=3D"https://groups.google.com/group/cryptopp=
-users/attach/58230e8ec9c5a/Screenshot%202023-11-04%20193832.png?part=3D0.2=
&view=3D1"><br></div><div><br></div><div>Thanks in advance.</div></bloc=
kquote></div></blockquote></div>
<p></p></blockquote></div></div><div dir=3D"ltr"><div class=3D"gmail_quote"=
><div>If you want help, then you should provide source code and post a link=
to a minimal reproducer. Pictures are not helpful.</div><div><br></div><di=
v>The wiki is full of little working examples. For example, <<a href=3D"=
https://www.cryptopp.com/wiki/XChaCha20" target=3D"_blank" rel=3D"nofollow"=
data-saferedirecturl=3D"https://www.google.com/url?hl=3Den&q=3Dhttps:/=
/www.cryptopp.com/wiki/XChaCha20&source=3Dgmail&ust=3D1699542599121=
000&usg=3DAOvVaw28p7mrX3qiGZ4i2uro-Cfn">https://www.cryptopp.com/wiki/X=
ChaCha20</a>> and <<a href=3D"https://www.cryptopp.com/wiki/XChaCha20=
Poly1305" target=3D"_blank" rel=3D"nofollow" data-saferedirecturl=3D"https:=
//www.google.com/url?hl=3Den&q=3Dhttps://www.cryptopp.com/wiki/XChaCha2=
0Poly1305&source=3Dgmail&ust=3D1699542599121000&usg=3DAOvVaw1iA=
hBWmojRChBZBdiygB18">https://www.cryptopp.com/wiki/XChaCha20Poly1305</a>>=
;.</div><div><br></div><div>You should also probably start with test vector=
s, and then move onto arbitrary messages once things work with test vectors=
. Here are the ones Crypto++ uses for XChaCha: <<a href=3D"https://githu=
b.com/weidai11/cryptopp/blob/master/TestVectors/chacha.txt" target=3D"_blan=
k" rel=3D"nofollow" data-saferedirecturl=3D"https://www.google.com/url?hl=
=3Den&q=3Dhttps://github.com/weidai11/cryptopp/blob/master/TestVectors/=
chacha.txt&source=3Dgmail&ust=3D1699542599121000&usg=3DAOvVaw0t=
LAKPZoprMW1tXgO5L2Sg">https://github.com/weidai11/cryptopp/blob/master/Test=
Vectors/chacha.txt</a>>. And here are the ones for ChaCha20/Poly1305: &l=
t;<a href=3D"https://github.com/weidai11/cryptopp/blob/master/TestVectors/c=
hacha20poly1305.txt#L4669" target=3D"_blank" rel=3D"nofollow" data-saferedi=
recturl=3D"https://www.google.com/url?hl=3Den&q=3Dhttps://github.com/we=
idai11/cryptopp/blob/master/TestVectors/chacha20poly1305.txt%23L4669&so=
urce=3Dgmail&ust=3D1699542599121000&usg=3DAOvVaw0wznZGZN-FLo5bUjX1-=
TIH">https://github.com/weidai11/cryptopp/blob/master/TestVectors/chacha20p=
oly1305.txt#L4669</a>>.</div><div><br></div><div>I'm just guessing, =
but the 16-bytes of garbage at the end of the=20
[encrypted] message may be a Poly1305 authentication tag. But it is just
a guess. The go documentation should tell you what you have.</div><div><br=
></div><div>Jeff<br></div></div></div>
</blockquote></div>
<p></p>
-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;Crypto++ Users" group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:[email protected]">cryp=
[email protected]</a>.<br />
To view this discussion on the web visit <a href=3D"https://groups.google.c=
om/d/msgid/cryptopp-users/a8864354-51a6-4b4e-8763-24202c79a1e7n%40googlegro=
ups.com?utm_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/d=
/msgid/cryptopp-users/a8864354-51a6-4b4e-8763-24202c79a1e7n%40googlegroups.=
com</a>.<br />
------=_Part_19395_1390267647.1699457107615--
------=_Part_19394_1949197546.1699457107615--