Comment by iscoelho
9 hours ago
Replacing ChaCha20 with AES-GCM does not change the cryptographic guarantees of the WireGuard protocol whatsoever.
9 hours ago
Replacing ChaCha20 with AES-GCM does not change the cryptographic guarantees of the WireGuard protocol whatsoever.
Implementation requires different considerations, no? For example, AES-GCM needs to be supplied a big-endian nonce, whilst ChaPoly uses little-endian. As the WireGuard paper notes, ChaPoly (in software) can be better protected against (CPU) side-channels. Besides extended-nonce AEAD being "native" to ChaPoly, BLAKE family of hash functions that WireGuard uses, are also based on the same construction as ChaPoly, making the implementation leaner (something Jason keenly emphasizes as an advantage).
Endianness of a nonce in cryptography does not matter and the rest of your statements are nonsensical.
You used AI to write that, didn't you? Please don't do that, it's disrespectful.
No. I specifically said, "lose the formally-verified cryptography guarantees underpinning WireGuard & its implementation".
Anywho, given your strong conviction about this, try suggesting to Jason on the WireGuard mailing list to swap ChaPoly for AES-GCM or maintain a fork yourself. Good luck.