Length limits of encauth etc.

[sjaeckel]

As @karel-m pointed out in https://github.com/libtom/libtomcrypt/pull/211/files#r115594690 we have a possible issue in chacha20poly1305

Now when I am looking at the implementation the max length of our chacha20poly1305 is 2^64 bytes; however, in theory chacha20poly1305 has max length limit 2^70 bytes. The potentioal trouble might occur due to the fact that we do not check for reaching 2^64.

We should verify the existing implementations regarding such limitations.

The following encauth implementations exist, they should be marked as resolved after their implementation has been verified and/or fixed

• ccm
• chacha20poly1305
• eax
• gcm fixed in GCM counter incrementation isn't stopped at 2^32 blocks, which breaks GCM #129
• ocb
• ocb3

Should this list contain further elements, e.g. MAC's?

[sjaeckel]

CFRG is working on defining those limits in https://datatracker.ietf.org/doc/draft-irtf-cfrg-aead-limits/

Integration will be postponed until the RFC is finished.