Enable CHACHA20-Draft Version in Openssl 1.1.0 and later

[Jemmy1228]

The Cloudflare patch can enable Both CHACHA20-RFC(0xcca8-0xccaa) ciphers and CHACH20-Draft(0xcc13-0xcc15) ciphers in Openssl 1.0.2f-j
I tried to make the Cloudflare patch compatible with Openssl-1.1.1-pre9 by myself, by adding the CHACHA-Draft back to it, but I met a lot of difficulties and caused many errors.
Can you please make such a patch that enable both the RFC and Draft CHACHA20 ciphers in Openssl 1.1.0
I think it would be very useful for everyone

[hakasenyang]

I think it's useful, but the draft version is obsolete.
As of 1.1.0, chacha20 supports the rfc version, not the draft version.

1.0.2 and 1.1.1 have a lot of differences, which makes it difficult to patch.

I will try, but I do not know if it is possible.

P.S. Google(google.com, etc.) has already removed OLD CHACHA from SSL Cipher.

Sorry my poor english.

[Jemmy1228]

Though draft version ciphers are obsolete, they are still secure.
As far as I know, Cloudflare is still using Draft version ciphers to perform handshake with Android 6 devices.
No matter is it possible or not, thank you very much. And I've learnt a lot from your patches.
p.s. I'm not a English speaker as well! :)

[hamjin]

Also, old device with old Android(like 5.0 and 6.0) can only use chacha20-draft

[hakasenyang]

I tried to support the CHACHA draft and the CHACHA draft handshake succeeded, but subsequent encryption and decryption failed.

It's too hard. :(

It is recommended to use AES because AES also guarantees sufficient safety... :-)

[hamjin]

You can see boringssl branch 2987 (git clone -b 2987 https://github.com/google/boringssl )and clousflare's patch(https://github.com/cloudflare/sslconfig/ )

[hamjin]

But you need to know that cloudflare's patc use AVX/AVX2 and SSE4 that could not work on some server(like Raspberry Pi, old Intel/AMD Proccers and ALL OF ARM DEVICES)
EDIT:Now I tested the pure C code in the patch and it is ok for all devices with a super fast speed

[hakasenyang]

I have searched for related materials, but for me, assembly is too difficult.

I am currently consulting documentation on encryption and decryption after handshaking.

[hamjin]

Thank you!

[hamjin]

Encryption and decryption after handshaking is more difficult than handshake... You can read the code in BoringSSL branch 2987, it's a good example that it has both RFC version and Draft version.

[Jemmy1228]

The documentation of Chacha-Draft is here
https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305-04

And the documentation of ChaCha-RFC version is here
https://tools.ietf.org/html/rfc7905

There isn't much difference between these two I think...
I've found a page that tells the differences here
https://blog.cloudflare.com/it-takes-two-to-chacha-poly/

I tried to rewrite the code with these documentations, but I can't even compile it successfully!

[hamjin]

The draft version is for old servers which have no SSE codes and AVX codes, that makes the code running almost all the devices

[ymshenyu]

maybe chrome or firefox on android 6 could use rfc chacha20 , and chrome support tls 1.3 draft28 now. @hakasenyang is that mean we dont need draft 23 anymore?

[hamjin]

@ymshenyu No, we need to make Internet safer and TLS1.3 draft23 26 28 is enough safe, so we needn't delete draft 23 support

[ymshenyu]

@railjty ok , actually draft 23 and 28 are draft standard so they are both safe i think , and android chrome still using draft 23 . android chrome did not release version 68 yet