Change Go's website address

[nncp.git] / doc / eblob.texi

diff --git a/doc/eblob.texi b/doc/eblob.texi
index 06c4a452a2bdbf2f2de9ede3d744af1330d34b0c..3a5c08d79659fc858b49217f9d66c3a2a1d55944 100644 (file)
--- a/doc/eblob.texi
+++ b/doc/eblob.texi
@@ -1,7 +1,7 @@
 @node EBlob
 @unnumbered EBlob format
 
-Eblob is an encrypted blob (binary large object, in the terms of
+EBlob is an encrypted blob (binary large object, in the terms of
 databases), holding any kind of symmetrically encrypted data with the
 passphrase used to derive the key. It is used to secure configuration
 files, holding valuable private keys, allowing them to be transferred
@@ -29,19 +29,19 @@ attacks and seems more secure than Argon2
 (@url{https://password-hashing.net/, Password Hashing Competition}
 winner).
 
-Eblob is an @url{https://tools.ietf.org/html/rfc4506, XDR}-encoded structure:
+EBlob is an @url{https://tools.ietf.org/html/rfc4506, XDR}-encoded structure:
 
 @verbatim
-+-------+------------------+------------+
-| MAGIC | S | T | P | SALT | BLOB | MAC |
-+-------+------------------+------------+
++-------+------------------+------+
+| MAGIC | S | T | P | SALT | BLOB |
++-------+------------------+------+
 @end verbatim
 
 @multitable @columnfractions 0.2 0.3 0.5
 @headitem @tab XDR type @tab Value
 @item Magic number @tab
     8-byte, fixed length opaque data @tab
-    @verb{|N N C P B 0x00 0x00 0x01|}
+    @verb{|N N C P B 0x00 0x00 0x03|}
 @item S, T, P @tab
     unsigned integer @tab
     Space cost, time cost and parallel jobs number
@@ -50,15 +50,12 @@ Eblob is an @url{https://tools.ietf.org/html/rfc4506, XDR}-encoded structure:
     Randomly generated salt
 @item Blob @tab
     variable length opaque data @tab
-    Encrypted data itself
-@item MAC @tab
-    32 bytes, fixed length opaque data @tab
-    BLAKE2b-256 MAC of encrypted blob
+    Authenticated and Encrypted data itself
 @end multitable
 
-Blob's encryption is done using @url{https://cr.yp.to/chacha.html,
-ChaCha20} algorithm. Data is splitted on 128 KiB blocks. Each block is
-encrypted with increasing nonce counter. @code{balloon(BLAKE2b-256, S,
-T, P, salt, password)} gives the main key, that is fed to
-@url{https://blake2.net/, BLAKE2Xb} XOF Actual encryption key for
-ChaCha20 and authentication key for MAC are derived from that XOF.
+@enumerate
+@item generate the key using @code{balloon(BLAKE2b-256, S, T, P, salt, password)}
+@item encrypt and authenticate blob using
+    @url{https://cr.yp.to/chacha.html, ChaCha20}-@url{https://en.wikipedia.org/wiki/Poly1305, Poly1305}.
+    EBlob packet itself, with empty blob field, is fed as an additional authenticated data
+@end enumerate