18.4 Poly1305
Poly1305 is a message authentication code specified in RFC 8439 [131]. It takes a 256-bit one-time key k and an arbitrary length plaintext m, and produces a 128-bit tag used to authenticate message m.
The key k is partitioned into two parts, which RFC 8439 refers to as r and s. The pair (r,s) must be unique and unpredictable for each Poly1305 invocation. The 16-byte part r may be constant, but must undergo the following modification, referred to as clamping in RFC 8439:
The four highest bits of bytes 3, 7, 11, and 15 must be set to 0 (in other words, these bytes must be smaller than 16).
The two bottom bits of bytes 4, 8, and 12 must be set to 0 (in other words, these bytes must be divisible by 4).
Part s, the other 16-byte part of the secret key k, must be unpredictable. However, r and s can also be (pseudo)randomly generated for each new Poly1305 invocation.
Poly1305 pseudocode is shown in Algorithm 9. It takes a 256-bit one-time key and an arbitrary-size message...
