2
$\begingroup$

ChaCha8 takes a 8 byte nonce (or IV) that should not be the same twice for the same key. Generating this nonce randomly makes me very very nervous for collisions.

Is it safe to generate this nonce deterministically?

For example the first 6 bytes could be the number of milliseconds since the Unix epoch, with the last 2 bytes being an unsigned counter wrapping around. This will prevent any collisions from happening for 9000 years if no more than 65535 streams get encrypted in a millisecond (things get more complicated if the same encryption key is being used by multiple machines/threads, but let's ignore that for now).

Improve this question
$\endgroup$
4
  • $\begingroup$ Use a larger nonce. See XSalsa20. Will post more tomorrow. $\endgroup$
    – CodesInChaos
    Mar 1, 2013 at 22:47
  • $\begingroup$ You could expand the nonce size to 192 bits, similar to how XSalsa20 expands the nonce size of Salsa. $\endgroup$
    – CodesInChaos
    Jun 1, 2016 at 17:19
  • $\begingroup$ @CodesInChaos "tomorrow" :P $\endgroup$
    – orlp
    Jun 1, 2016 at 17:43
  • $\begingroup$ Procrastination... $\endgroup$
    – CodesInChaos
    Jun 1, 2016 at 17:46

2 Answers 2

Reset to default
6
$\begingroup$

Yes, it is safe. The only requirement for the nonce in Salsa/Chacha is to be unique; being predictable is not an issue, so a counter is fine.

Like CodesInChaos indicated, I believe extending XSalsa20 to XChaCha20 would also work if you want to a larger nonce, but have nothing concrete so will leave the details to him/her.

Improve this answer
$\endgroup$
-3
$\begingroup$

Looking at the reference implementation, it looks like the IV is 64 bytes, not 8. In ECRYPT_ivsetup, it's a pointer to uint8_t, which is then treated as a pair of quartets (e.g., 8) of 8-byte values.

Improve this answer
$\endgroup$
4
  • $\begingroup$ You're misunderstanding something. Input to the permutation is 64 bytes, but that includes key, stream-id(nonce), offset and a constant. $\endgroup$
    – CodesInChaos
    Mar 1, 2013 at 22:40
  • $\begingroup$ And chacha operates on 16 words with 4 bytes each. Iv setup sets the offset to 0, and sets the 8 byte nonce. $\endgroup$
    – CodesInChaos
    Mar 1, 2013 at 23:07
  • $\begingroup$ Apologies. I wasn't able to find any real documentation on chacha, so went to the source. I've obviously misread something in the implementation. $\endgroup$
    – Stephen Touset
    Mar 1, 2013 at 23:42
  • $\begingroup$ While ChaCha doesn't have much documentation, you can look at Salsa20's documentation. They're almost identical. $\endgroup$
    – CodesInChaos
    Mar 2, 2013 at 10:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.