22
$\begingroup$

We are all aware of Google's approach to introduce ChaCha/Poly1305 as TLS cipher suite. The rationale seems clear: ChaCha is newer and seems to provide better security (and maybe speed?) gained from the experiences of the design of Salsa20.

But in his "recent" paper McBits: fast constant-time code-based cryptography (basically code-based ECIES) Bernstein (the inventor of Salsa20 and ChaCha), Chou and Schwabe used Salsa20 as standard primitive for McBits and not ChaCha.

So what are the reasons to prefer Salsa20 over ChaCha?

Improve this question
$\endgroup$
3
  • 1
    $\begingroup$ I'm not fully sure if this is "primarily opinion-based" or could be considered "not answerable", but I think that the rationale behind preferring salsa20 should be "obvious" / "transparent" for such an "important" PKCS. $\endgroup$
    – SEJPM
    Jul 18, 2015 at 20:08
  • $\begingroup$ Probably (as DJ BERNSTEIN claimed himself), ChaCha is a variant of salsa20 As he wrote many papers with many versions on this subject, he need time to stabilize them. $\endgroup$
    – Robert NACIRI
    Jul 18, 2015 at 21:13
  • 2
    $\begingroup$ It is my recollection that the advantage of ChaCha is slightly better diffusion per round, and a modified round structure that allows better performance when certain SSE instructions are available $\endgroup$
    – Richie Frame
    Jul 18, 2015 at 22:36

2 Answers 2

Reset to default
15
$\begingroup$

I agree that conservatism is the likely reason for the choice in McBits.

ChaCha was published while eSTREAM was still running. Salsa20/12 is now in the final eSTREAM portfolio. Even in the XSalsa paper on constructing a larger nonce, Bernstein makes no mention of ChaCha.

So what are the reasons to prefer Salsa20 over ChaCha?

Wanting to use a standardized algorithm is one reason. Choosing the more exhaustively studied algorithm is another good one.

If you have your tinfoil hat on, you might also prefer to avoid any tweaks in the absence of real breaks. After all, tweaking the cipher would be an opportunity to introduce new back doors.

Improve this answer
$\endgroup$
5
$\begingroup$

Salsa20 saw lots of cryptanalysis. If I recall correctly Chacha20 was only analyzed by two papers prior to getting into TLS. Some people may think that this was a bit hasty even given its heritage. I wouldn't be surprised if DJB (Daniel J. Bernstein) is simply being conservative.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Wasn't ChaCha20 proven to be no less secure than the Salsa20 core? $\endgroup$
    – forest
    Mar 12, 2018 at 3:54
  • $\begingroup$ That would be a simply amazing proof - I doubt it is even possible. "For all possible attacks, under all possible security profiles, show one algorithm is more secure than the other." ChaCha20 was designed as a delta, more or less, to Salsa20 and intended to remove some quibbles while increasing diffusion - so a general notion of "no less secure" isn't entirely unwarranted. $\endgroup$
    – Thomas M. DuBuisson
    Mar 12, 2018 at 5:06
  • $\begingroup$ Ah, it seems like I was thinking of XSalsa20 which does indeed have a security proof. $\endgroup$
    – forest
    Mar 24, 2018 at 23:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.