For Java I'm only aware of the Bouncy Castle implementation of Salsa20. However, that version is significantly slower than AES-CTR and ARC4.
There are plenty of libraries in C, but are there any good implementations of this stream cipher in Java?
I doubt you will find a fast implementation of Salsa20 in Java (having spent much time attempting to achieve just this).
Salsa20 mutates a 512 bit state made up of 16 x 32 bit integers, which means that implementations that don't take advantage of SIMD (on Java or otherwise) will probably not perform well - there are too many independent state parts to keep them all in general purpose registers on any common architecture, so you inevitably incur load/store overhead, which kills your throughput.
Java (Hotspot at least) does a reasonable job of optimising all the basic operations (e.g. inlining, single instruction rotate etc.) but it doesn't have the smarts to dynamically do small scale SIMD optimisations.
I've tried various approaches to get around this: simulated SIMD by packing 32 bit integers into 64 bit longs (too many additional instructions); triggering hotspot vectorisation optimisations (too much array munging overhead), and didn't find anything that worked.
By comparison: Threefish 512, despite having the same state size uses 8 x 64 bit words, so on 64 bit Java the entire state can be held in registers, and the performance is ~150% the speed of AES.
The BouncyCastle Salsa20 implementation can be pushed a bit (by registerising the state as much as possible) to get it just faster than AES, but it's still woefully slow compared to implementations on SIMD capable platforms.
XSalsa20 and ChaCha will have the same issues, as they have the same basic structure.
|show 2 more comments|