6
$\begingroup$

Some of the encrypted messenger apps and password managers use extended version of Bernstein's ciphers and some of them not.

Viber-Salsa20

Wire-ChaCha20

Threema-XSalsa20

Sid-Salsa20

Nordpass-XChaCha20

Keepass-ChaCha20

Why? Does larger nonce make extended version more secure? if it is then why some of them not using extended one? or Can we say extended and non extended versions have equal security level?

$\endgroup$
1
  • $\begingroup$ Use XChaCha20 if you want to randomly generate nonces with the same key. If you rotate the key for each encryption or use a counter nonce, use regular (IETF) ChaCha20. Don't bother with the original (non-IETF) ChaCha20. $\endgroup$ Aug 17 at 8:48

1 Answer 1

6
$\begingroup$

The only difference is that XChaCha uses a 192-bit nonce rather than a 64-bit nonce. This allows you to use a random nonce without worrying about the risks of nonce-reuse, which makes picking nonces significantly easier and safer. The core of the cipher (the public permutation) is unchanged.

XChaCha is built on top of HChaCha:

XChaCha20 can be constructed from an existing ChaCha20 implementation and HChaCha20. All one needs to do is:

  1. Pass the key and the first 16 bytes of the 24-byte nonce to HChaCha20 to obtain the subkey.

  2. Use the subkey and remaining 8 byte nonce with ChaCha20 as normal (prefixed by 4 NUL bytes, since [RFC8439] specifies a 12-byte nonce).

And HChaCha is a small tweak to ChaCha:

HChaCha20 is initialized the same way as the ChaCha cipher, except that HChaCha20 uses a 128-bit nonce and has no counter. Instead, the block counter is replaced by the first 32 bits of the nonce.

Original ChaCha uses a 64-bit nonce and a 64-bit counter. IETF ChaCha uses a 96-bit nonce and a 32-bit counter (the larger nonce is so it can be generated randomly in TLS, and the smaller counter is acceptable because TLS records are limited to 16 KiB). XChaCha gets the best of both words, with a 192-bit nonce and a 64-bit counter. It's design is identical to that of XSalsa20, but with the ChaCha core. As the core is just a public permutation, the security proof for XSalsa20 applies to XChaCha.

$\endgroup$
2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.