I'm currently examining the NaCl library written by Daniel J. Bernstein and I noticed that the library hard codes the sigma:
static const unsigned char sigma[16] = "expand 32-byte k";
In all the salsa stream implementations:
crypto_stream_xsalsa20
crypto_stream_salsa20
crypto_stream_salsa2012
crypto_stream_salsa208
and the crypto_box
library wrapper:
static const unsigned char sigma[16] = "expand 32-byte k";
static const unsigned char n[16] = {0};
int crypto_box_beforenm(
unsigned char *k,
const unsigned char *pk,
const unsigned char *sk
)
{
unsigned char s[32];
crypto_scalarmult_curve25519(s,sk,pk);
return crypto_core_hsalsa20(k,n,s,sigma);
}
As far as I understand from the paper the constant is used to expand the Stream Cipher.
Now:
- Why is this variable hardcoded in the library?
- Would it make sense to change this magic string to a different value?
- Edit: What are the security considerations of using the sigma as provided in the library?
Implementations can be found in the files:
crypto_box/curve25519xsalsa20poly1305/ref/before.c
crypto_stream/salsa2012/ref/xor.c
crypto_stream/salsa2012/ref/stream.c
crypto_stream/salsa20/ref/xor.c
crypto_stream/salsa20/ref/stream.c
crypto_stream/salsa208/ref/xor.c
crypto_stream/salsa208/ref/stream.c
crypto_stream/xsalsa20/ref/xor.c
crypto_stream/xsalsa20/ref/stream.c
Edit: I found the reference to this constant in the paper referenced above as "Salsa20" constant:
(x0; x5; x10; x15) = (0x61707865; 0x3320646e; 0x79622d32; 0x6b206574); in other words, (x0; x5; x10; x15) is the Salsa20 constant.
which is "expand 32-byte k" considering endianness.