15
$\begingroup$

We are all aware of Google's approach to introduce ChaCha/Poly1305 as TLS cipher suite. The rationale seems clear: ChaCha is newer and seems to provide better security (and maybe speed?) gained from the experiences of the design of Salsa20.

But in his "recent" paper McBits: fast constant-time code-based cryptography (basically code-based ECIES) Bernstein (the inventor of Salsa20 and ChaCha), Chou and Schwabe used Salsa20 as standard primitive for McBits and not ChaCha.

So what are the reasons to prefer Salsa20 over ChaCha?

$\endgroup$
  • 1
    $\begingroup$ I'm not fully sure if this is "primarily opinion-based" or could be considered "not answerable", but I think that the rationale behind preferring salsa20 should be "obvious" / "transparent" for such an "important" PKCS. $\endgroup$ – SEJPM Jul 18 '15 at 20:08
  • $\begingroup$ Probably (as DJ BERNSTEIN claimed himself), ChaCha is a variant of salsa20 As he wrote many papers with many versions on this subject, he need time to stabilize them. $\endgroup$ – Robert NACIRI Jul 18 '15 at 21:13
  • 1
    $\begingroup$ It is my recollection that the advantage of ChaCha is slightly better diffusion per round, and a modified round structure that allows better performance when certain SSE instructions are available $\endgroup$ – Richie Frame Jul 18 '15 at 22:36
8
$\begingroup$

I agree that conservatism is the likely reason for the choice in McBits.

ChaCha was published while eSTREAM was still running. Salsa20/12 is now in the final eSTREAM portfolio. Even in the XSalsa paper on constructing a larger nonce, Bernstein makes no mention of ChaCha.

So what are the reasons to prefer Salsa20 over ChaCha?

Wanting to use a standardized algorithm is one reason. Choosing the more exhaustively studied algorithm is another good one.

If you have your tinfoil hat on, you might also prefer to avoid any tweaks in the absence of real breaks. After all, tweaking the cipher would be an opportunity to introduce new back doors.

$\endgroup$
4
$\begingroup$

Salsa20 saw lots of cryptanalysis. If I recall correctly Chacha20 was only analyzed by two papers prior to getting into TLS. Some people may think that this was a bit hasty even given its heritage. I wouldn't be surprised if DJB (Daniel J. Bernstein) is simply being conservative.

$\endgroup$
  • $\begingroup$ Wasn't ChaCha20 proven to be no less secure than the Salsa20 core? $\endgroup$ – forest Mar 12 '18 at 3:54
  • $\begingroup$ That would be a simply amazing proof - I doubt it is even possible. "For all possible attacks, under all possible security profiles, show one algorithm is more secure than the other." ChaCha20 was designed as a delta, more or less, to Salsa20 and intended to remove some quibbles while increasing diffusion - so a general notion of "no less secure" isn't entirely unwarranted. $\endgroup$ – Thomas M. DuBuisson Mar 12 '18 at 5:06
  • $\begingroup$ Ah, it seems like I was thinking of XSalsa20 which does indeed have a security proof. $\endgroup$ – forest Mar 24 '18 at 23:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.