3
$\begingroup$

I know that the ChaCha20 core (without the initial constant) is not an ideal PRP and must not be used as such. I also know that $\text{ChaChaCore}(0) = 0$. Are there any other differences?

$\endgroup$
1
  • 1
    $\begingroup$ 1) I think the ChaCha(0)=0 property generalizes to all words being identical. 2) ChaCha has obvious rotational symmetries. $\endgroup$ – CodesInChaos Mar 25 '16 at 10:21
7
$\begingroup$

It would be extremily surprising if the ChaCha core was a permutation (as the last P in PRP), although we have no proof it is not (if it was a permutation, it would at least be one we do not known how to invert, see this question).

A better approximation is that the ChaCha core behaves as a Pseudo-Random Function with the additional property $\text{ChaChaCore}(0)=0$. When we use as part of the input a constant secret key, the ChaCha core becomes a plausible Pseudo Random Function family.

The ChaCha core has less remarkable externally visible properties than the Salsa20 core has. $\text{ChaChaCore}(0)=0$ is a simple one. There are however others, including keeping some symmetries in the input into the output; and other properties that a true PRF would not have.

In particular: by definition, $\text{ChaChaCore}(x)=P(x)\boxplus x$ where $\boxplus$ is 512-bit addition with carry removed between 32-bit chunks, and $P$ is some public permutation (with $P(0)=0$) that can be trivially inverted. It follows that knowledge of $\text{ChaChaCore}(x)\boxminus x$ is enough to find $x$, by computing $P^{-1}(\text{ChaChaCore}(x)\boxminus x)$, where $\boxminus$ is to $\boxplus$ what subtraction is to addition.

$\endgroup$
3
  • 1
    $\begingroup$ I think the OP considers ChaCha without the final addition when they talk about the core. $\endgroup$ – CodesInChaos Mar 25 '16 at 10:20
  • $\begingroup$ @CodesInChaos: perhaps the OP considers ChaCha without the final $\boxplus$; but unambiguously, the Salsa20 core includes $\boxplus$, and I see that a lot for the term Chacha core; e.g. here; here; and even arguably by the author here. $\endgroup$ – fgrieu Mar 25 '16 at 15:25
  • $\begingroup$ @fgrieu yes I was referring to the case where the final ⊞ is omitted. $\endgroup$ – Demi Mar 26 '16 at 18:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.