I know that the ChaCha20 core (without the initial constant) is not an ideal PRP and must not be used as such. I also know that $\text{ChaChaCore}(0) = 0$. Are there any other differences?
$\begingroup$
$\endgroup$
1
-
1$\begingroup$ 1) I think the ChaCha(0)=0 property generalizes to all words being identical. 2) ChaCha has obvious rotational symmetries. $\endgroup$ – CodesInChaos Mar 25 '16 at 10:21
Add a comment
|
$\begingroup$
$\endgroup$
3
It would be extremily surprising if the ChaCha core was a permutation (as the last P in PRP), although we have no proof it is not (if it was a permutation, it would at least be one we do not known how to invert, see this question).
A better approximation is that the ChaCha core behaves as a Pseudo-Random Function with the additional property $\text{ChaChaCore}(0)=0$. When we use as part of the input a constant secret key, the ChaCha core becomes a plausible Pseudo Random Function family.
The ChaCha core has less remarkable externally visible properties than the Salsa20 core has. $\text{ChaChaCore}(0)=0$ is a simple one. There are however others, including keeping some symmetries in the input into the output; and other properties that a true PRF would not have.
In particular: by definition, $\text{ChaChaCore}(x)=P(x)\boxplus x$ where $\boxplus$ is 512-bit addition with carry removed between 32-bit chunks, and $P$ is some public permutation (with $P(0)=0$) that can be trivially inverted. It follows that knowledge of $\text{ChaChaCore}(x)\boxminus x$ is enough to find $x$, by computing $P^{-1}(\text{ChaChaCore}(x)\boxminus x)$, where $\boxminus$ is to $\boxplus$ what subtraction is to addition.
-
1$\begingroup$ I think the OP considers ChaCha without the final addition when they talk about the core. $\endgroup$ – CodesInChaos Mar 25 '16 at 10:20
-
-
$\begingroup$ @fgrieu yes I was referring to the case where the final ⊞ is omitted. $\endgroup$ – Demi Mar 26 '16 at 18:24
