Suppose I encrypt a bytestream using ChaCha20, and then encrypt the resulting ciphertext using AES in ECB mode. How secure is the combination?

  • $\begingroup$ That is called XE mode, it has good provable security properties $\endgroup$ Apr 8, 2016 at 1:27
  • $\begingroup$ @RichieFrame how much stronger than ChaCha20 or AES-CTR seperately? $\endgroup$
    – Demi
    Apr 8, 2016 at 2:16
  • $\begingroup$ Strong enough that any block cipher modes I have designed in the last few years are either XE or XEX type. You get the parallelization of both modes, but eliminate their weaknesses. You can drop ChaCha to 8 rounds, and use AES-128 for additional performance $\endgroup$ Apr 8, 2016 at 9:05
  • $\begingroup$ @RichieFrame Could we (or preferably, you) answer this by pointing out some kind of paper that explaints or mentions the security properties of XE mode? $\endgroup$
    – Maarten Bodewes
    Apr 8, 2016 at 10:16
  • $\begingroup$ @MaartenBodewes I looked for the reference I was expecting, but only found the one relating to OCB mode. The reference I was expecting was much earlier $\endgroup$ Apr 8, 2016 at 10:31


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.