Suppose I encrypt a bytestream using ChaCha20, and then encrypt the resulting ciphertext using AES in ECB mode. How secure is the combination?

  • $\begingroup$ That is called XE mode, it has good provable security properties $\endgroup$ – Richie Frame Apr 8 '16 at 1:27
  • $\begingroup$ @RichieFrame how much stronger than ChaCha20 or AES-CTR seperately? $\endgroup$ – Demi Apr 8 '16 at 2:16
  • $\begingroup$ Strong enough that any block cipher modes I have designed in the last few years are either XE or XEX type. You get the parallelization of both modes, but eliminate their weaknesses. You can drop ChaCha to 8 rounds, and use AES-128 for additional performance $\endgroup$ – Richie Frame Apr 8 '16 at 9:05
  • $\begingroup$ @RichieFrame Could we (or preferably, you) answer this by pointing out some kind of paper that explaints or mentions the security properties of XE mode? $\endgroup$ – Maarten Bodewes Apr 8 '16 at 10:16
  • $\begingroup$ @MaartenBodewes I looked for the reference I was expecting, but only found the one relating to OCB mode. The reference I was expecting was much earlier $\endgroup$ – Richie Frame Apr 8 '16 at 10:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.