#include <std_roll_your_own_crypto_warning.h>
With the third round CAESAR candidates about to be announced, the design[0] of Salsa20/ChaCha + Poly1305 is still looking good in a number of ways, including software performance. However, LRX algorithms have a major advantage when it comes to (relatively) efficient masking/blinding[1].
NORX[2] is a sponge based design similar to Keccak/SHA-3 and the Keccak-p based Keyak[3] CAESAR candidate but designed with efficient software performance in mind. However, it is not as efficient as ChaCha20/Poly1305[4] in software, particularly if you want 256-bit keys on 32-bit systems.
- https://norx.io/data/norx.pdf
- https://competitions.cr.yp.to/round2/keyakv2.pdf
- https://www.rfc-editor.org/rfc/rfc7539
So the question is, are there any obvious issues to using NORX32-f in a Salsa20 style stream cipher, using the pseudo-addition operation $H()$ to add in the initial state the way Salsa20 does? What, if any, different security properties are needed for the stream cipher usage vs. the sponge usage?