I'm trying to get understanding of Salsa20 algorithm. There is an official specification from Daniel J. Bernstein at link. Everything in spec is clear and I could write an implementation on Swift.

But I met Salsa20 cipher algorithm implemented by other developers Crypto and TLS for C++11 , Salsa20 written on Python The developers perform some operations with words at positions 8 and 9 after generating ciphertext message: enter image description here

I didn't saw these operations in the original Salsa20 spec. What do these increments mean?


This code only increments word 9 when word 8 is zero. Just like when counting you increment the next digit whenever the previous digit is zero, going from 9 to 10.

This is equivalent to having a 64-bit counter and putting the lower half into word 8 and the upper half into word 9.

  • $\begingroup$ I understand the code, but I’m not clear why it was added for? $\endgroup$ Nov 13 '17 at 21:22
  • 3
    $\begingroup$ @IgorKotkovets Salsa20 is Salsa20 core in CTR mode. So you need a counter. The spec says the counter is 64 bits, divided into two 32-bit words. $\endgroup$ Nov 13 '17 at 22:25
  • 1
    $\begingroup$ @CodesInChaos Reading the PDF spec, the $Salsa20_k(n)$ expansion function defines a single 16 byte input $n$, then section 10 references that function called with 2 distinct inputs, the 8 byte nonce $v$ and "the unique 8 byte sequence" $i$. It should have used a concatenation symbol instead of a comma, took me a few minutes to figure out what was supposed to happen. $\endgroup$ Nov 14 '17 at 5:35
  • $\begingroup$ @CodesInChaos, you are right. It's Salsa20 in CTR mode. There is no mentions about CRT mode in the original Salsa20 spec. Probably it's common convention to use word 8,9 for a counter. $\endgroup$ Nov 17 '17 at 21:24
  • $\begingroup$ @IgorKotkovets It's a bit implicit in the paper. It defines a function with a 16 byte nonce parameter and then defines a function which passes an 8 byte nonce and an 8 byte counter as that argument (as Richie Frame commented). The NaCl paper is a bit clearer. Salsa20 is Salsa20Core in counter-mode. $\endgroup$ Nov 17 '17 at 21:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.