I need to establish potentially infinite secure streams of data between many remote devices with very few resources. Chacha20 is lightweight enough, but I do not trust myself to implement a reliable nonce agreement protocol between devices.

One option is to use XChacha20 and random nonces, but I can not afford the performance reduction. Other option, the object of this question, is to generate a random 128 bits nonce and use it as both the conventional 64 bits nonce and the 64 bits counter.

Is there any references about the security of such a construction?

Some notes:

  • All devices use same secret key.
  • Public key cryptography is not an option due processing power and memory constrains.
  • Devices are mobile, so any connection can fail at any time, requiring to reconnect again.
  • 4
    $\begingroup$ A little offtopic note: I just want to suggest to make sure you're using a MAC such as Poly1305 with it, a block/stream cipher on its own is not enough to ensure data integrity. $\endgroup$ – Mark Feb 5 '18 at 17:46
  • 2
    $\begingroup$ What is your budget, if ChaCha fits in it and XChaCha does not? Do you have to use the full 20-round ChaCha or could you tolerate ChaCha12 or ChaCha8? What is the protocol you're hoping to build out of this? $\endgroup$ – Squeamish Ossifrage Feb 5 '18 at 20:56
  • 4
    $\begingroup$ @user3368561 If you ‘can't afford the performance reduction’, there must be some budget (in joules? watts? cycles? RAM?) that XChaCha20 exceeds. Any other putative answer would presumably have to fit within that budget, but it's hard to say what will without knowing the budget. And to really give a useful answer it will be necessary to consider how you are using the stream cipher: what communication are the devices trying to do, what state do they have available, etc. $\endgroup$ – Squeamish Ossifrage Feb 6 '18 at 1:13
  • 3
    $\begingroup$ If there are many remote devices, and all of them share the same secret key, then that key is no longer a "secret"; it's at best a "discreet". $\endgroup$ – Thomas Pornin Feb 7 '18 at 14:49
  • 3
    $\begingroup$ It is far easier for someone to just break the hardware protection (yes, it happens) than it would be for them to break even ChaCha8. Why do you use this as a session key rather than for authentication purposes? There are several very lightweight key exchange protocols out there. $\endgroup$ – forest May 9 '18 at 5:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.