Is it secure to use Salsa20/ChaCha as the key schedule for a 512-bit block cipher using a public permutation in Even-Mansour construction?

  • $\begingroup$ So you have a public permutation (unrelated to Salsa20/ChaCha?) and are now asking whether it's (probably) secure to use the keystream generated by either of these stream ciphers to perform the pre- and post-whitening? $\endgroup$
    – SEJPM
    Aug 17, 2018 at 10:03

1 Answer 1


If you define one round of your Even-Mansour cipher as: $$c \leftarrow P(\operatorname{Salsa20}(k, f(\text{nonce}, \text{round})) + m)$$

Where $P$ is your public fixed permutation, $f$ is some function that ensures the combination of nonce and round number don't lead to repeating nonces, and $\operatorname{Salsa20}$ is the Salsa20 stream cipher.

And assume that:

  • Salsa20 is a secure stream cipher
  • The Even-Mansour cipher uses one round
  • The permutation is the identity permutation

Then the proposed Even-Mansour cipher is secure. To see this, simply drop the permutation and round counter altogether and get $$c \leftarrow \operatorname{Salsa20}(k, nonce) + m$$

If $\operatorname{Salsa20}$ is assumed to be secure, then the above is secure.

The latter two assumptions of a single round with the identity permutation are the worst case scenario. More rounds and an alternative permutation should not make the design weaker.


This also demonstrates that there is little benefit to using more than one round and an additional permutation.

Note also that with more than one round, the $f$ function needs to be designed to ensure that the combination of nonce and round counter never leads to the generation of repeated key streams. It is conceivable that failure to do so could lead to an Even-Mansour cipher that is trivially broken despite Salsa20 being secure, e.g. a 2 round variant where rounds 1 and 2 result in the same key stream being generated, leaving the plaintext message unaltered.

If Salsa20 is secure, then there is no real benefit from embedding it inside of another encryption algorithm. The extra complexity could lead to something that is broken, despite Salsa20 being secure.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.