# How secure is ChaCha20? [closed]

I want to implement a stream cipher to encrypt very sensitive data in my Python code. I heard about the ChaCha20 algorithm and the PyCryptodome library , but how secure is it ?

• Possible duplicate of How secure is Salsa20? Commented Sep 30, 2018 at 15:35
• @EllaRose Although I can see where you're coming from when comparing ChaCha20 with Salsa20, I can imagine that users of this site may not. A bit more info about Salsa20 would be welcome. Besides that, it does use a new round function; it may not be directly obvious how much this would influence security. Commented Oct 1, 2018 at 14:39
• @MaartenBodewes It does say possible duplicate ;) Commented Oct 1, 2018 at 15:30
• We cannot and should not comment here on the security of a library. You'd need to perform comprehensive research for that, possibly including a review of the given implementation (if those haven't been performed and well documented before). Answers here should focus on the algorithm alone and if the algorithm can be implemented securely. Commented Oct 1, 2018 at 16:48

• Aumasson et al. Showed that ChaCha6 can be attacked with time complexity $$2^{139}$$ and ChaCha7 with $$2^{248}$$.
• Shi et al. gave an attack based on second-order differential with $$2^{136}$$ for ChaCha6 and $$2^{246.5}$$ for ChaCha7.
• Maitra, chosen IV cryptoanalysis and the time complexity of the attack showed that it can be reduced to $$2^{239}$$ for ChaCha7.
• Choudhuri and Maitra concluded ChaCha12 are sufficient for 256-bit keys against differential cryptanalysis using a hybrid model of non-linear round functions and linear approximation...

$$\begin{array} {|l|l|} \hline Attack & Evaluation \\ \hline \text{Differential Analysis } & \text{No attack found}\\ \text{Rotational Cryptanalysis} & \text{No attack found}\\ \text{Boomerang Attack} & \text{No attack found} \\ \text{Linear Cryptanalysis} & \text{No attack found}\\ \text{Distinguishing Attack} & \text{No attack found}\\ \text{Guess and Determine Analysis} & \text{No attack found}\\ \text{Time-Memory-Data Tradeoff Attack } & \text{Protected}\\ \text{Practically ChaCha Algebraic Attack} & \text{No attack found} \\ \text{Attacks on Initialization Process} & \text{No attack found}\\ \text{Single Power Analysis } & \text{Protected}\\ \text{Practically Difference Power Analysis } & \text{Protected Practically}\\ \text{Cache Timing Attack} & \text{No attack found}\\ \text{Fault Injection Analysis } & \text{Protected Practically}\\ \hline \end{array}$$

The above table and results come from KDDI Research, Inc

• simple power attack; though the rotation is vulnerable to power attack, they propose masking as a countermeasure.
• differential power analysis; they demonstrated that adversary can get all keys except $$k_1$$ which can be found in $$2^{32}$$, proposed masking as a countermeasure.
• Fault Injection Attack; they claim that the initial matrix $$X$$ or matrix $$X^{(20)}$$ will be output if injection is performed on the addition.

A countermeasure against this sort of attacks is to separate variables; that is, distinct variables store the inputs and output of the addition. Consider an addition $$z \leftarrow x+y$$. The addition returns the initial value of variable z even if the addition is skipped. Thus, the adversary can get neither the value of variables $$x$$ and $$y$$. Algorithm 9 shows the implementation using countermeasure based on variable separation.

We should note that variable separation in source-code level does not work

They include all attacks upto 2017 in their document. I couldn't find one in 2018.

• How is the conclusion that ChaCha is practically resistant to fault injection reached? That one seems highly dependent on hypothesis made. At least in a setup where the same Chacha calculation is performed multiple times, it seems fault injection could work.
– fgrieu
Commented Oct 1, 2018 at 11:42
• If you want, Ill we go deeper. Commented Oct 1, 2018 at 15:38

ChaCha20 is a "primitive", in other words it's just one component of a secure cryptographic system (and PyCryptodome is a collection of primitives). So in a way, and from the perspective of a programmer, it's not secure at all. It's dangerous to use something so low-level.

In order to implement a secure crypto system, you need more than just encryption. Go with something like Cryptography or PyNaCl - they have already done all the work for you.

• I've voted this down. On StackOverflow this could possibly count as an answer, as the question could suffer from the X-Y problem. But on crypto, when asked about the security of an algorithm, we want to focus on just that - not the protocol or system that the algorithm is used in. Commented Oct 1, 2018 at 16:45
• Sure, I definitely answered the "real" question here. Maybe flag so that it can be converted into a comment. Or we change the question. Commented Oct 1, 2018 at 18:59