I want to implement a stream cipher to encrypt very sensitive data in my Python code. I heard about the ChaCha20 algorithm and the PyCryptodome library , but how secure is it ?

  • 2
    $\begingroup$ Possible duplicate of How secure is Salsa20? $\endgroup$
    – Ella Rose
    Sep 30, 2018 at 15:35
  • 1
    $\begingroup$ @EllaRose Although I can see where you're coming from when comparing ChaCha20 with Salsa20, I can imagine that users of this site may not. A bit more info about Salsa20 would be welcome. Besides that, it does use a new round function; it may not be directly obvious how much this would influence security. $\endgroup$
    – Maarten Bodewes
    Oct 1, 2018 at 14:39
  • 1
    $\begingroup$ @MaartenBodewes It does say possible duplicate ;) $\endgroup$
    – Ella Rose
    Oct 1, 2018 at 15:30
  • 1
    $\begingroup$ We cannot and should not comment here on the security of a library. You'd need to perform comprehensive research for that, possibly including a review of the given implementation (if those haven't been performed and well documented before). Answers here should focus on the algorithm alone and if the algorithm can be implemented securely. $\endgroup$
    – Maarten Bodewes
    Oct 1, 2018 at 16:48

2 Answers 2

  • Aumasson et al. Showed that ChaCha6 can be attacked with time complexity $2^{139}$ and ChaCha7 with $2^{248}$.
  • Shi et al. gave an attack based on second-order differential with $2^{136}$ for ChaCha6 and $2^{246.5}$ for ChaCha7.
  • Maitra, chosen IV cryptoanalysis and the time complexity of the attack showed that it can be reduced to $2^{239}$ for ChaCha7.
  • Choudhuri and Maitra concluded ChaCha12 are sufficient for 256-bit keys against differential cryptanalysis using a hybrid model of non-linear round functions and linear approximation...

\begin{array} {|l|l|} \hline Attack & Evaluation \\ \hline \text{Differential Analysis } & \text{No attack found}\\ \text{Rotational Cryptanalysis} & \text{No attack found}\\ \text{Boomerang Attack} & \text{No attack found} \\ \text{Linear Cryptanalysis} & \text{No attack found}\\ \text{Distinguishing Attack} & \text{No attack found}\\ \text{Guess and Determine Analysis} & \text{No attack found}\\ \text{Time-Memory-Data Tradeoff Attack } & \text{Protected}\\ \text{Practically ChaCha Algebraic Attack} & \text{No attack found} \\ \text{Attacks on Initialization Process} & \text{No attack found}\\ \text{Single Power Analysis } & \text{Protected}\\ \text{Practically Difference Power Analysis } & \text{Protected Practically}\\ \text{Cache Timing Attack} & \text{No attack found}\\ \text{Fault Injection Analysis } & \text{Protected Practically}\\ \hline \end{array}

The above table and results come from KDDI Research, Inc

  • simple power attack; though the rotation is vulnerable to power attack, they propose masking as a countermeasure.
  • differential power analysis; they demonstrated that adversary can get all keys except $k_1$ which can be found in $2^{32}$, proposed masking as a countermeasure.
  • Fault Injection Attack; they claim that the initial matrix $X$ or matrix $X^{(20)}$ will be output if injection is performed on the addition.

A countermeasure against this sort of attacks is to separate variables; that is, distinct variables store the inputs and output of the addition. Consider an addition $z \leftarrow x+y$. The addition returns the initial value of variable z even if the addition is skipped. Thus, the adversary can get neither the value of variables $x$ and $y$. Algorithm 9 shows the implementation using countermeasure based on variable separation.

We should note that variable separation in source-code level does not work

They include all attacks upto 2017 in their document. I couldn't find one in 2018.

  • 3
    $\begingroup$ How is the conclusion that ChaCha is practically resistant to fault injection reached? That one seems highly dependent on hypothesis made. At least in a setup where the same Chacha calculation is performed multiple times, it seems fault injection could work. $\endgroup$
    – fgrieu
    Oct 1, 2018 at 11:42
  • $\begingroup$ If you want, Ill we go deeper. $\endgroup$
    – kelalaka
    Oct 1, 2018 at 15:38

ChaCha20 is a "primitive", in other words it's just one component of a secure cryptographic system (and PyCryptodome is a collection of primitives). So in a way, and from the perspective of a programmer, it's not secure at all. It's dangerous to use something so low-level.

In order to implement a secure crypto system, you need more than just encryption. Go with something like Cryptography or PyNaCl - they have already done all the work for you.

  • 5
    $\begingroup$ I've voted this down. On StackOverflow this could possibly count as an answer, as the question could suffer from the X-Y problem. But on crypto, when asked about the security of an algorithm, we want to focus on just that - not the protocol or system that the algorithm is used in. $\endgroup$
    – Maarten Bodewes
    Oct 1, 2018 at 16:45
  • $\begingroup$ Sure, I definitely answered the "real" question here. Maybe flag so that it can be converted into a comment. Or we change the question. $\endgroup$ Oct 1, 2018 at 18:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.