# How secure is ChaCha20? [closed]

I want to implement a stream cipher to encrypt very sensitive data in my Python code. I heard about the ChaCha20 algorithm and the PyCryptodome library , but how secure is it ?

• Possible duplicate of How secure is Salsa20? – Ella Rose Sep 30 '18 at 15:35
• @EllaRose Although I can see where you're coming from when comparing ChaCha20 with Salsa20, I can imagine that users of this site may not. A bit more info about Salsa20 would be welcome. Besides that, it does use a new round function; it may not be directly obvious how much this would influence security. – Maarten Bodewes Oct 1 '18 at 14:39
• @MaartenBodewes It does say possible duplicate ;) – Ella Rose Oct 1 '18 at 15:30
• We cannot and should not comment here on the security of a library. You'd need to perform comprehensive research for that, possibly including a review of the given implementation (if those haven't been performed and well documented before). Answers here should focus on the algorithm alone and if the algorithm can be implemented securely. – Maarten Bodewes Oct 1 '18 at 16:48

• Aumasson et al. Showed that ChaCha6 can be attacked with time complexity $$2^{139}$$ and ChaCha7 with $$2^{248}$$.
• Shi et al. gave an attack based on second-order differential with $$2^{136}$$ for ChaCha6 and $$2^{246.5}$$ for ChaCha7.
• Maitra, chosen IV cryptoanalysis and the time complexity of the attack showed that it can be reduced to $$2^{239}$$ for ChaCha7.
• Choudhuri and Maitra concluded ChaCha12 are sufficient for 256-bit keys against differential cryptanalysis using a hybrid model of non-linear round functions and linear approximation...

$$\begin{array} {|l|l|} \hline Attack & Evaluation \\ \hline \text{Differential Analysis } & \text{No attack found}\\ \text{Rotational Cryptanalysis} & \text{No attack found}\\ \text{Boomerang Attack} & \text{No attack found} \\ \text{Linear Cryptanalysis} & \text{No attack found}\\ \text{Distinguishing Attack} & \text{No attack found}\\ \text{Guess and Determine Analysis} & \text{No attack found}\\ \text{Time-Memory-Data Tradeoff Attack } & \text{Protected}\\ \text{Practically ChaCha Algebraic Attack} & \text{No attack found} \\ \text{Attacks on Initialization Process} & \text{No attack found}\\ \text{Single Power Analysis } & \text{Protected}\\ \text{Practically Difference Power Analysis } & \text{Protected Practically}\\ \text{Cache Timing Attack} & \text{No attack found}\\ \text{Fault Injection Analysis } & \text{Protected Practically}\\ \hline \end{array}$$

The above table and results come from KDDI Research, Inc

• simple power attack; though the rotation is vulnerable to power attack, they propose masking as a countermeasure.
• differential power analysis; they demonstrated that adversary can get all keys except $$k_1$$ which can be found in $$2^{32}$$, proposed masking as a countermeasure.
• Fault Injection Attack; they claim that the initial matrix $$X$$ or matrix $$X^{(20)}$$ will be output if injection is performed on the addition.

A countermeasure against this sort of attacks is to separate variables; that is, distinct variables store the inputs and output of the addition. Consider an addition $$z \leftarrow x+y$$. The addition returns the initial value of variable z even if the addition is skipped. Thus, the adversary can get neither the value of variables $$x$$ and $$y$$. Algorithm 9 shows the implementation using countermeasure based on variable separation.

We should note that variable separation in source-code level does not work

They include all attacks upto 2017 in their document. I couldn't find one in 2018.

• How is the conclusion that ChaCha is practically resistant to fault injection reached? That one seems highly dependent on hypothesis made. At least in a setup where the same Chacha calculation is performed multiple times, it seems fault injection could work. – fgrieu Oct 1 '18 at 11:42
• If you want, Ill we go deeper. – kelalaka Oct 1 '18 at 15:38

ChaCha20 is a "primitive", in other words it's just one component of a secure cryptographic system (and PyCryptodome is a collection of primitives). So in a way, and from the perspective of a programmer, it's not secure at all. It's dangerous to use something so low-level.

In order to implement a secure crypto system, you need more than just encryption. Go with something like Cryptography or PyNaCl - they have already done all the work for you.

• I've voted this down. On StackOverflow this could possibly count as an answer, as the question could suffer from the X-Y problem. But on crypto, when asked about the security of an algorithm, we want to focus on just that - not the protocol or system that the algorithm is used in. – Maarten Bodewes Oct 1 '18 at 16:45
• Sure, I definitely answered the "real" question here. Maybe flag so that it can be converted into a comment. Or we change the question. – Stefano Palazzo Oct 1 '18 at 18:59