I've always been under the belief that larger block sizes require more rounds to achieve full diffusion. Rijndael, SPECK, and SIMON, for example, have a round multiplier based on the block size. The idea that a larger block size also necessitates more rounds for equivalent security also seems intuitively correct. However, reading DJB's paper introducing Salsa20, I came across the following:

The basic argument for a larger block size, say 256 bytes, is that one does not need as many cipher rounds to achieve the same conjectured security level. Using a larger block size, like copying state across blocks, seems to provide just as much mixing as the first few cipher rounds.

This goes against what I have always thought. Why is this?

  • $\begingroup$ I'm not sure you understand my question. $\endgroup$ – forest Mar 6 at 6:23
  • $\begingroup$ I have no difficulty understanding this question. @PaulUszak Can you provide a citation for you claim regarding ideal s-box size? I have never encountered that before. $\endgroup$ – Ella Rose Mar 6 at 16:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.