Chacha20 is essentially a hash function that maps 512-bit strings to other 512-bit strings which are in turn xored with the plaintext to create the ciphertext. Of the 512-bit input 128-bit are used for the "expand 32-byte k" constant, 256-bit are used for the key, 64 bit are used for the nonce and the final 64 bit are used for the counter.

I noticed that in the eBASH/eBASC benchmarks here and here that chacha20 depending on the architecture the speed for the encryption of a 512-bit message ranges (at least for the 64-bit architectures) from slightly faster to significantly slower when compared to BLAKE2b (if we use it in a mode similar to the one that we use in chacha20 - so 512-bit consisting of a constant, key, nonce, and counter and xor the result with the message) which is a "real" cryptographic/collision resistant hash function based on chacha20 that given a message of any (reasonable) size gives a 512-bit output. BLAKE2b has 12 rounds (each of which if I understand correctly is equal to two chacha rounds).

My question is, how can BLAKE2b be faster in some architectures than chacha20 even though it does more work? I think that BLAKE2b uses 64-bit words rather than the 32-bit words that chacha20 uses, is this one of the causes?

Also, would there be any reason not to prefer BLAKE2b (in what is essentially a CTR mode) for such an architecture?

  • 2
    $\begingroup$ Since the eBASH/eBASC benchmarks contain a lot of information, could you please specify some platforms where BLAKE2b is faster than ChaCha20? $\endgroup$ – Raoul722 Aug 2 '19 at 10:20
  • $\begingroup$ Have you tried comparing BLAKE2s with ChaCha20? $\endgroup$ – forest Aug 3 '19 at 11:11
  • $\begingroup$ I just browsed your two benchmarks. Even though I did not compare every architecture, I tried to get a representative view and I've yet to find an architecture where blake2b is faster than chacha20. I think your question is moot because it is based on false premises. $\endgroup$ – A. Hersean Aug 5 '19 at 8:21
  • $\begingroup$ @Raoul722 Consider the first one: amd64; CannonLake (60663); 2018 Intel Core i3-8121U; 2 x 2200MHz. Cycles/byte for 64 bytes for chacha20 is 8.78 8.88 9.19 while for blake2b it is 6.09 6.16 6.22. The second one too. ppc64; 2017 IBM POWER9 DD2.1; 32 x 3126MHz. 26.03 26.03 26.80 for chacha20 while we have 19.91 19.91 20.67 for blake2b. $\endgroup$ – Astolfo Aug 6 '19 at 15:06
  • 1
    $\begingroup$ In your comment you stated that on "2018 Intel Core i3-8121U" blake2b is faster than chacha20. However, on average on this architecture, chacha20 uses 0.57 cycles/bytes (for messages over 4KB, which are most messages) whereas blake2b uses 6.16 cycles/bytes (when processing input of the same length as its output, which is the case when used in CTR mode even for long messages). Thus, in this case chacha20 is 10.8 times faster than blake2b. Chacha20 as an overhead to initialize the cipher, this make it "slow" on very small messages, and this is documented. $\endgroup$ – A. Hersean Aug 7 '19 at 13:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.