2
$\begingroup$

Which version of ChaCha is more secure?

XChaCha20-Poly1305-IETF

ChaCha20-IETF-Poly1305 

ChaCha20-Poly1305

I am looking for 256bit strength for large datasets.

I am having trouble disambiguating the delta between these ciphers available in libSodium.

Improve this question
$\endgroup$
6
$\begingroup$

The only difference between these is the nonce size (and, consequently, the internal counter size). The core function is exactly the same. They all offer the exact same security level if they are used as expected.

The trade-offs are described in the AEAD section of the documentation.

XChaCha20-Poly1305-IETF is the one that has the largest nonce size. This significantly reduces the risk of reuse, since it can be randomly chosen without any practical risk of collision. This can also be leveraged to build nonce misuse-resistant schemes.

Unless you specifically need compatibility with a different implementation that doesn't support the XChaCha20 version, this is the one you want to use in virtually all cases.

XChaCha20-Poly1305-IETF is very likely to become the function used by the high-level API in a future libsodium release. Which means that other variants will not be available any longer in minimal builds.

Since your use case appears to be encrypting large messages, the higher-level secretstream API is a better fit. It uses XChaCha20-Poly1305-IETF internally.

Improve this answer
$\endgroup$
4
  • $\begingroup$ Thanks @Frank Denis $\endgroup$
    – Woodstock
    Sep 10 '19 at 12:40
  • $\begingroup$ we consider the IV reuse as a security risk. If they have different IV lengths how will they have the same security levels? $\endgroup$
    – kelalaka
    Sep 10 '19 at 17:51
  • $\begingroup$ @kelalaka I think in this instance the siding scale between nonce size and internal counter size only changes the number of files/size of files you can encrypt... i.e. large nonce you can encrypt many files with the same key (and different nonces), larger counter size, you can encrypt a larger file without hitting the internal counter limit. $\endgroup$
    – Woodstock
    Mar 15 at 8:19
  • $\begingroup$ @Woodstock Actually, it was a question to the answerer, XChaCha20 and ChaCha20 uses the same amount of counter. The lesser nonce usage is the key to the nonce collision that is problematic. It is ironic that the answers that explain these in detail (probability) have fewer votes. $\endgroup$
    – kelalaka
    Mar 15 at 8:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.