2
$\begingroup$

Which version of ChaCha is more secure?

XChaCha20-Poly1305-IETF

ChaCha20-IETF-Poly1305 

ChaCha20-Poly1305

I am looking for 256bit strength for large datasets.

I am having trouble disambiguating the delta between these ciphers available in libSodium.

|improve this question
$\endgroup$
6
$\begingroup$

The only difference between these is the nonce size (and, consequently, the internal counter size). The core function is exactly the same. They all offer the exact same security level if they are used as expected.

The trade-offs are described in the AEAD section of the documentation.

XChaCha20-Poly1305-IETF is the one that has the largest nonce size. This significantly reduces the risk of reuse, since it can be randomly chosen without any practical risk of collision. This can also be leveraged to build nonce misuse-resistant schemes.

Unless you specifically need compatibility with a different implementation that doesn't support the XChaCha20 version, this is the one you want to use in virtually all cases.

XChaCha20-Poly1305-IETF is very likely to become the function used by the high-level API in a future libsodium release. Which means that other variants will not be available any longer in minimal builds.

Since your use case appears to be encrypting large messages, the higher-level secretstream API is a better fit. It uses XChaCha20-Poly1305-IETF internally.

|improve this answer
$\endgroup$
  • $\begingroup$ Thanks @Frank Denis $\endgroup$ – Woodstock Sep 10 '19 at 12:40
  • $\begingroup$ we consider the IV reuse as a security risk. If they have different IV lengths how will they have the same security levels? $\endgroup$ – kelalaka Sep 10 '19 at 17:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.