0
$\begingroup$

I understand that WAGE cipher uses duplex/sponge mode with stream based cipher for Authenticated encryption with associated data (AEAD) and NORX uses duplex/sponge mode with LRX structure , so , Is it possible to design AEAD cipher using duplex/sponge mode with ARX structure (Chacha20)? what are the advantages/disadvantages?

I could not find an example in NIST Lightweight candidates

$\endgroup$
1
$\begingroup$

It is possible!

The SPARKLE suite is a round 2 family of NIST candidates that uses ARX-based permutations to build sponge-based hash functions (called ESCH) and duplex-based AEAD (called Schwaemm): see their website and the NIST list of candidates.

Some advantages of ARX would be the smaller code size and the speed it allows. A disadvantages would be a harder masking (an implementation technique preventing side-channel attacks).

$\endgroup$
0
$\begingroup$

The Chacha ARX permutation can be used for such a purpose, though you may wish to introduce round constants.

Advantages would probably include the good software performance Chacha enjoys.

Disadvantages would be having to alter the primitive and then wonder if you screwed up somewhere.

You may want to look into the BLAKE hash function, it uses a modified Chacha permutation.

$\endgroup$
  • 1
    $\begingroup$ Either the statement "Yes. ChaCha20 works here." or "No. ChaCha20 doesn't work." is true. (My bet would be on "Yes") However, neither statement is particularly valuable. A "yes" or "no" answer ought to be followed up with a "because". $\endgroup$ – Future Security Sep 20 '19 at 0:48
  • 1
    $\begingroup$ Not all permutation functions are suitable to use in a sponge. Analysis of sponge constructs in general (not of specific hashes or stream ciphers) is premised on the function being a random permutation. There isn't any research that I'm aware of which argues whether the permutation used by ChaCha or even related algorithms is indifferentiable from random, so answering why this specific permutation would or would not be safe unfortunately looks like it wouldn't be a simple task. If it were and I'm just unaware of the paper, then simply adding a sentence citing it would suffice. $\endgroup$ – Future Security Sep 20 '19 at 1:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.