0
$\begingroup$

I understand that WAGE cipher uses duplex/sponge mode with stream based cipher for Authenticated encryption with associated data (AEAD) and NORX uses duplex/sponge mode with LRX structure , so , Is it possible to design AEAD cipher using duplex/sponge mode with ARX structure (Chacha20)? what are the advantages/disadvantages?

I could not find an example in NIST Lightweight candidates

Improve this question
$\endgroup$

2 Answers 2

Reset to default
2
$\begingroup$

It is possible!

The SPARKLE suite is a round 2 family of NIST candidates that uses ARX-based permutations to build sponge-based hash functions (called ESCH) and duplex-based AEAD (called Schwaemm): see their website and the NIST list of candidates.

Some advantages of ARX would be the smaller code size and the speed it allows. A disadvantages would be a harder masking (an implementation technique preventing side-channel attacks).

Improve this answer
$\endgroup$
0
$\begingroup$

The Chacha ARX permutation can be used for such a purpose, though you may wish to introduce round constants.

Advantages would probably include the good software performance Chacha enjoys.

Disadvantages would be having to alter the primitive and then wonder if you screwed up somewhere.

You may want to look into the BLAKE hash function, it uses a modified Chacha permutation.

Improve this answer
$\endgroup$
2
  • 1
    $\begingroup$ Either the statement "Yes. ChaCha20 works here." or "No. ChaCha20 doesn't work." is true. (My bet would be on "Yes") However, neither statement is particularly valuable. A "yes" or "no" answer ought to be followed up with a "because". $\endgroup$
    – Future Security
    Commented Sep 20, 2019 at 0:48
  • 1
    $\begingroup$ Not all permutation functions are suitable to use in a sponge. Analysis of sponge constructs in general (not of specific hashes or stream ciphers) is premised on the function being a random permutation. There isn't any research that I'm aware of which argues whether the permutation used by ChaCha or even related algorithms is indifferentiable from random, so answering why this specific permutation would or would not be safe unfortunately looks like it wouldn't be a simple task. If it were and I'm just unaware of the paper, then simply adding a sentence citing it would suffice. $\endgroup$
    – Future Security
    Commented Sep 20, 2019 at 1:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.