I've learned that a stream cipher like ChaCha20 generates a key stream that gets XORed with the plaintext to get the ciphertext... If an attacker knows the plaintext, he could just simply XOR that with the ciphertext to get the corresponding keystream. Is there any security issue with this? I realize that it is because of the XORing operation that this is easily possible. Is there an even better way to encrypt the plaintext using the keystream without using XOR, that would also facilitate message authentication?
$\begingroup$
$\endgroup$
5
-
1$\begingroup$ Do you realize that for different plaintext messages, we give ChaCha20 different nonce (a.k.a. initialization vector) so as to prevent known cipher stream being used to break unknown ciphertext datagrams? $\endgroup$– DannyNiuCommented Jan 29, 2020 at 10:52
-
$\begingroup$ Suggestion for your future questions: learn some basic cryptography concepts such as block cipher(s) and their mode of operations, stream cipher, nonce/initialization vector, authentication and authenticated encryption, public-key encryption and key exchange, digital signature, communication protocols such as SSL/TLS, or SSH. This site have tags for most of these listed here. $\endgroup$– DannyNiuCommented Jan 29, 2020 at 10:58
-
$\begingroup$ @DannyNiu Yes I know of that nonce and also basic crypto and mode of operations. In block ciphers like AES any change in ciphertext would totally wreck the output plaintext after decryption is applied. But for ChaCha20 you need to use Poly1305 message authentication to be exactly sure no "man in the middle" altered your ciphertext during transmission... I'm trying to make ChaCha20 as robust as AES and also make Chacha20 suitable for file encryption/decryption. Can you please share your thoughts on that ? $\endgroup$– Aravind ACommented Jan 29, 2020 at 11:55
-
1$\begingroup$ What makes you think ChaCha20 isn't as robust as AES? People had built BLAKE-series hash functions out of the primitives used in ChaCha, and the password hashing algorithm Argon. You can like-wise build hash algorithms from compression functions built using block ciphers like AES. $\endgroup$– DannyNiuCommented Jan 29, 2020 at 12:18
-
$\begingroup$ @DannyNiu Thankyou for your answer! $\endgroup$– Aravind ACommented Jan 29, 2020 at 12:24
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
3
First, there's no issue with modern stream cipher constructions - either using an AEAD block cipher mode of operation such as GCM, or the combination of ChaCha20-Poly1305 as Google had experimented and subsequently formalized in the form of Internet RFC documents.
Stream ciphers are basically reduced-capability one-time-pads as one may infer: stream cipher cipher streams only has as many possible values as there are keys, where as one-time-pads are truely random. This is fine since physically buildable computers (including those hypothetical quantum computers) are bounded in capabilities - in both time and space dimensions.
Second, the new trend in the field is to build AEADs from permutations using Duplex construction (I admit these aren't the popular knowledges you might learn from school or might encounter in your TV programs or newspapers).
Indeed, ChaCha20 and Poly1305 are separate primitives that were introduced as "backup"s to AES, etc. Even the original paper proposing Poly1305 introduced it as AES-Poly1305.
Roughly describing the concept:
Recall the SHA3 hash functions are based on 1600-bit Keccak permutation running in Sponge mode - the permutation is partitioned into 2 parts, 1 part is used to absorb data and squeeze out the hash digest, the other part is kept secret as the security capacity.
Duplex is similar, except the data is read as they goes in. Adding in some careful design, you get a AEAD from a single primitive - the permutation.
Examples of these types of cipher include Gimli, Xoodyak, etc. You'd find some more at NIST lightweight cryptography project page.
-
$\begingroup$ Will Duplex replace AES or ChaCha20 in the future ? $\endgroup$ Commented Jan 29, 2020 at 12:25
-
1$\begingroup$ I don't like predicting future, especially when there's little evidence of what the trend is like. But Permutation-Duplex ciphers are certainly going to complement existing algorithms as SHA3 had complemented SHA2 as we've seen. AES is efficient in hardware, and efficient hardwares for AES had been proliferous, so it's unlikely to go away any time soon. ChaCha20 and most permutations are already efficient using SIMD instructions available on modern CPUs (ranging from mobile, to desktop, to server), so they're fine even without dedicated hardware. $\endgroup$– DannyNiuCommented Jan 29, 2020 at 12:32
-
$\begingroup$ Thankyou very much, your knowledge is very much appreciated :) $\endgroup$ Commented Jan 29, 2020 at 12:44