Right now chacha20 and blake use constants in order to eliminate fixpoints. As far as I know however inserting a bitwise not every $n$ rounds should eliminate this issue without using constants (and as a bonus chacha20 would be a $\{0, 1\}^{512} \to \{0, 1\}^{512}$ function rather than a $\{0, 1\}^{384} \to \{0, 1\}^{512}$ as it currently is).

My questions are:

  1. Why did Bernstein went with constants rather than bitwise not?
  2. Would use bitwise not once every two rounds, for example, cause some kind of issue that I am not aware of?
  • 1
    $\begingroup$ using a bitwise not is the same as adding a constant of 1 $\endgroup$ – Richie Frame Jan 29 at 19:48
  • $\begingroup$ @RichieFrame I am aware of that. $\endgroup$ – 8321992485 Jan 29 at 20:10
  • $\begingroup$ which cipher uses bit wise not for eliminating fixed points ? have you seen a particular cipher? $\endgroup$ – hardyrama Jan 30 at 3:22
  • $\begingroup$ @hardyrama Xoodoo-p and Keccak-p, although these are not ARX, unlike Chacha20. $\endgroup$ – 8321992485 Jan 30 at 16:20
  • $\begingroup$ @8321992485 keccak uses a LFSR to generate constants, and im pretty sure it does not use NOT $\endgroup$ – Richie Frame Jan 30 at 21:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.