The user Forest in here claims that the internal chacha20 permutation is "vulnerable to attacks if it were used in a sponge construction". My question is as follows:

  • What are these attacks?
  • Would these attacks still be an issue if we assume that we are using a modified version of the chacha20 that does not have a trivial to find fixed point?

I would have phrased it as not having evidence supporting it as safe to use.

The ChaCha permutation was not designed to be used in a sponge construction. It could be safe, but we don't have evidence of any weight similar to the weight of evidence we have suggesting that the whole ChaCha20 stream cipher is safe.

I'm not aware of any attack on the ChaCha permutation if used as a sponge, unless capacity bits are initialized to zero. ChaCha's trivial fixed point is from zero to zero. If you can force the sponge's state to that value, then you can insert one or more blocks of all zero bits between two message blocks without changing the sponge's state. (Making collision attacks trivial.)

It is (most likely) non-trivial to get the state (capacity) bits to the zero if they aren't already that value. If the capacity bits are non-zero and the number of capacity bits is sufficiently large and the ChaCha permutation would be indifferentiable from a random permutation if not for the one known fixed point, then there might not be a way to exploit the fixed point in practice.

But, again, that third point isn't something that we can assume is true with the same confidence that we have for assuming that the stream cipher algorithm, ChaCha20, is secure. There is a lack of evidence because not enough effort has been put into studying the permutation in isolation.

  • $\begingroup$ "I'm not aware of any attack on the ChaCha permutation if used as a sponge, unless capacity bits are initialized to zero." But that doesn't mean that one hasn't been published nor that there hasn't been an unpublished attacked discovered. $\endgroup$ Feb 6 '20 at 1:36
  • $\begingroup$ Thanks for the answer. If I do not receive any more responses in the next few days I will select it as the accepted one. Do you have some specific changes in mind that would be needed in the permutation if it was designed to be used in the sponge construction? but we don't have evidence ... Would the same not hold true for Gimli or XooDoo? $\endgroup$
    – 8321992485
    Feb 6 '20 at 5:49
  • $\begingroup$ I had a similar question crypto.stackexchange.com/q/74330/32035, wage is stream cipher used in sponge construction and sparx is arx used in sponge , chacha is stream and arx but never used in sponge construction , is there a particular requirement for sponge construction to be filled? $\endgroup$
    – hardyrama
    Feb 6 '20 at 7:24
  • $\begingroup$ @hardyrama, please ask separate questions instead of commenting below an answer. $\endgroup$
    – Maarten Bodewes
    Feb 6 '20 at 23:24
  • 1
    $\begingroup$ It's worth noting that the Keccak team's own definition of sponge functions says to initialize the state to all zeroes. So you do have to take a small (and entirely defensible) liberty with their definition and forbid that initial state in order to exclude the trivial attack. It's also worth noting that the CAESAR candidate NORX uses a ChaCha-inspired permutation with the all-zero fixpoint in a spongy mode. $\endgroup$ Feb 7 '20 at 0:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.