I'm planning to use ChaCha20 just as a CSPRNG. Key is random (taken from strong initial entropy source) and will be constantly replaced via DJB's fast key-erasure scheme. What should I use as the nonce? Does it matter? Is it safe to just use zero?
$\begingroup$
$\endgroup$
asked Mar 25 at 21:48
$\begingroup$
$\endgroup$
No it doesn't matter, as you won't be switching the nonce on a per message basis, just outputting a stream of random data.
However, remember, your key will only produce an output stream valid until the internal counter overflows.
Consider XChaCha20.
IETF ChaCha20 uses a 96-bit nonce and 32-bit counter, XChaCha20 uses a 192-bit nonce and 64-bit counter. The 64-bit counter lets it encrypt 1 Zettabyte of data, i.e. output a large random dataset.
-
$\begingroup$ I'm using the original DJB spec for ChaCha that has 64-bit counter and nonce, rather than the IETF's broken version with 32-bit counter and 96-bit nonce, but in any case the counter is unlikely to ever exceed 2 or 3 due to re-keying. $\endgroup$ – R.. GitHub STOP HELPING ICE Mar 25 at 22:51
-
$\begingroup$ @R.. GitHub STOP HELPING ICE Can you please tell me, why IETF ChaCha20 is broken ? $\endgroup$ – Vivekanand V Mar 26 at 16:30
-
$\begingroup$ @Woodstock Can I encrypt and authenticate 1 Zettabyte of data using XChaCha20- Poly1305 with 192 bit nonce and 64 bit counter ? $\endgroup$ – Vivekanand V Mar 26 at 16:33
-
$\begingroup$ @VivekanandV: 32-bit block counters are largely considered to be a bug/mistake because they compromise security properties if more than 4G blocks are encrypted. DJB intentionally made the counter 64-bit for that reason, and then the IETF spec changed it for inexplicable reasons. $\endgroup$ – R.. GitHub STOP HELPING ICE Mar 26 at 16:42
-
$\begingroup$ @R.. GitHub STOP HELPING ICE Thankyou for your reply! How much data can XChaCha20-Poly1305 with 64 bit counter encrypt and authenticate ? $\endgroup$ – Vivekanand V Mar 26 at 16:49
