2
$\begingroup$

I'm planning to use ChaCha20 just as a CSPRNG. Key is random (taken from strong initial entropy source) and will be constantly replaced via DJB's fast key-erasure scheme. What should I use as the nonce? Does it matter? Is it safe to just use zero?

Improve this question
$\endgroup$
3
$\begingroup$

No it doesn't matter, as you won't be switching the nonce on a per message basis, just outputting a stream of random data.

However, remember, your key will only produce an output stream valid until the internal counter overflows.

Consider XChaCha20.

IETF ChaCha20 uses a 96-bit nonce and 32-bit counter, XChaCha20 uses a 192-bit nonce and 64-bit counter. The 64-bit counter lets it encrypt 1 Zettabyte of data, i.e. output a large random dataset.

Improve this answer
$\endgroup$
7
  • $\begingroup$ I'm using the original DJB spec for ChaCha that has 64-bit counter and nonce, rather than the IETF's broken version with 32-bit counter and 96-bit nonce, but in any case the counter is unlikely to ever exceed 2 or 3 due to re-keying. $\endgroup$ – R.. GitHub STOP HELPING ICE Mar 25 '20 at 22:51
  • $\begingroup$ @R.. GitHub STOP HELPING ICE Can you please tell me, why IETF ChaCha20 is broken ? $\endgroup$ – Vivekanand V Mar 26 '20 at 16:30
  • $\begingroup$ @Woodstock Can I encrypt and authenticate 1 Zettabyte of data using XChaCha20- Poly1305 with 192 bit nonce and 64 bit counter ? $\endgroup$ – Vivekanand V Mar 26 '20 at 16:33
  • $\begingroup$ @VivekanandV: 32-bit block counters are largely considered to be a bug/mistake because they compromise security properties if more than 4G blocks are encrypted. DJB intentionally made the counter 64-bit for that reason, and then the IETF spec changed it for inexplicable reasons. $\endgroup$ – R.. GitHub STOP HELPING ICE Mar 26 '20 at 16:42
  • $\begingroup$ @R.. GitHub STOP HELPING ICE Thankyou for your reply! How much data can XChaCha20-Poly1305 with 64 bit counter encrypt and authenticate ? $\endgroup$ – Vivekanand V Mar 26 '20 at 16:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.