2
$\begingroup$

I'm planning to use ChaCha20 just as a CSPRNG. Key is random (taken from strong initial entropy source) and will be constantly replaced via DJB's fast key-erasure scheme. What should I use as the nonce? Does it matter? Is it safe to just use zero?

| improve this question | |
$\endgroup$
3
$\begingroup$

No, as you won't be switching the nonce on a per message basis, just outputting a stream of random data.

However, remember, your key will only produce an output stream valid until the internal counter overflows.

Consider XChaCha20.

IETF ChaCha20 uses a 96-bit nonce and 32-bit counter, XChaCha20 uses a 192-bit nonce and 64-bit counter. The 64-bit counter lets it encrypt 1 Zettabyte of data, i.e. output a large random dataset.

| improve this answer | |
$\endgroup$
  • $\begingroup$ I'm using the original DJB spec for ChaCha that has 64-bit counter and nonce, rather than the IETF's broken version with 32-bit counter and 96-bit nonce, but in any case the counter is unlikely to ever exceed 2 or 3 due to re-keying. $\endgroup$ – R.. GitHub STOP HELPING ICE Mar 25 at 22:51
  • $\begingroup$ @R.. GitHub STOP HELPING ICE Can you please tell me, why IETF ChaCha20 is broken ? $\endgroup$ – Vivekanand V Mar 26 at 16:30
  • $\begingroup$ @Woodstock Can I encrypt and authenticate 1 Zettabyte of data using XChaCha20- Poly1305 with 192 bit nonce and 64 bit counter ? $\endgroup$ – Vivekanand V Mar 26 at 16:33
  • $\begingroup$ @VivekanandV: 32-bit block counters are largely considered to be a bug/mistake because they compromise security properties if more than 4G blocks are encrypted. DJB intentionally made the counter 64-bit for that reason, and then the IETF spec changed it for inexplicable reasons. $\endgroup$ – R.. GitHub STOP HELPING ICE Mar 26 at 16:42
  • $\begingroup$ @R.. GitHub STOP HELPING ICE Thankyou for your reply! How much data can XChaCha20-Poly1305 with 64 bit counter encrypt and authenticate ? $\endgroup$ – Vivekanand V Mar 26 at 16:49

Your Answer

By clicking โ€œPost Your Answerโ€, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.