Basic question- if I'm encoding a bunch of known filetypes with salsa20, will it still be secure if the plaintext header is known?

Assume that a different IV and Key are generated before each file is encrypted (or at least, it's statistically impossible for an attacker to know whether or not different files were encrypted with the same IV or key, and it's very unlikely that 2 in fact were)

I.e. the attacker will precisely know the first 64 bytes or so of the plaintext file, not the remaining mega/gigabytes, and does not have a comparison file which was likely to be encrypted with the same IV and Key

  • $\begingroup$ @D.W. Salsa20 is a stream cipher. It always uses something similar to CTR mode. $\endgroup$ Commented May 10, 2013 at 8:36
  • 2
    $\begingroup$ @davidkomer It's essential to use a distinct nonce for every message you encrypt. If you do that, Salsa20 is pretty secure. You should also consider adding authentication, so active attacks are rejected. $\endgroup$ Commented May 10, 2013 at 8:38
  • $\begingroup$ @CodesInChaos - thanks, updated to reflect that point $\endgroup$
    – davidkomer
    Commented May 10, 2013 at 12:28
  • $\begingroup$ It depends. There are many details. For instance, if you use a key derived from a password, it'll likely be insecure. If you fail to use authenticated encryption (e.g., a MAC), it'll be susceptible to chosen-ciphertext attacks. There are a number of ways to go wrong. Usually you shouldn't try to encrypt in this way; instead, you should use an existing, well-vetted scheme/software, like GnuPG $\endgroup$
    – D.W.
    Commented May 10, 2013 at 16:02

1 Answer 1


Yes, because there are no known weaknesses in (full) Salsa20.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.