This paper introduces 'Freestyle' a randomized, and variable round version of the ChaCha cipher. It uses the concept of hash based halting condition, where a decryption attempt with an incorrect key is likely to take longer time to halt.

It works on the following principle: a sender encrypts a block of message using a random number of round (R), which is never shared with the receiver. However, the sender along with the ciphertext shares the hash of the cipher state (or partial cipher-state) after executing R rounds. The hash is sent in cleartext; and the receiver can compute R using the correct key, and the received hash. This expected hash acts as a halting condition for the decryption process.

I don't really understand what the hash halting process adds here. The attacker doesn't need to search incorrect keys forever, just for the maximum possible number of rounds. The small benefit of not having a second key is that the ciphertext is 50% or so larger due to all the hashes provided.

The proposed cipher also amends the first constant of the ChaCha block. This seems bizarre given Bernstein's comments on the constants being carefully chosen.

It seems there are more simple ways to implement a variable round ChaCha than the linked paper. We could use added secret bits to create a stream (using SHA3) of 512 bits that could be read as a series of n bits to add to the rounds. Every iteration of SHA3 would be good to seed the added rounds for about 1024-2048 iterations of ChaCha (assuming additional rounds of 16 or 8).

Does varying the rounds (based on something unrelated to the 256bit ChaCha key) add any security? Or is the main benefit of the proposed cipher in the linked paper the hash halting concept or something else I'm missing?

  • 1
    $\begingroup$ With a 256-bit key, I see no point in adding security against key search. $\endgroup$ – fgrieu Nov 20 '20 at 11:40
  • $\begingroup$ @fgrieu You could use similar reasoning to see no point in a 256 bit key, as some other 192 bit scheme is unbroken. In any case, with a 256 bit key not derived from random, there would be a point. $\endgroup$ – Modal Nest Nov 20 '20 at 20:23
  • $\begingroup$ @ModalNest If a key is not fully randomized then that's not a fault of the cipher. And 256 bit keys are required to give 128 bit protection against quantum computing. $\endgroup$ – Maarten Bodewes Nov 20 '20 at 23:38
  • $\begingroup$ @MaartenBodewes But no one mentioned any fault of the cipher. Adding security (or not) would give more protection (or not) against quantum computing for random 256 bit keys. $\endgroup$ – Modal Nest Nov 21 '20 at 0:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.