# Would a key recovery attack on ChaCha's keystream would be made more secure with an AONT?

To be clear I'm well aware that ChaCha doesn't need to be "improved". Also, I have no intentions or misguided ideas about trying to "improve" it. My question is hypothetical, and is inspired by the comments on this answer

I am also aware that ChaCha does not require any padding scheme, and that any positives from the scheme listed below would be outweighed by the negatives.

However, imagine that we choose to use the RSA Optimal Asymmetric Encryption Padding (OAEP) padding scheme along with the ChaCha cipher. The padding scheme is used unnecessarily as an attempt to improve security.

Per Wikipedia:

The algorithm takes the form of a Feistel network which uses a pair of random oracles $$G$$ and $$H$$ to process the plaintext prior to asymmetric encryption. When combined with any secure trapdoor one-way permutation $$f$$, this processing is proved in the random oracle model to result in a combined scheme which is semantically secure under chosen plaintext attack

And:

OAEP can be used to build an all-or-nothing transform.

It seems intuitive that OAEP improves the security of the cipher. The padding scheme should provide additional CPA/CCA security.

In the event of a known/chosen plaintext, it would obscure the key stream. As per the Ron Rivest's paper All-or-nothing encryption and the package transform

We present a new mode of encryption for block ciphers, which we call all-or-nothing encryption. This mode has the interesting defining property that one must decrypt the entire ciphertext before one can determine even one message block. This means that brute-force searches against all-or-nothing encryption are slowed down by a factor equal to the number of blocks in the ciphertext. We give a specific way of implementing all-or-nothing encryption using a “package transform≓ as a pre-processing step to an ordinary encryption mode. A package transform followed by ordinary codebook encryption also has the interesting property that it is very efficiently implemented in parallel. All-or-nothing encryption can also provide protection against chosen-plaintext and related-message attacks.

Question:

Would using OAEP alongside ChaCha improve the CPA/CCA security of the cipher? Specifically, would a key recovery attack using the keystream would be made more secure with an AONT?

• Are you essentially asking if an all or nothing transform meaningfully improves security? Take Poly1305 for example, which provides CCA. An all or nothing transform seems like a similar attempt to provide authentication similar to that of PCBC (which we now know is inferior to true AE), except that errors propagate in both directions rather than only forward. – forest Jan 10 at 0:08
• @forest Yeah I am I think. Although I suppose restricted to ChaCha (if required in order to make it an answerable question) – Modal Nest Jan 10 at 0:12
• It might just be better to restrict it to an arbitrary secure PRG instead of ChaCha specifically. Also, doesn't an all or nothing transform only work for block ciphers? – forest Jan 10 at 0:12
• @ModalNest Known plaintext against a stream cipher only makes it possible to know what that part of the keystream is. It doesn't provide the attacker with any other capabilities. If you need CCA security, you need to authenticate, and CCA security is related to authentication. – forest Jan 10 at 0:23
• I guess what I'm asking is: What aspect of security do you believe an AONT improves that isn't already solved by existing, superior techniques? – forest Jan 10 at 0:28