# Security of ChaCha compared to AES and Serpent

I'm trying to understand how secure XChaCha20 is in comparison with other ciphers. From what I know, ChaCha is more secure than AES, but less secure than Serpent. My question is how much more "secure" is ChaCha than AES and how much less secure it is than Serpent. If (on a scale of 1 to 10) AES is 5 and Serpent is 10, what would ChaCha be? I think it is around 6~7, but I'm not sure. Also, about how much longer would ChaCha theoretically last under bruteforce of the NSA than AES (assuming no KDF used)? If I encrypt an archive and store it encrypted by ChaCha in the cloud, can I expect it to be more secure than the same archive encrypted by AES? Would it be less secure theoretically than Serpent? Thanks.

I'm looking for the best combo of security and modernism to store files long term in the cloud.

• How do you expect the security of unbroken ciphers to be quantified? Commented Jan 26, 2021 at 2:09
• Serpent has a higher security margin than AES, we all know that. While all of the three ciphers are unbroken, the design of them distinguishes their security margins. Think of how we know AES is stronger than RC4. Commented Jan 26, 2021 at 2:14
• If it's "security margin" you want to use a basis for quantification, then one way to "score" them is to find out how many round each cipher has, and how many rounds have had known attack, and how much time and space does such attack require. Each broken round amounts to an order of magnitude of security, so the score should probably be an index and not a factor. Commented Jan 26, 2021 at 2:18
• @DannyNiu: "number of unbroken rounds" isn't a perfect metric; I would expect that there has been considerably more attempts against AES than, say, Serpent Commented Jan 26, 2021 at 3:32
• "I'm looking for the best combo of security and moderism...:"; that's an odd thing to look for. In cryptography, we generally don't want to use the latest shiny object; we generally prefer things that have been around a long while (and have withstood a number of cryptanalytic attacks). After all, the biggest threat to a cipher is an unknown cryptanalytic approach; the longer something has been out there and studied, the more confidence we have that there is no such approach... Commented Jan 26, 2021 at 4:04

This answer has 2 parts, the 1st on "quantifying" the security of unbroken ciphers, the 2nd on the choice of ciphers for different usage scenarios.

If (on a scale of 1 to 10) AES is 5 and Serpent is 10, what would ChaCha be?

First, you have to quantify their security in order for the scores to be meaningful. The quantification must have a basis, such as "security margin" mentioned in the comments.

This answer does not intend to provide concrete values for the scores or detailed formula, but provide a outline on how it might be calculated.

With "security margin" as quantification metric, we can proceed as follow: Most ciphers operate iteratively in rounds, each round increases the diffusion and confusion of the input - the amount diffusion and confusion obtained in each rounds are usually an order of magnitudes great, so the quantification should be an index rather than a factor.

With these in mind, we can look at

1. $$r$$ the number of rounds each cipher has,

2. $$r_a$$ the number of rounds attacked, and

3. $$w$$ the time-space-query (optionally success probability) tradeoff required for the attack. This is measured in security-in-bits murdered by the attack, divided by bit length of the key.

We get a rough score for the index of security margin of the cipher:

$$r \over {r_a \cdot \log(w + 1)}$$

Because we're considering both the threat and the feasibility of attacks, multiple attacks must be considered for a given cipher to find its final actual minimum score.

I'm looking for ...

This question asks for security at rest of data in the cloud, but others seeing the title of this question may look for something slightly different.

ChaCha is notable for its inclusion as "stand-by cipher" in TLS, as such, the reasoning led to such decision is worth analyzing. We'll reference https://datatracker.ietf.org/doc/html/draft-mcgrew-standby-cipher-00 for this purpose.

The first thing to consider, is, how easy is it to change the cipher?

• For internet transport protocols, changing cipher is as easy as re-connecting to the server and negotiate a new cipher. The biggest burdon is on library implementations to add the support for that cipher.

• For data at rest (in cloud, or offline), it'll be easy for new data to be encrypted with the new cipher. For existing data, we'll have to "trans-cipher" them by first decrypting them with the old cipher and re-encrypting them with the new one - this is a long and slow process with possibility of unexpected failures.

• For hardware devices, changing the cipher will often be impractical without replacing the hardware in entirety.

The 2nd thing, is balance of diversity of paradigm, verses the burdon of supporting multiple algorithms.

The linked IETF draft set out explicitly, that, the stand-by cipher should have a different design than AES. This way, non-generic attacks that're applicable to AES will not be applicable to the new stand-by cipher (and a 2nd stand-by cipher may be sought when such attack to AES is found).

The linked IETF draft also set out, that, in order to lighten the burdon of implementations, only 1 stand-by cipher is to be selected. A clever stratagy for prosumers would be to encrypt files of different importance using different ciphers (and keys of different strength), but this have to be balanced with availability of support of new ciphers in older softwares. Otherwise, most-needed files encrypted with newer algorithms may not be readable using older softwares.