From Section 3.1 in DJB's document on The Salsa20 family of stream ciphers- https://cr.yp.to/snuffle/salsafamily-20071225.pdf

Salsa20 expands a 256-bit key and a 64-bit nonce (unique message number) into a $2^{70}$-byte stream.

Where does this $2^{70}$ number come from?


1 Answer 1


Salsa20 is a PRF working in Counter-mode. That is it generates the keystream as $K_i=F_k(N,\text{Counter}_i)$.

This Counter is a 64-bit value - not the nonce - thus allowing $2^{64}$ invocations of the PRF before repetition. Each PRF invocation yields 64 bytes, so in total $2^{64}\cdot 64=2^{70}$ bytes.

Salsa20 generates the stream in 64-byte (512-bit) blocks. Each block is an independent hash of the key, the nonce, and a 64-bit block number; there is no chaining from one block to the next.

The above is the relevant quote from the paper, about five lines below the quote in the question.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.