0
$\begingroup$

In libsodium, there're 3 symmetric encryption(stream cipher) which are AES256-GCM(Hardware-accelerated), XSalsa20Poly1305 and XChaCha20Poly1305(uncertain which version of libsodium add support to XChaCha20Poly1305).

Considering that AES256-GCM will be a primary choice if hardware supports it as it's an industry standard which commonly seen in file storage or any other applicable platform.

AES256-GCM was commonly seen in file storage as the server will request user's secret such as passwords/passphrase to derive a key then perform encryption/decryption.

In scenario where it uses total endpoint encryption(does not send any user's secret to the server), the encryption was done on devices instead of server.

If the device is unable to support AES256-GCM (hardware accelerated), how to choose between XSalsa20Poly1305(crypto_secretbox_easy) and XChaCha20Poly1305(secretbox_xchacha20poly1305)?

Improve this question
$\endgroup$
6

1 Answer 1

Reset to default
3
$\begingroup$

This is kinda subjective. All options are supposed to be good.

If I would have to pick one I would pick XChaCha20Poly1305 as AES hardware support is limited. It is usually faster than software AES and safe from side channel attacks.

Only reason to use XSalsa20Poly1305 is old library support (which is probably not good idea anyway). Salsa20 is older and slightly slower on most CPUs and has slightly slower diffusion.

Improve this answer
$\endgroup$
4
  • $\begingroup$ So it's depending on how one views it. If they want to have a better tested version of stream cipher, it's better to go for XSalsa20Poly1305. If they want to have a faster and "probably" more secure version then go for XChaCha20Poly1305 $\endgroup$
    – Hern
    Oct 11, 2021 at 3:10
  • $\begingroup$ @Hern I would actually say ChaCha is better tested than Salsa, because it is also used for Blake hash function. Although Salsa was selected for eSTREAM, ChaCha is now more popular. Salsa is just 3 years older (actually it was published only 1 year before ChaCha). Google uses ChaCha. Many UNIX-like operating systems use it for random number generator. $\endgroup$
    – LightBit
    Oct 11, 2021 at 6:57
  • $\begingroup$ Update: Just confirmed something with the libsodium developer, they said that the existence of XChaCha20Poly1305 is only there for DNSCrypt perhaps that's the reason why they didn't bother to put the documentation on their libsodium-doc github repo and their website (doc.libsodium.org) $\endgroup$
    – Hern
    Oct 17, 2021 at 8:35
  • $\begingroup$ They didn't said that it will be removed so my binding can probably still have that coded in place. $\endgroup$
    – Hern
    Oct 17, 2021 at 8:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.