We know that for ChaCha20 and XChaCha20, the same key can never be used with the same nonce. But let's say I use a random 256-bit key every time... Then the nonce can be whatever because the key is always different. Let's say I set the nonce to be all zeros. As long as the 256-bit key is random, then this setup should be secure since 256-bits is large enough to not be bruteforced or be reused.
Now, let's work backward. Suppose I use Argon2 for key derivation. If I use a 256-bit salt with Argon2, then the output key should have 256-bits of randomness, and if I feed that key into XChaCha20, I theoretically should never run into the same key, and thus, can use a zeroed nonce.
I have three questions:
- Is there something wrong with using a zeroed nonce if the key is always random?
- In this case, does using a 192-bit nonce for XChaCha20 have any additional benefit?
- Is it safe to use a 256-bit salt for Argon2, when the recommended salt is 128-bits?
Context: file encryption