I'm using the Crypto++ implementation of Salsa20 for a software project we are working on and I'd like to know if there are any SSE or software optimizations that will increase the speed of the CSPNG?


Looking at the Crypto++ 5.6.2 implementation for Salsa20 it seems they do have an SSE implementation, but it doesn't use intrinsics so it doesn't look very portable between compilers.

If you're not exactly set on using Salsa20 I would recommend using ChaCha20, which is a small modification of Salsa20 by the author (Daniel Bernstein) that is slightly faster and cleaner. And if you really value speed I would recommend using Salsa12, which reduces computation time by about 40%.

For ChaCha20 I would recommend the crypto_stream\chacha20\krovetz implementation found in SUPERCOP. Similarly for ChaCha12.

For Salsa20 I suggest you look inside the crypto_stream\salsa20 folder and look for an appropriate implementation for your target platform. You can see timings for various platforms at these pages.

  • $\begingroup$ This is second hand from two different sources, but at the Crypto 2013, Bernstein was recommending to people that they not use a reduced round version of Salsa20(i.e Salsa12,13, 19, etc) for a proposed addition to TLS. I believe there are (mainly) theoretical attacks against reduced round variants $\endgroup$ – imichaelmiers Aug 24 '13 at 17:04
  • $\begingroup$ Our goal is to populate blocks of 128 MBs of RAM with noise and my thought process was to simply use a CSPRNG. Salsa20 is a fairly fast. The noise has to be as close to random as possible. $\endgroup$ – Charles Hoskinson Aug 24 '13 at 20:40
  • 2
    $\begingroup$ @CharlesHoskinson What purpose does the noise have? Will it ever be used to encrypt sensitive data or did you just choose for a cryptographic PRNG for maximum randomness? Will the random data ever face an attacker trying to find the seed? Because if you only need it to be sufficiently random for things like simulation or random overwriting of memory I would not hesitate to suggest ChaCha8 or even a non-cryptographic RNG for speed. $\endgroup$ – orlp Aug 24 '13 at 20:50
  • $\begingroup$ The seed is public knowledge and we are using for a proof of work. We selected a CSPRNG both security and randomness. I suppose we could use hardware accelerated AES. My goal is raw speed. $\endgroup$ – Charles Hoskinson Aug 27 '13 at 3:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.