Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [chacha]

ChaCha is a family of stream ciphers proposed by Daniel J. Bernstein, as an evolution of Salsa20 with (conjecturally) improved resistance to cryptanalysis.

1
vote
0answers
29 views

generating HChaCha20 internal state with existant ChaCha20 implementation [migrated]

In RFC7539 § 2.3.2. Test Vector for the ChaCha20 Block Function it shows the "ChaCha state at the end of the ChaCha20 operation". I'm able to get that with PHP 7.2.8 and OpenSSL thusly: ...
1
vote
1answer
74 views

How resistant are stream ciphers like Salsa20 or ChaCha in a post-quantum world?

What kind of quantum computer would be required, if it is possible to break such ciphers?
2
votes
3answers
89 views

Can I achieve data authentication with ChaCha20 without MAC?

My case is rather special. I need to send data in small chunks, each under 32bytes. ChaCha20 state is 64 bytes. Since I will be receiving data stream in chunks, id like to verify it on the fly (i.e. ...
2
votes
3answers
149 views

Does ChaCha20 counter actually increment through iterations?

RFC defines: state = constants | key | counter | nonce Suggested on multiple places is to set counter to 0 or 1. It is still ...
1
vote
0answers
22 views

Round counts and permutation usage for hashing for a Merkle tree

Are there any current recommendations for performant hashing in a Merkle tree? It appears the hash based signatures in Sphincs use Blake2 everywhere (see Table 1 on page 22 of https://sphincs.cr.yp....
2
votes
1answer
126 views

What are implementations of PRNGs based on ChaCha20? [closed]

I thought I'd find an implementation in NaCl, but /dev/urandom is what I find. Search engines samples revealed most implementations are broken. What libraries are ...
1
vote
1answer
89 views

ChaCha with 64bit integers as a PRNG with streams

Can I use ChaCha with four rounds as a good non-cryptographic PRNG with different streams if I use 64 bit integers instead of the standard 32 bit integers? I need a bigger state and this seems the ...
1
vote
1answer
124 views

Is it safe to send IV in plain text for every request?

Currently, I am creating a project with an IoT device. This is an offline device which shows a QR code which can be scanned by a mobile device, which sends this code to a server. The server handles ...
5
votes
1answer
259 views

Does ChaCha20-Poly1305 need random nonce?

RFC 7539 says: A 96-bit nonce -- different for each invocation with the same key It doesn't explicitly say whether it has to be random or not. If we use an ever incrementing counter. Would that be ...
2
votes
1answer
122 views

Salsa20 / ChaCha with 128 bit keys

According to wikipedia both Salsa20 and ChaCha support both 128 and 256-bit keys. The initial state for each has 8 words of key, where each word is 32 bits. 32*8 = 256. My question is... how is one ...
2
votes
2answers
159 views

Understanding ChaCha20-Poly1305 AEAD

In the AEAD scheme described in https://tools.ietf.org/html/rfc7539#section-2.8.1, the aad and cyphertext are padded to be a multiple of 16 bytes in length. Why is this necessary? Does it provide any ...
6
votes
3answers
113 views

Mixing x into permutation through XOR vs. modular addition

Block ciphers mix key material into the permutation through XOR. Also do pre and post whitening this way. Chacha/Salsa finishes by 32-bit modular adding key and iv material (among other bits but ...
2
votes
1answer
31 views

Are Authenticated Encryption ciphersuites supported in legacy TLS versions older than TLS 1.2?

I have read in a paper that Authenticated Encryption (by this I mean those that support GCM mode or ChaCha20 ciphers) are not supported in versions older than TLS 1.2? I could not confirm this as ...
1
vote
2answers
901 views

How secure is ChaCha20? [closed]

I want to implement a stream cipher to encrypt very sensitive data in my Python code. I heard about the ChaCha20 algorithm and the PyCryptodome library , but how secure is it ?
2
votes
1answer
160 views

Does chacha20-poly1305 require new key for every encryption process?

As I know chacha20-poly1305 is stream cipher. Does that mean for every encryption process require a new key?
6
votes
1answer
156 views

Reason for 3 rounds ChaCha in ChaCha20Poly1305@openssh

OpenSSH uses a slightly different ChaCha20Poly1305 AEAD construct then the one proposed by A. Langley and others for TLS. The TLS version The openSSH version (and here) The openSSH version uses two ...
5
votes
1answer
113 views

Latin dance family in block cipher

Is it secure to use Salsa20/ChaCha as the key schedule for a 512-bit block cipher using a public permutation in Even-Mansour construction?
1
vote
2answers
593 views

Is it safe to use a timestamp to build a nonce?

I'm writing an application, which can be used on multiple clients, and share data on a server. To make sure the data never leaves the clients unencrypted, the application should offer encryption with ...
1
vote
0answers
55 views

ChaCha20 - How confidentiality is lost if reusing nonce? [duplicate]

I read that (key, nonce) pair should be used only once for encryption of a message. My question is how confidentiality can be lost if two peers using a shared key use same (key, nonce) pair to encrypt ...
3
votes
1answer
268 views

Can ChaCha20 be repurposed as a general purpose permutation function like Gimli?

I like the idea behind Gimli and libhydrogen but in my benchmarks Gimli permutation function is considerably slower than ChaCha20 one. By considerably I mean four times slower using SIMD builtins. ...
6
votes
3answers
2k views

Is it safe to use a random numbers instead of a counter in ChaCha20?

Besides the IV, ChaCha20 takes a random number and a counter as input. I couldn't find more precise information about this but it seems to be that the counter is just a safety measure in case of a ...
3
votes
1answer
186 views

Would it be safe to use the message hash as the IV in ChaCha?

This seemed like an option if the hash is unpredictable. It could be the hash of the message or the hash of the message + some common secret (apart from the key). The only circumstance in which the ...
0
votes
1answer
79 views

Sending the nonce in ChachaPoly1305 with the ciphertext

I am trying to implement a ChachaPoly1305 encryption with authentication scheme over a network. I am using a counter to derive the nonce as suggested by the rfc. Is it secure to send the nonce over ...
3
votes
1answer
208 views

Message length limit induced by block counter size

Wikipedia reports the following information about the ChaCha20 algorithm: An implementation reference for ChaCha20 has been published in RFC 7539. The IETF's implementation modified Bernstein's ...
2
votes
0answers
49 views

Rationale behind IETF-ChaChaPoly's padding during MAC computation [duplicate]

RFC 7539 (Section 2.8) specifies a ChaCha20/Poly1305 based AEAD cipher scheme; pseudocode: ...
2
votes
1answer
82 views

Should I include the ciphertext length in an AAD when using Chacha20+Poly1205 AEAD?

I want to construct a time-limited authorization token using ChaCha20 and Poly1305 as defined by RFC7539. I chose the following simple layout: ...
8
votes
1answer
353 views

Can reduced-round ChaCha be used as non-cryptographic fast PRNG to produce output indistinguishable from random data?

The fastest known attack against the Salsa20 family of stream ciphers requires 2137 simple operations against Salsa20/7, or 2244 against Salsa20/8. The 8-round version encrypts data at 1.88 cycles-per-...
2
votes
1answer
472 views

384-bit ChaCha20 / Salsa20

The standard Salsa20 core is a $\{0,1\}^{384} \to \{0,1\}^{512}$ PRF with a 16 byte constant ($\sigma$ for a 32-byte key), an 8 byte nonce, an 8 byte counter, and a 32 byte key. The hash function does ...
3
votes
0answers
84 views

Why Salsa20 rotates columns vertically to optimize for SIMD?

I'm writing a school assignment and I'm trying to fully grasp the differences between Salsa20 and ChaCha. I've come to understand that by rotating upwards the initial matrix columns, DJB says that ...
3
votes
0answers
355 views

Chacha20 random nonce + counter

I need to establish potentially infinite secure streams of data between many remote devices with very few resources. Chacha20 is lightweight enough, but I do not trust myself to implement a reliable ...
4
votes
1answer
169 views

Can ChaCha be turned into a collision resistant hash function by xoring keystreams?

In his paper about RFSB Bernstein states that the compression function $(m_1,\ m_2,\ m_3,\ ...\ ,\ m_n) \rightarrow c_1[m_1]\ \oplus\ c_2[m_2]\ \oplus c_3[m_3]\ \oplus\ ... \oplus\ c_n[m_n]$ is ...
1
vote
1answer
160 views

Is streaming API to ChaCha20-Poly1305 possible or recommended against?

None of the implementations of ChaCha20-Poly1305 AEAD scheme I've seen so far provide a streaming API. Instead, ChaCha20-Poly1305 is presented as an inseparable combination, closely adhering to the ...
4
votes
1answer
531 views

Challenge / Response to Prevent Replay Attack - Using nonce as challenge

I am implementing a radio protocol and trying to prevent replay attacks. It is an embedded system so storing nonce values is not an option, as each node in the system may talk to each other. My plan ...
4
votes
2answers
901 views

Using ChaCha20 as a PRNG with a variable-length seed

As far as I understand, the key stream of the ChaCha20 cipher may be used as a seeded PRNG, where the seed is used to set the key and the nonce. As described in RFC7539, ChaCha20 can be used with a ...
4
votes
1answer
929 views

Is XChaCha20-Poly1305 nonce misuse-resistant?

In the Libsodium v1.0.12 and v1.0.13 Security Assessment one can read The ChaCha20-Poly1305 implementation combines a stream cipher and is resistant to timing attacks by design. In addition, this ...
4
votes
1answer
439 views

Can I reuse a nonce to retransmit the same packet using ChaCha20-Poly1305?

I understand the "sudden death" implications of reusing a nonce with ChaCha20-poly1305, but I believe this rule doesn't apply if you are transmitting exactly the same packet. I'm putting together a ...
0
votes
1answer
231 views

minimal overhead of ChaCha20 + ECC

What we want? Encrypt plaintext with ChaCha20 + ECC on curve 25519 (hybrid cryptography) the result would be a data stracture X. Input: public key on Curve 25519 No authentication required (no AEAD)...
4
votes
3answers
947 views

ChaCha20-Poly1305 test vectors

I was trying to use OpenSSL 1.1 (via Ruby) to validate the ChaCha20-Poly1305 test vector from this IETF draft: https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305-04#section-7 The relevant ...
4
votes
1answer
288 views

Where is HChaCha20 formally defined?

I stumbled upon the Q&A “Advantages of HS1-SIV over ChaCha20-Poly1305-SIV?” which mentions “HChaCha20” in the question. Trying to look it up via the usual research sources, I failed to find an ...
4
votes
1answer
245 views

Negating the risk of a random 64-bit nonce

Given a stream cipher such as Chacha20, which uses a 64-bit nonce, it would be unsafe to use a random nonce because of the risk of accidental repetition (which if used twice with the same key would be ...
8
votes
1answer
2k views

Is ChaCha20 safer than AES with respect to side-channel attacks?

I've already seen some topics on this matter, but I feel like my question hasn't really been answered. Given the following: AES must be implemented in hardware (i.e. using the AES-NI instruction set)...
1
vote
1answer
246 views

Would using two keys for Salsa20 or ChaCha increase security?

Would using the keys (as in two passes with a key each) increase security for Salsa20 or ChaCha stream ciphers increase security?
2
votes
2answers
250 views

Possible to decrypt every fragment of an ecrypted file on its own?

I have a project where I want to encrypt a file and split it up into several fragments and place these files on different systems. I want to do it on mobile phones as well, so I chose poly-chacha20 as ...
3
votes
1answer
178 views

Determining strength of a crypto algorithm - clarification with the salsa paper

I am reading through the salsa family paper and on the second page DJB says this -- One can reasonably conjecture, for example, that every function that encrypts data in 0.5 Core-2 cycles/byte is ...
3
votes
1answer
267 views

Using ChaCha20 on very short messages with high packet loss

I'm building a low power wireless network and need to transmit very small packets at regular intervals (10 bytes every minute or so). In order to secure the communications I'm considering using ...
6
votes
1answer
198 views

Can NORX32-f be used in a Salsa20 style stream cipher?

#include <std_roll_your_own_crypto_warning.h> With the third round CAESAR candidates about to be announced, the design[0] of Salsa20/ChaCha + Poly1305 is ...
0
votes
1answer
489 views

Is a KDF needed when using X25519 for ECDH and XChaCha20-Poly1305 for AEAD?

Is a KDF needed when using X25519 for ECDH and XChaCha20-Poly1305 or XSalsa20-Poly1305 for authenticated encryption? My hypothesis is "no" because the key from X25519 is less than 256 bits long; ...
5
votes
1answer
253 views

In Fortuna, can I use ChaCha20 instead of a block cipher and Blake2b instead of iterated SHA256?

In the Fortuna CSPRNG, can I use ChaCha20 instead of a block cipher and Blake2b instead of double SHA256, and still retain security? My hypothesis is "yes" because: The block cipher's only use is in ...
4
votes
0answers
89 views

Creating an SPN cipher from ChaCha20 or Salsa20's double round function

Given that ChaCha20's building blocks have been also used to construct a hash function, can the double round function from either ChaCha20 or Salsa20 be used to construct a secure SP-network cipher? ...
9
votes
2answers
1k views

Nonce encryption with Poly1305-Chacha20

I have seen that a couple of companies (like Google, Apple HomeKit) are adding "ChaCha20-Poly1305" as an encryption option. Poly1305 requires algorithm to encrypt the nonce. The Poly1305-AES ...