Questions tagged [chacha]

ChaCha is a family of stream ciphers proposed by Daniel J. Bernstein, as an evolution of Salsa20 with (conjecturally) improved resistance to cryptanalysis.

Filter by
Sorted by
Tagged with
0
votes
0answers
23 views

Streaming encryption with handshake [closed]

I am writing a protocol that is meant to provide high-speed streaming-encryption for the games I am writing. I would like to avoid a dependency on OpenSSL for licensing reasons, so I am using ...
0
votes
0answers
43 views

recommended encryption algorithms to create an encrypted communication application

I have just turned 17 and I have been developing in Java for a few years. Recently I have been interested in a language called rust, I have also been made aware of privacy issues by some of my friends....
0
votes
2answers
61 views

If all encrypt algorithms in TLS1.3 ciphersuites are AEAD , why do they keep including a Hash algorithm?

In TLS1.3 all allowed algorithms included in cipher suites are AEAD, which means they don't just encrypt but they authenticate too (thus if I don't misunderstand, they give not only confidentiality ...
0
votes
1answer
33 views

Termonology help: What is using AEAD without encrypting data called?

I'm using ChaCha20-Poly1305 in a "full AEAD" mode, where a payload of data is encrypted and a block of unencrypted "additional data" is secured as well. However, I'd like to also occasionally use the ...
11
votes
3answers
1k views

Why is the core ChaCha primitive not good for use in a CRCF? Why create BLAKE?

Why is the core ChaCha primitive not good for use in a collision-resistant compression function (crypto hash)? Why go through the trouble to create BLAKE? What's wrong with using the core ChaCha ...
1
vote
1answer
128 views

Chacha20 internal counter/position and nonce

I have to encrypt the communications between two devices. I was planning on using a timestamp(in seconds) and the serial number as the nonce. I know its impossible for me to send more than 100 ...
1
vote
1answer
84 views

(Whitebox Crypto) Using ChaCha20, is it safe to reduce the nonce length in a single block cipher?

I am willing to write a Whitebox Crypto unit using ChaCha20 algorithm (Bernstein, D. 2008) for an input consisting of a single block. The fact it is going to be a single block cipher is of special ...
0
votes
2answers
87 views

what are the benefits/limits of constructing AEAD using Duplex mode with ARX primitive (chacha20 for example)?

I understand that WAGE cipher uses duplex/sponge mode with stream based cipher for Authenticated encryption with associated data (AEAD) and NORX uses duplex/sponge mode with LRX structure , so , Is ...
2
votes
1answer
201 views

Which version of ChaCha is more secure?

Which version of ChaCha is more secure? XChaCha20-Poly1305-IETF ChaCha20-IETF-Poly1305 ChaCha20-Poly1305 I am looking for 256bit strength for large datasets. ...
1
vote
1answer
202 views

ChaCha20: is this a potentially safe way of using nonce derived from private key if the key/nonce pair is never reused, for a given plaintext?

Note: I realize in ChaCha20 the nonce should be random and unique each time follow certain constraints but am trying to determine whether there could be a safe way to use it just once if other ...
2
votes
1answer
147 views

Related-key attacks against Salsa20 and ChaCha

From the Salsa20 security document, DJB states that he doesn't care about related key attacks: The standard solutions to all the standard cryptographic problems—encryption, authentication, etc.—are ...
0
votes
1answer
75 views

Different ways of building a ChaCha20-based RNG

Let's say you're building RNG with ChaCha20 and the fast key erasure technique. There seem to be a few ways to do it. The reference implementation in the SUPERCOP benchmarking toolkit looks like ...
4
votes
1answer
93 views

Fundamental difference between the constant, key, nonce, and counter bits in Salsa20/ChaCha20 or AES-Encrypt?

The Salsa20 core function takes a 128-bit constant, 256-bit key, 64-bit counter, and 64-bit nonce and produces a 512-bit value. Or more generically, it is a mapping from 512-bit values to 512-bit ...
7
votes
0answers
162 views

Why is BLAKE2 faster than chacha20?

Chacha20 is essentially a hash function that maps 512-bit strings to other 512-bit strings which are in turn xored with the plaintext to create the ciphertext. Of the 512-bit input 128-bit are used ...
5
votes
2answers
115 views

Append data to authenticated ciphertext encrypted using a stream cipher

Say we have xSalsa20 authenticated using Poly1305. If $ X $ is the ciphertext, $N$ is the nonce value, and $H$ is the authentication tag such that the final ciphertext is $ N || X || H $, then given ...
3
votes
3answers
322 views

Largest message size for XChaCha20-Poly1305

libsodium documentation says that XChaCha20-Poly1305 can encrypt a message of arbitrary size. However, the only specification available (still a draft) explains that under the hood the IETF version ...
6
votes
2answers
333 views

Does ChaCha20/Salsa have the same Bit Strength as AES for identical key sizes?

i.e. does ChaCha20 with a 128bit key, require 2^128 attempts to brute force, as with AES-128, theoretically? Ps. notwithstanding that ChaCha is a stream cipher.
1
vote
1answer
167 views

How resistant are stream ciphers like Salsa20 or ChaCha in a post-quantum world?

What kind of quantum computer would be required, if it is possible to break such ciphers?
2
votes
3answers
145 views

Can I achieve data authentication with ChaCha20 without MAC?

My case is rather special. I need to send data in small chunks, each under 32bytes. ChaCha20 state is 64 bytes. Since I will be receiving data stream in chunks, id like to verify it on the fly (i.e. ...
2
votes
3answers
329 views

Does ChaCha20 counter actually increment through iterations?

RFC defines: state = constants | key | counter | nonce Suggested on multiple places is to set counter to 0 or 1. It is still ...
1
vote
0answers
28 views

Round counts and permutation usage for hashing for a Merkle tree

Are there any current recommendations for performant hashing in a Merkle tree? It appears the hash based signatures in Sphincs use Blake2 everywhere (see Table 1 on page 22 of https://sphincs.cr.yp....
2
votes
1answer
224 views

What are implementations of PRNGs based on ChaCha20? [closed]

I thought I'd find an implementation in NaCl, but /dev/urandom is what I find. Search engines samples revealed most implementations are broken. What libraries are ...
1
vote
1answer
125 views

ChaCha with 64bit integers as a PRNG with streams

Can I use ChaCha with four rounds as a good non-cryptographic PRNG with different streams if I use 64 bit integers instead of the standard 32 bit integers? I need a bigger state and this seems the ...
1
vote
1answer
282 views

Is it safe to send IV in plain text for every request?

Currently, I am creating a project with an IoT device. This is an offline device which shows a QR code which can be scanned by a mobile device, which sends this code to a server. The server handles ...
6
votes
1answer
407 views

Does ChaCha20-Poly1305 need random nonce?

RFC 7539 says: A 96-bit nonce -- different for each invocation with the same key It doesn't explicitly say whether it has to be random or not. If we use an ever incrementing counter. Would that be ...
2
votes
1answer
216 views

Salsa20 / ChaCha with 128 bit keys

According to wikipedia both Salsa20 and ChaCha support both 128 and 256-bit keys. The initial state for each has 8 words of key, where each word is 32 bits. 32*8 = 256. My question is... how is one ...
2
votes
2answers
379 views

Understanding ChaCha20-Poly1305 AEAD

In the AEAD scheme described in https://tools.ietf.org/html/rfc7539#section-2.8.1, the aad and cyphertext are padded to be a multiple of 16 bytes in length. Why is this necessary? Does it provide any ...
6
votes
3answers
164 views

Mixing x into permutation through XOR vs. modular addition

Block ciphers mix key material into the permutation through XOR. Also do pre and post whitening this way. Chacha/Salsa finishes by 32-bit modular adding key and iv material (among other bits but ...
2
votes
1answer
37 views

Are Authenticated Encryption ciphersuites supported in legacy TLS versions older than TLS 1.2?

I have read in a paper that Authenticated Encryption (by this I mean those that support GCM mode or ChaCha20 ciphers) are not supported in versions older than TLS 1.2? I could not confirm this as ...
2
votes
2answers
2k views

How secure is ChaCha20? [closed]

I want to implement a stream cipher to encrypt very sensitive data in my Python code. I heard about the ChaCha20 algorithm and the PyCryptodome library , but how secure is it ?
2
votes
1answer
221 views

Does chacha20-poly1305 require new key for every encryption process?

As I know chacha20-poly1305 is stream cipher. Does that mean for every encryption process require a new key?
6
votes
1answer
189 views

Reason for 3 rounds ChaCha in ChaCha20Poly1305@openssh

OpenSSH uses a slightly different ChaCha20Poly1305 AEAD construct then the one proposed by A. Langley and others for TLS. The TLS version The openSSH version (and here) The openSSH version uses two ...
5
votes
1answer
135 views

Latin dance family in block cipher

Is it secure to use Salsa20/ChaCha as the key schedule for a 512-bit block cipher using a public permutation in Even-Mansour construction?
1
vote
2answers
792 views

Is it safe to use a timestamp to build a nonce?

I'm writing an application, which can be used on multiple clients, and share data on a server. To make sure the data never leaves the clients unencrypted, the application should offer encryption with ...
1
vote
0answers
66 views

ChaCha20 - How confidentiality is lost if reusing nonce? [duplicate]

I read that (key, nonce) pair should be used only once for encryption of a message. My question is how confidentiality can be lost if two peers using a shared key use same (key, nonce) pair to encrypt ...
3
votes
1answer
368 views

Can ChaCha20 be repurposed as a general purpose permutation function like Gimli?

I like the idea behind Gimli and libhydrogen but in my benchmarks Gimli permutation function is considerably slower than ChaCha20 one. By considerably I mean four times slower using SIMD builtins. ...
6
votes
3answers
2k views

Is it safe to use a random numbers instead of a counter in ChaCha20?

Besides the IV, ChaCha20 takes a random number and a counter as input. I couldn't find more precise information about this but it seems to be that the counter is just a safety measure in case of a ...
5
votes
1answer
354 views

Would it be safe to use the message hash as the IV in ChaCha?

This seemed like an option if the hash is unpredictable. It could be the hash of the message or the hash of the message + some common secret (apart from the key). The only circumstance in which the ...
0
votes
1answer
109 views

Sending the nonce in ChachaPoly1305 with the ciphertext

I am trying to implement a ChachaPoly1305 encryption with authentication scheme over a network. I am using a counter to derive the nonce as suggested by the rfc. Is it secure to send the nonce over ...
3
votes
1answer
227 views

Message length limit induced by block counter size

Wikipedia reports the following information about the ChaCha20 algorithm: An implementation reference for ChaCha20 has been published in RFC 7539. The IETF's implementation modified Bernstein's ...
2
votes
0answers
50 views

Rationale behind IETF-ChaChaPoly's padding during MAC computation [duplicate]

RFC 7539 (Section 2.8) specifies a ChaCha20/Poly1305 based AEAD cipher scheme; pseudocode: ...
2
votes
1answer
108 views

Should I include the ciphertext length in an AAD when using Chacha20+Poly1205 AEAD?

I want to construct a time-limited authorization token using ChaCha20 and Poly1305 as defined by RFC7539. I chose the following simple layout: ...
8
votes
1answer
417 views

Can reduced-round ChaCha be used as non-cryptographic fast PRNG to produce output indistinguishable from random data?

The fastest known attack against the Salsa20 family of stream ciphers requires 2137 simple operations against Salsa20/7, or 2244 against Salsa20/8. The 8-round version encrypts data at 1.88 cycles-per-...
3
votes
1answer
594 views

384-bit ChaCha20 / Salsa20

The standard Salsa20 core is a $\{0,1\}^{384} \to \{0,1\}^{512}$ random function with a 16 byte constant ($\sigma$ for a 32-byte key), an 8 byte nonce, an 8 byte counter, and a 32 byte key. The hash ...
5
votes
0answers
120 views

Why Salsa20 rotates columns vertically to optimize for SIMD?

I'm writing a school assignment and I'm trying to fully grasp the differences between Salsa20 and ChaCha. I've come to understand that by rotating upwards the initial matrix columns, DJB says that ...
3
votes
0answers
453 views

Chacha20 random nonce + counter

I need to establish potentially infinite secure streams of data between many remote devices with very few resources. Chacha20 is lightweight enough, but I do not trust myself to implement a reliable ...
5
votes
1answer
258 views

Can ChaCha be turned into a collision resistant hash function by xoring keystreams?

In his paper about RFSB Bernstein states that the compression function $(m_1,\ m_2,\ m_3,\ ...\ ,\ m_n) \rightarrow c_1[m_1]\ \oplus\ c_2[m_2]\ \oplus c_3[m_3]\ \oplus\ ... \oplus\ c_n[m_n]$ is ...
1
vote
1answer
186 views

Is streaming API to ChaCha20-Poly1305 possible or recommended against?

None of the implementations of ChaCha20-Poly1305 AEAD scheme I've seen so far provide a streaming API. Instead, ChaCha20-Poly1305 is presented as an inseparable combination, closely adhering to the ...
4
votes
1answer
620 views

Challenge / Response to Prevent Replay Attack - Using nonce as challenge

I am implementing a radio protocol and trying to prevent replay attacks. It is an embedded system so storing nonce values is not an option, as each node in the system may talk to each other. My plan ...
4
votes
2answers
1k views

Using ChaCha20 as a PRNG with a variable-length seed

As far as I understand, the key stream of the ChaCha20 cipher may be used as a seeded PRNG, where the seed is used to set the key and the nonce. As described in RFC7539, ChaCha20 can be used with a ...