Questions tagged [chacha]

ChaCha is a family of stream ciphers proposed by Daniel J. Bernstein, as an evolution of Salsa20 with (conjecturally) improved resistance to cryptanalysis.

Filter by
Sorted by
Tagged with
8 votes
1 answer
1k views

Understanding the impact of partitioning oracle attacks on stream ciphers

Yesterday I came across some conversation discussing partitioning oracle attacks, against authenticated stream ciphers like ChaCha20 and Salsa20 with poly1305 for MAC. As I understand it (though the ...
Woodstock's user avatar
  • 1,394
20 votes
3 answers
1k views

Collision or second preimage for the ChaCha core?

Daniel J. Bernstein's ChaCha core is an evolution of the Salsa20 core. Both are functions over the set of 512-bit bitstrings, partitioned as sixteen 32-bit words. Can we exhibit collisions, or second-...
fgrieu's user avatar
  • 141k
1 vote
1 answer
2k views

How to generate a nonce for ChaCha20 Poly1305?

I am using a self implementation of ChaCha20 with Poly1305. Since the nonce is only 96 bits it cannot be chosen at random. Can anyone suggest an efficient method to generate nonce from the key ?
Aravind A's user avatar
  • 1,020
9 votes
2 answers
4k views

Does ChaCha20/Salsa have the same bit strength as AES for identical key sizes?

Does ChaCha20/Salsa have the same bit strength as AES for identical key sizes? In other words, does ChaCha20 with a 128-bit key theoretically require 2^128 attempts to brute force, as with AES-128? ...
Woodstock's user avatar
  • 1,394
6 votes
1 answer
6k views

What happens if a nonce is reused in ChaCha20-Poly1305?

In ChaCha20-Poly1305, I know that reusing a nonce loses confidentiality and integrity for all messages encrypted with the (key, nonce) pair. However, is security affected for those messages encrypted ...
Demi's user avatar
  • 4,793
10 votes
2 answers
5k views

Changing an Encryption scheme from AES to ChaCha20

I am using the AES cipher for my OTT platform. Almost all Chip vendors (ARM, Intel, etc) have built-in AES for faster and secure processing. Now, how feasible it is to move from AES to ChaCha20? ...
SSA's user avatar
  • 640
10 votes
1 answer
972 views

Can I use the ChaCha core as a 256-bit to 256-bit one-way function?

I'm looking to implement Lamport signatures as a little fun project, and I need a fast one way function that maps $\{0,1\}^{256} \rightarrow \{0,1\}^{256}$. I was wondering whether I could safely use ...
orlp's user avatar
  • 4,230
2 votes
2 answers
1k views

Salsa20 / ChaCha with 128 bit keys

According to wikipedia both Salsa20 and ChaCha support both 128 and 256-bit keys. The initial state for each has 8 words of key, where each word is 32 bits. 32*8 = 256. My question is... how is one ...
neubert's user avatar
  • 2,927
63 votes
5 answers
100k views

What's the appeal of using ChaCha20 instead of AES?

I read about ChaCha20 being used in TLS by Google, SSH, and towards standardization in general. What's the appeal of using something other than AES, what with AES receiving dedicated CPU instructions ...
JDługosz's user avatar
  • 733
10 votes
1 answer
764 views

Can reduced-round ChaCha be used as non-cryptographic fast PRNG to produce output indistinguishable from random data?

The fastest known attack against the Salsa20 family of stream ciphers requires 2137 simple operations against Salsa20/7, or 2244 against Salsa20/8. The 8-round version encrypts data at 1.88 cycles-per-...
forest's user avatar
  • 15.3k
6 votes
1 answer
1k views

Would it be safe to use the message hash as the IV in ChaCha?

This seemed like an option if the hash is unpredictable. It could be the hash of the message or the hash of the message + some common secret (apart from the key). The only circumstance in which the ...
alandefreitas's user avatar
4 votes
1 answer
1k views

Advantages of HS1-SIV over ChaCha20-Poly1305-SIV?

What advantages does HS1-SIV have over ChaCha20-Poly1305-SIV? I know that both use the ChaCha stream cipher, but I am trying to understand why HS1-Hash is a better MAC. Edit: To hide the Poly1305 ...
Demi's user avatar
  • 4,793
4 votes
1 answer
1k views

chacha20-poly1305 padding and length encoding

The AEAD construction for chacha20-poly1305 described in the IETF proposal encodes message lengths into the text that is to be hashed. The newer proposal goes further and pads associated data and ...
dietr's user avatar
  • 143
2 votes
2 answers
389 views

ChaCha with 64bit integers as a PRNG with streams

Can I use ChaCha with four rounds as a good non-cryptographic PRNG with different streams if I use 64 bit integers instead of the standard 32 bit integers? I need a bigger state and this seems the ...
Thorham's user avatar
  • 223
2 votes
1 answer
4k views

Is XChacha20 - Poly1305 Quantum resistant?

This is a question just out of curiosity, as I am a newbie to Post Quantum Cryptography. I have read several articles where they emphasize that current standardised symmetric encryption algorithms (...
Aravind A's user avatar
  • 1,020
1 vote
1 answer
548 views

Can we encrypt part of the XChaCha/XSalsa nonce?

The xChaCha cipher detailed here extends the nonce 192bits and works as follows (from the link): Pass the key and the first 16 bytes of the 24-byte nonce to HChaCha20 to obtain the subkey. Use the ...
Modal Nest's user avatar
  • 1,443
16 votes
3 answers
2k views

Why is the core ChaCha primitive not good for use in a CRCF? Why create BLAKE?

Why is the core ChaCha primitive not good for use in a collision-resistant compression function (crypto hash)? Why go through the trouble to create BLAKE? What's wrong with using the core ChaCha ...
Charlie's user avatar
  • 374
10 votes
1 answer
582 views

Why is the whole initial state used in the final addition of Salsa20 and ChaCha?

Both Salsa20 and ChaCha basically work like this: Put the key, the nonce, the sequence number and a constant into a 4x4 matrix of 32-bit words. Transform the matrix invertibly with a number of ARX ...
otus's user avatar
  • 32.1k
9 votes
2 answers
5k views

Where are the ChaCha20 test vectors/examples?

I see in the Salsa20 specification there are test examples throughout the document to help an implementer make sure every function works as designed. Consequently the whole algorithm would work ...
Motox's user avatar
  • 146
8 votes
1 answer
5k views

Is ChaCha20 safer than AES with respect to side-channel attacks?

I've already seen some topics on this matter, but I feel like my question hasn't really been answered. Given the following: AES must be implemented in hardware (i.e. using the AES-NI instruction set)...
Dreadlockyx's user avatar
6 votes
1 answer
1k views

Does ChaCha20-Poly1305 need random nonce?

RFC 7539 says: A 96-bit nonce -- different for each invocation with the same key It doesn't explicitly say whether it has to be random or not. If we use an ever incrementing counter. Would that be ...
Saptarshi Basu's user avatar
5 votes
3 answers
3k views

Does ChaCha20 counter actually increment through iterations?

RFC defines: state = constants | key | counter | nonce Suggested on multiple places is to set counter to 0 or 1. It is still ...
michnovka's user avatar
  • 356
4 votes
2 answers
1k views

Can I reuse a nonce to retransmit the same packet using ChaCha20-Poly1305?

I understand the "sudden death" implications of reusing a nonce with ChaCha20-poly1305, but I believe this rule doesn't apply if you are transmitting exactly the same packet. I'm putting together a ...
microwavesafe's user avatar
4 votes
1 answer
626 views

ChaCha20 immune to timing attacks

What are the reasons because of which ChaCha20 is immune to timing attacks ? Also why is not AES immune to timing attacks?
Shridhar R Kulkarni's user avatar
3 votes
1 answer
2k views

How resistant are stream ciphers like Salsa20 or ChaCha in a post-quantum world?

What kind of quantum computer would be required, if it is possible to break such ciphers?
Bobisnotyouruncle's user avatar
3 votes
2 answers
2k views

What are best practices for long term storage (~20 years) of encrypted / sensitive files?

I have some very sensitive family files that I want to store in the cloud on multiple providers for maximal reliability and redundancy. It's essentially a large archive of all our family photos, ...
Evan Su's user avatar
  • 449
3 votes
1 answer
499 views

ARC4random – ChaCha-based LibreSSL PRG

Here is arc4random.c from the LibreSSL pseudorandom generator as used in OpenBSD. It works as follows: Take 40 "truly random" bytes from OS (PRG seed); Use the seed as key and IV to generate 1024 ...
kludg's user avatar
  • 736
2 votes
1 answer
4k views

XChaCha20 vs AES 128 security and speed

Is XChaCha20 with 256 bit key and 192 bit nonce more secure than 128 bit key 128 bit key nonce AES, due to using larger key/nonce sizes? Isn't it supposed to be faster due to being a stream cipher? (...
imdoingmath's user avatar
1 vote
0 answers
398 views

Would a key recovery attack on ChaCha's keystream would be made more secure with an AONT?

To be clear I'm well aware that ChaCha doesn't need to be "improved". Also, I have no intentions or misguided ideas about trying to "improve" it. My question is hypothetical, and ...
Modal Nest's user avatar
  • 1,443
0 votes
2 answers
678 views

If all encrypt algorithms in TLS1.3 ciphersuites are AEAD , why do they keep including a Hash algorithm?

In TLS1.3 all allowed algorithms included in cipher suites are AEAD, which means they don't just encrypt but they authenticate too (thus if I don't misunderstand, they give not only confidentiality ...
Osqui's user avatar
  • 103
0 votes
2 answers
275 views

what are the benefits/limits of constructing AEAD using Duplex mode with ARX primitive (chacha20 for example)?

I understand that WAGE cipher uses duplex/sponge mode with stream based cipher for Authenticated encryption with associated data (AEAD) and NORX uses duplex/sponge mode with LRX structure , so , Is ...
hardyrama's user avatar
  • 2,126