Questions tagged [chacha]

ChaCha is a family of stream ciphers proposed by Daniel J. Bernstein, as an evolution of Salsa20 with (conjecturally) improved resistance to cryptanalysis.

Filter by
Sorted by
Tagged with
-1
votes
2answers
71 views

Is there any vulnerability in this scheme?

We want to design a symmetric encryption scheme. Note that the following things are true for our system: The plaintext P will change every time for a given user. A user will choose a password which ...
0
votes
0answers
50 views

recommended encryption algorithms to create an encrypted communication application

I have just turned 17 and I have been developing in Java for a few years. Recently I have been interested in a language called rust, I have also been made aware of privacy issues by some of my friends....
0
votes
2answers
67 views

If all encrypt algorithms in TLS1.3 ciphersuites are AEAD , why do they keep including a Hash algorithm?

In TLS1.3 all allowed algorithms included in cipher suites are AEAD, which means they don't just encrypt but they authenticate too (thus if I don't misunderstand, they give not only confidentiality ...
0
votes
1answer
39 views

Termonology help: What is using AEAD without encrypting data called?

I'm using ChaCha20-Poly1305 in a "full AEAD" mode, where a payload of data is encrypted and a block of unencrypted "additional data" is secured as well. However, I'd like to also occasionally use the ...
11
votes
3answers
1k views

Why is the core ChaCha primitive not good for use in a CRCF? Why create BLAKE?

Why is the core ChaCha primitive not good for use in a collision-resistant compression function (crypto hash)? Why go through the trouble to create BLAKE? What's wrong with using the core ChaCha ...
2
votes
1answer
601 views

Is XSalsa20-Poly1305-SIV a reasonable choice for nonce-misuse-resistant authenticated encryption?

Consider XSalsa20-Poly1305-SIV. This is obtained by: computing a MAC $t_{secret}$ of the plaintext from the key and nonce, as in ChaCha20-Poly1305 except that the plaintext, not the ciphertext, is ...
1
vote
1answer
136 views

Chacha20 internal counter/position and nonce

I have to encrypt the communications between two devices. I was planning on using a timestamp(in seconds) and the serial number as the nonce. I know its impossible for me to send more than 100 ...
2
votes
1answer
154 views

Related-key attacks against Salsa20 and ChaCha

From the Salsa20 security document, DJB states that he doesn't care about related key attacks: The standard solutions to all the standard cryptographic problems—encryption, authentication, etc.—are ...
1
vote
1answer
86 views

(Whitebox Crypto) Using ChaCha20, is it safe to reduce the nonce length in a single block cipher?

I am willing to write a Whitebox Crypto unit using ChaCha20 algorithm (Bernstein, D. 2008) for an input consisting of a single block. The fact it is going to be a single block cipher is of special ...
5
votes
1answer
1k views

Is XChaCha20-Poly1305 nonce misuse-resistant?

In the Libsodium v1.0.12 and v1.0.13 Security Assessment one can read The ChaCha20-Poly1305 implementation combines a stream cipher and is resistant to timing attacks by design. In addition, this ...
0
votes
2answers
107 views

what are the benefits/limits of constructing AEAD using Duplex mode with ARX primitive (chacha20 for example)?

I understand that WAGE cipher uses duplex/sponge mode with stream based cipher for Authenticated encryption with associated data (AEAD) and NORX uses duplex/sponge mode with LRX structure , so , Is ...
2
votes
1answer
298 views

ChaCha20: is this a potentially safe way of using nonce derived from private key if the key/nonce pair is never reused, for a given plaintext?

Note: I realize in ChaCha20 the nonce should be random and unique each time follow certain constraints but am trying to determine whether there could be a safe way to use it just once if other ...
2
votes
1answer
287 views

Which version of ChaCha is more secure?

Which version of ChaCha is more secure? XChaCha20-Poly1305-IETF ChaCha20-IETF-Poly1305 ChaCha20-Poly1305 I am looking for 256bit strength for large datasets. ...
3
votes
1answer
612 views

384-bit ChaCha20 / Salsa20

The standard Salsa20 core is a $\{0,1\}^{384} \to \{0,1\}^{512}$ random function with a 16 byte constant ($\sigma$ for a 32-byte key), an 8 byte nonce, an 8 byte counter, and a 32 byte key. The hash ...
4
votes
1answer
103 views

Fundamental difference between the constant, key, nonce, and counter bits in Salsa20/ChaCha20 or AES-Encrypt?

The Salsa20 core function takes a 128-bit constant, 256-bit key, 64-bit counter, and 64-bit nonce and produces a 512-bit value. Or more generically, it is a mapping from 512-bit values to 512-bit ...
0
votes
1answer
96 views

Different ways of building a ChaCha20-based RNG

Let's say you're building RNG with ChaCha20 and the fast key erasure technique. There seem to be a few ways to do it. The reference implementation in the SUPERCOP benchmarking toolkit looks like ...
0
votes
1answer
208 views

Hardware optimized stream ciphers?

As I understand it, ChaCha20 is slower than AES-CTR in hardware. Are there any hardware-optimized stream ciphers?
5
votes
0answers
121 views

Why Salsa20 rotates columns vertically to optimize for SIMD?

I'm writing a school assignment and I'm trying to fully grasp the differences between Salsa20 and ChaCha. I've come to understand that by rotating upwards the initial matrix columns, DJB says that ...
6
votes
2answers
415 views

Does ChaCha20/Salsa have the same Bit Strength as AES for identical key sizes?

i.e. does ChaCha20 with a 128bit key, require 2^128 attempts to brute force, as with AES-128, theoretically? Ps. notwithstanding that ChaCha is a stream cipher.
7
votes
0answers
171 views

Why is BLAKE2 faster than chacha20?

Chacha20 is essentially a hash function that maps 512-bit strings to other 512-bit strings which are in turn xored with the plaintext to create the ciphertext. Of the 512-bit input 128-bit are used ...
5
votes
2answers
116 views

Append data to authenticated ciphertext encrypted using a stream cipher

Say we have xSalsa20 authenticated using Poly1305. If $ X $ is the ciphertext, $N$ is the nonce value, and $H$ is the authentication tag such that the final ciphertext is $ N || X || H $, then given ...
3
votes
3answers
371 views

Largest message size for XChaCha20-Poly1305

libsodium documentation says that XChaCha20-Poly1305 can encrypt a message of arbitrary size. However, the only specification available (still a draft) explains that under the hood the IETF version ...
6
votes
1answer
1k views

Extending key sizes in Salsa20 and ChaCha?

I've written implementations of Salsa20 and ChaCha that accept 384 and 448 bit keys. It was fairly trivial to implement, the 'sigma' constant is replaced with key material, and the counter, (which was ...
2
votes
3answers
387 views

Does ChaCha20 counter actually increment through iterations?

RFC defines: state = constants | key | counter | nonce Suggested on multiple places is to set counter to 0 or 1. It is still ...
1
vote
1answer
176 views

How resistant are stream ciphers like Salsa20 or ChaCha in a post-quantum world?

What kind of quantum computer would be required, if it is possible to break such ciphers?
2
votes
3answers
161 views

Can I achieve data authentication with ChaCha20 without MAC?

My case is rather special. I need to send data in small chunks, each under 32bytes. ChaCha20 state is 64 bytes. Since I will be receiving data stream in chunks, id like to verify it on the fly (i.e. ...
1
vote
0answers
28 views

Round counts and permutation usage for hashing for a Merkle tree

Are there any current recommendations for performant hashing in a Merkle tree? It appears the hash based signatures in Sphincs use Blake2 everywhere (see Table 1 on page 22 of https://sphincs.cr.yp....
2
votes
1answer
343 views

Why is there no 'ECDSA' version of 'DHE-RSA-CHACHA20-POLY1305'?

So I was just checking my TLS cipherlist and noticed that there was a 'DSS' / DSA / ECDSA version of every ...
6
votes
1answer
382 views

Would it be safe to use the message hash as the IV in ChaCha?

This seemed like an option if the hash is unpredictable. It could be the hash of the message or the hash of the message + some common secret (apart from the key). The only circumstance in which the ...
2
votes
1answer
246 views

What are implementations of PRNGs based on ChaCha20? [closed]

I thought I'd find an implementation in NaCl, but /dev/urandom is what I find. Search engines samples revealed most implementations are broken. What libraries are ...
1
vote
1answer
129 views

ChaCha with 64bit integers as a PRNG with streams

Can I use ChaCha with four rounds as a good non-cryptographic PRNG with different streams if I use 64 bit integers instead of the standard 32 bit integers? I need a bigger state and this seems the ...
2
votes
2answers
438 views

Understanding ChaCha20-Poly1305 AEAD

In the AEAD scheme described in https://tools.ietf.org/html/rfc7539#section-2.8.1, the aad and cyphertext are padded to be a multiple of 16 bytes in length. Why is this necessary? Does it provide any ...
1
vote
1answer
311 views

Is it safe to send IV in plain text for every request?

Currently, I am creating a project with an IoT device. This is an offline device which shows a QR code which can be scanned by a mobile device, which sends this code to a server. The server handles ...
6
votes
1answer
439 views

Does ChaCha20-Poly1305 need random nonce?

RFC 7539 says: A 96-bit nonce -- different for each invocation with the same key It doesn't explicitly say whether it has to be random or not. If we use an ever incrementing counter. Would that be ...
2
votes
1answer
243 views

Salsa20 / ChaCha with 128 bit keys

According to wikipedia both Salsa20 and ChaCha support both 128 and 256-bit keys. The initial state for each has 8 words of key, where each word is 32 bits. 32*8 = 256. My question is... how is one ...
6
votes
3answers
176 views

Mixing x into permutation through XOR vs. modular addition

Block ciphers mix key material into the permutation through XOR. Also do pre and post whitening this way. Chacha/Salsa finishes by 32-bit modular adding key and iv material (among other bits but ...
2
votes
1answer
39 views

Are Authenticated Encryption ciphersuites supported in legacy TLS versions older than TLS 1.2?

I have read in a paper that Authenticated Encryption (by this I mean those that support GCM mode or ChaCha20 ciphers) are not supported in versions older than TLS 1.2? I could not confirm this as ...
4
votes
1answer
640 views

Challenge / Response to Prevent Replay Attack - Using nonce as challenge

I am implementing a radio protocol and trying to prevent replay attacks. It is an embedded system so storing nonce values is not an option, as each node in the system may talk to each other. My plan ...
2
votes
2answers
2k views

How secure is ChaCha20? [closed]

I want to implement a stream cipher to encrypt very sensitive data in my Python code. I heard about the ChaCha20 algorithm and the PyCryptodome library , but how secure is it ?
2
votes
1answer
234 views

Does chacha20-poly1305 require new key for every encryption process?

As I know chacha20-poly1305 is stream cipher. Does that mean for every encryption process require a new key?
6
votes
1answer
196 views

Reason for 3 rounds ChaCha in ChaCha20Poly1305@openssh

OpenSSH uses a slightly different ChaCha20Poly1305 AEAD construct then the one proposed by A. Langley and others for TLS. The TLS version The openSSH version (and here) The openSSH version uses two ...
5
votes
1answer
159 views

Latin dance family in block cipher

Is it secure to use Salsa20/ChaCha as the key schedule for a 512-bit block cipher using a public permutation in Even-Mansour construction?
1
vote
2answers
832 views

Is it safe to use a timestamp to build a nonce?

I'm writing an application, which can be used on multiple clients, and share data on a server. To make sure the data never leaves the clients unencrypted, the application should offer encryption with ...
1
vote
0answers
68 views

ChaCha20 - How confidentiality is lost if reusing nonce? [duplicate]

I read that (key, nonce) pair should be used only once for encryption of a message. My question is how confidentiality can be lost if two peers using a shared key use same (key, nonce) pair to encrypt ...
3
votes
1answer
384 views

Can ChaCha20 be repurposed as a general purpose permutation function like Gimli?

I like the idea behind Gimli and libhydrogen but in my benchmarks Gimli permutation function is considerably slower than ChaCha20 one. By considerably I mean four times slower using SIMD builtins. ...
6
votes
3answers
2k views

Is it safe to use a random numbers instead of a counter in ChaCha20?

Besides the IV, ChaCha20 takes a random number and a counter as input. I couldn't find more precise information about this but it seems to be that the counter is just a safety measure in case of a ...
0
votes
1answer
111 views

Sending the nonce in ChachaPoly1305 with the ciphertext

I am trying to implement a ChachaPoly1305 encryption with authentication scheme over a network. I am using a counter to derive the nonce as suggested by the rfc. Is it secure to send the nonce over ...
9
votes
1answer
430 views

Can reduced-round ChaCha be used as non-cryptographic fast PRNG to produce output indistinguishable from random data?

The fastest known attack against the Salsa20 family of stream ciphers requires 2137 simple operations against Salsa20/7, or 2244 against Salsa20/8. The 8-round version encrypts data at 1.88 cycles-per-...
3
votes
1answer
230 views

Message length limit induced by block counter size

Wikipedia reports the following information about the ChaCha20 algorithm: An implementation reference for ChaCha20 has been published in RFC 7539. The IETF's implementation modified Bernstein's ...
2
votes
0answers
50 views

Rationale behind IETF-ChaChaPoly's padding during MAC computation [duplicate]

RFC 7539 (Section 2.8) specifies a ChaCha20/Poly1305 based AEAD cipher scheme; pseudocode: ...