Questions tagged [chacha]
ChaCha is a family of stream ciphers proposed by Daniel J. Bernstein, as an evolution of Salsa20 with (conjecturally) improved resistance to cryptanalysis.
20
questions
19
votes
3answers
733 views
Collision or second preimage for the ChaCha core?
Daniel J. Bernstein's ChaCha core is an evolution of the Salsa20 core. Both are functions over the set of 512-bit bitstrings, partitioned as sixteen 32-bit words.
Can we exhibit collisions, or second-...
1
vote
1answer
324 views
How to generate a nonce for ChaCha20 Poly1305?
I am using a self implementation of ChaCha20 with Poly1305. Since the nonce is only 96 bits it cannot be chosen at random. Can anyone suggest an efficient method to generate nonce from the key ?
6
votes
1answer
3k views
What happens if a nonce is reused in ChaCha20-Poly1305?
In ChaCha20-Poly1305, I know that reusing a nonce loses confidentiality and integrity for all messages encrypted with the (key, nonce) pair.
However, is security affected for those messages encrypted ...
10
votes
1answer
780 views
Can I use the ChaCha core as a 256-bit to 256-bit one-way function?
I'm looking to implement Lamport signatures as a little fun project, and I need a fast one way function that maps $\{0,1\}^{256} \rightarrow \{0,1\}^{256}$.
I was wondering whether I could safely use ...
9
votes
1answer
531 views
Can reduced-round ChaCha be used as non-cryptographic fast PRNG to produce output indistinguishable from random data?
The fastest known attack against the Salsa20 family of stream ciphers requires 2137 simple operations against Salsa20/7, or 2244 against Salsa20/8. The 8-round version encrypts data at 1.88 cycles-per-...
7
votes
2answers
1k views
Does ChaCha20/Salsa have the same bit strength as AES for identical key sizes?
Does ChaCha20/Salsa have the same bit strength as AES for identical key sizes? In other words, does ChaCha20 with a 128-bit key theoretically require 2^128 attempts to brute force, as with AES-128?
...
1
vote
2answers
197 views
ChaCha with 64bit integers as a PRNG with streams
Can I use ChaCha with four rounds as a good non-cryptographic PRNG with different streams if I use 64 bit integers instead of the standard 32 bit integers? I need a bigger state and this seems the ...
4
votes
1answer
651 views
chacha20-poly1305 padding and length encoding
The AEAD construction for chacha20-poly1305 described in the IETF proposal encodes message lengths into the text that is to be hashed. The newer proposal goes further and pads associated data and ...
12
votes
3answers
1k views
Why is the core ChaCha primitive not good for use in a CRCF? Why create BLAKE?
Why is the core ChaCha primitive not good for use in a collision-resistant compression function (crypto hash)? Why go through the trouble to create BLAKE?
What's wrong with using the core ChaCha ...
9
votes
1answer
348 views
Why is the whole initial state used in the final addition of Salsa20 and ChaCha?
Both Salsa20 and ChaCha basically work like this:
Put the key, the nonce, the sequence number and a constant into a 4x4 matrix of 32-bit words.
Transform the matrix invertibly with a number of ARX ...
9
votes
2answers
3k views
Where are the ChaCha20 test vectors/examples?
I see in the Salsa20 specification there are test examples throughout the document to help an implementer make sure every function works as designed. Consequently the whole algorithm would work ...
6
votes
1answer
623 views
Would it be safe to use the message hash as the IV in ChaCha?
This seemed like an option if the hash is unpredictable.
It could be the hash of the message or the hash of the message + some common secret (apart from the key).
The only circumstance in which the ...
3
votes
3answers
834 views
Does ChaCha20 counter actually increment through iterations?
RFC defines:
state = constants | key | counter | nonce
Suggested on multiple places is to set counter to 0 or 1.
It is still ...
6
votes
1answer
665 views
Does ChaCha20-Poly1305 need random nonce?
RFC 7539 says:
A 96-bit nonce -- different for each invocation with the same key
It doesn't explicitly say whether it has to be random or not. If we use an ever incrementing counter. Would that be ...
4
votes
1answer
630 views
Advantages of HS1-SIV over ChaCha20-Poly1305-SIV?
What advantages does HS1-SIV have over ChaCha20-Poly1305-SIV?
I know that both use the ChaCha stream cipher, but I am trying to understand why HS1-Hash is a better MAC.
Edit: To hide the Poly1305 ...
4
votes
1answer
421 views
ChaCha20 immune to timing attacks
What are the reasons because of which ChaCha20 is immune to timing attacks ? Also why is not AES immune to timing attacks?
2
votes
1answer
489 views
Salsa20 / ChaCha with 128 bit keys
According to wikipedia both Salsa20 and ChaCha support both 128 and 256-bit keys.
The initial state for each has 8 words of key, where each word is 32 bits. 32*8 = 256. My question is... how is one ...
2
votes
1answer
389 views
ARC4random – ChaCha-based LibreSSL PRG
Here is arc4random.c from the LibreSSL pseudorandom generator as used in OpenBSD.
It works as follows:
Take 40 "truly random" bytes from OS (PRG seed);
Use the seed as key and IV to generate 1024 ...
0
votes
0answers
37 views
Would a key recovery attack on ChaCha's keystream would be made more secure with an AONT?
To be clear I'm well aware that ChaCha doesn't need to be "improved". Also, I have no intentions or misguided ideas about trying to "improve" it. My question is hypothetical, and ...
0
votes
2answers
182 views
what are the benefits/limits of constructing AEAD using Duplex mode with ARX primitive (chacha20 for example)?
I understand that WAGE cipher uses duplex/sponge mode with stream based cipher for Authenticated encryption with associated data (AEAD) and NORX uses duplex/sponge mode with LRX structure , so , Is ...
