Questions tagged [chacha]
ChaCha is a family of stream ciphers proposed by Daniel J. Bernstein, as an evolution of Salsa20 with (conjecturally) improved resistance to cryptanalysis.
14
questions
19
votes
3answers
643 views
Collision or second preimage for the ChaCha core?
Daniel J. Bernstein's ChaCha core is an evolution of the Salsa20 core. Both are functions over the set of 512-bit bitstrings, partitioned as sixteen 32-bit words.
Can we exhibit collisions, or second-...
5
votes
1answer
2k views
What happens if a nonce is reused in ChaCha20-Poly1305?
In ChaCha20-Poly1305, I know that reusing a nonce loses confidentiality and integrity for all messages encrypted with the (key, nonce) pair.
However, is security affected for those messages encrypted ...
10
votes
1answer
716 views
Can I use the ChaCha core as a 256-bit to 256-bit one-way function?
I'm looking to implement Lamport signatures as a little fun project, and I need a fast one way function that maps $\{0,1\}^{256} \rightarrow \{0,1\}^{256}$.
I was wondering whether I could safely use ...
9
votes
1answer
430 views
Can reduced-round ChaCha be used as non-cryptographic fast PRNG to produce output indistinguishable from random data?
The fastest known attack against the Salsa20 family of stream ciphers requires 2137 simple operations against Salsa20/7, or 2244 against Salsa20/8. The 8-round version encrypts data at 1.88 cycles-per-...
1
vote
1answer
129 views
ChaCha with 64bit integers as a PRNG with streams
Can I use ChaCha with four rounds as a good non-cryptographic PRNG with different streams if I use 64 bit integers instead of the standard 32 bit integers? I need a bigger state and this seems the ...
4
votes
1answer
543 views
chacha20-poly1305 padding and length encoding
The AEAD construction for chacha20-poly1305 described in the IETF proposal encodes message lengths into the text that is to be hashed. The newer proposal goes further and pads associated data and ...
11
votes
3answers
1k views
Why is the core ChaCha primitive not good for use in a CRCF? Why create BLAKE?
Why is the core ChaCha primitive not good for use in a collision-resistant compression function (crypto hash)? Why go through the trouble to create BLAKE?
What's wrong with using the core ChaCha ...
9
votes
1answer
321 views
Why is the whole initial state used in the final addition of Salsa20 and ChaCha?
Both Salsa20 and ChaCha basically work like this:
Put the key, the nonce, the sequence number and a constant into a 4x4 matrix of 32-bit words.
Transform the matrix invertibly with a number of ARX ...
6
votes
1answer
381 views
Would it be safe to use the message hash as the IV in ChaCha?
This seemed like an option if the hash is unpredictable.
It could be the hash of the message or the hash of the message + some common secret (apart from the key).
The only circumstance in which the ...
8
votes
2answers
3k views
Where are the ChaCha20 test vectors/examples?
I see in the Salsa20 specification there are test examples throughout the document to help an implementer make sure every function works as designed. Consequently the whole algorithm would work ...
4
votes
1answer
511 views
Advantages of HS1-SIV over ChaCha20-Poly1305-SIV?
What advantages does HS1-SIV have over ChaCha20-Poly1305-SIV?
I know that both use the ChaCha stream cipher, but I am trying to understand why HS1-Hash is a better MAC.
Edit: To hide the Poly1305 ...
4
votes
1answer
371 views
ChaCha20 immune to timing attacks
What are the reasons because of which ChaCha20 is immune to timing attacks ? Also why is not AES immune to timing attacks?
2
votes
1answer
243 views
Salsa20 / ChaCha with 128 bit keys
According to wikipedia both Salsa20 and ChaCha support both 128 and 256-bit keys.
The initial state for each has 8 words of key, where each word is 32 bits. 32*8 = 256. My question is... how is one ...
2
votes
1answer
347 views
ARC4random – ChaCha-based LibreSSL PRG
Here is arc4random.c from the LibreSSL pseudorandom generator as used in OpenBSD.
It works as follows:
Take 40 "truly random" bytes from OS (PRG seed);
Use the seed as key and IV to generate 1024 ...
