A message from our CEO about the future of Stack Overflow and Stack Exchange. Read now.

Questions tagged [chacha]

ChaCha is a family of stream ciphers proposed by Daniel J. Bernstein, as an evolution of Salsa20 with (conjecturally) improved resistance to cryptanalysis.

Filter by
Sorted by
Tagged with
5
votes
1answer
1k views

Is XChaCha20-Poly1305 nonce misuse-resistant?

In the Libsodium v1.0.12 and v1.0.13 Security Assessment one can read The ChaCha20-Poly1305 implementation combines a stream cipher and is resistant to timing attacks by design. In addition, this ...
4
votes
1answer
524 views

Can I reuse a nonce to retransmit the same packet using ChaCha20-Poly1305?

I understand the "sudden death" implications of reusing a nonce with ChaCha20-poly1305, but I believe this rule doesn't apply if you are transmitting exactly the same packet. I'm putting together a ...
0
votes
1answer
290 views

minimal overhead of ChaCha20 + ECC

What we want? Encrypt plaintext with ChaCha20 + ECC on curve 25519 (hybrid cryptography) the result would be a data stracture X. Input: public key on Curve 25519 No authentication required (no AEAD)...
4
votes
3answers
1k views

ChaCha20-Poly1305 test vectors

I was trying to use OpenSSL 1.1 (via Ruby) to validate the ChaCha20-Poly1305 test vector from this IETF draft: https://tools.ietf.org/html/draft-agl-tls-chacha20poly1305-04#section-7 The relevant ...
4
votes
1answer
350 views

Where is HChaCha20 formally defined?

I stumbled upon the Q&A “Advantages of HS1-SIV over ChaCha20-Poly1305-SIV?” which mentions “HChaCha20” in the question. Trying to look it up via the usual research sources, I failed to find an ...
4
votes
1answer
282 views

Negating the risk of a random 64-bit nonce

Given a stream cipher such as Chacha20, which uses a 64-bit nonce, it would be unsafe to use a random nonce because of the risk of accidental repetition (which if used twice with the same key would be ...
8
votes
1answer
3k views

Is ChaCha20 safer than AES with respect to side-channel attacks?

I've already seen some topics on this matter, but I feel like my question hasn't really been answered. Given the following: AES must be implemented in hardware (i.e. using the AES-NI instruction set)...
1
vote
1answer
267 views

Would using two keys for Salsa20 or ChaCha increase security?

Would using the keys (as in two passes with a key each) increase security for Salsa20 or ChaCha stream ciphers increase security?
2
votes
2answers
280 views

Possible to decrypt every fragment of an ecrypted file on its own?

I have a project where I want to encrypt a file and split it up into several fragments and place these files on different systems. I want to do it on mobile phones as well, so I chose poly-chacha20 as ...
3
votes
1answer
186 views

Determining strength of a crypto algorithm - clarification with the salsa paper

I am reading through the salsa family paper and on the second page DJB says this -- One can reasonably conjecture, for example, that every function that encrypts data in 0.5 Core-2 cycles/byte is ...
3
votes
1answer
308 views

Using ChaCha20 on very short messages with high packet loss

I'm building a low power wireless network and need to transmit very small packets at regular intervals (10 bytes every minute or so). In order to secure the communications I'm considering using ...
6
votes
1answer
212 views

Can NORX32-f be used in a Salsa20 style stream cipher?

#include <std_roll_your_own_crypto_warning.h> With the third round CAESAR candidates about to be announced, the design[0] of Salsa20/ChaCha + Poly1305 is ...
0
votes
1answer
642 views

Is a KDF needed when using X25519 for ECDH and XChaCha20-Poly1305 for AEAD?

Is a KDF needed when using X25519 for ECDH and XChaCha20-Poly1305 or XSalsa20-Poly1305 for authenticated encryption? My hypothesis is "no" because the key from X25519 is less than 256 bits long; ...
5
votes
1answer
282 views

In Fortuna, can I use ChaCha20 instead of a block cipher and Blake2b instead of iterated SHA256?

In the Fortuna CSPRNG, can I use ChaCha20 instead of a block cipher and Blake2b instead of double SHA256, and still retain security? My hypothesis is "yes" because: The block cipher's only use is in ...
4
votes
0answers
98 views

Creating an SPN cipher from ChaCha20 or Salsa20's double round function

Given that ChaCha20's building blocks have been also used to construct a hash function, can the double round function from either ChaCha20 or Salsa20 be used to construct a secure SP-network cipher? ...
10
votes
2answers
2k views

Nonce encryption with Poly1305-Chacha20

I have seen that a couple of companies (like Google, Apple HomeKit) are adding "ChaCha20-Poly1305" as an encryption option. Poly1305 requires algorithm to encrypt the nonce. The Poly1305-AES ...
4
votes
0answers
209 views

How secure is $\operatorname{AES256}_{\operatorname{ECB}}(\operatorname{ChaCha20}(\text{plaintext}))$?

Suppose I encrypt a bytestream using ChaCha20, and then encrypt the resulting ciphertext using AES in ECB mode. How secure is the combination?
1
vote
0answers
333 views

Is parallel, vectorized NORX nearly as fast as hardware-accelerated AES-GCM?

As I understand it, NORX gets 3.5 CPB in an unoptimized implementation. But NORX can be parallelized. With 4-way SIMD, I would expect about 7/8 CPB performance. This is nearly as good as AES-GCM in ...
5
votes
0answers
183 views

Can an analog of ChaCha with 64-bit words be defined, and would it be secure? [duplicate]

Blake2b has a lightning fast compression function with more-than-overkill security even against quantum attacks. It seems to be based on ChaCha, but with 64-bit words and different rotation constants....
2
votes
1answer
160 views

ChaCha20 core vs ideal unkeyed PRP

I know that the ChaCha20 core (without the initial constant) is not an ideal PRP and must not be used as such. I also know that $\text{ChaChaCore}(0) = 0$. Are there any other differences?
4
votes
2answers
430 views

Can one extend the nonce of ChaCha/Salsa20 by XORing the extra bits with the key?

Can one extend the ChaCha and Salsa20 nonces by XORing the extra nonce bits with the key? My reasoning is as follows: the Rumba compression function allows attackers to supply any 48-byte input to ...
2
votes
1answer
347 views

ARC4random – ChaCha-based LibreSSL PRG

Here is arc4random.c from the LibreSSL pseudorandom generator as used in OpenBSD. It works as follows: Take 40 "truly random" bytes from OS (PRG seed); Use the seed as key and IV to generate 1024 ...
4
votes
1answer
513 views

Advantages of HS1-SIV over ChaCha20-Poly1305-SIV?

What advantages does HS1-SIV have over ChaCha20-Poly1305-SIV? I know that both use the ChaCha stream cipher, but I am trying to understand why HS1-Hash is a better MAC. Edit: To hide the Poly1305 ...
4
votes
1answer
371 views

ChaCha20 immune to timing attacks

What are the reasons because of which ChaCha20 is immune to timing attacks ? Also why is not AES immune to timing attacks?
3
votes
1answer
1k views

Does XChaCha20 exist with similar properties to XSalsa20?

Does XChaCha20 (built from ChaCha20 just like XSalsa20 is built from Salsa20) exist and have XSalsa20's desirable properties?
2
votes
1answer
605 views

Is XSalsa20-Poly1305-SIV a reasonable choice for nonce-misuse-resistant authenticated encryption?

Consider XSalsa20-Poly1305-SIV. This is obtained by: computing a MAC $t_{secret}$ of the plaintext from the key and nonce, as in ChaCha20-Poly1305 except that the plaintext, not the ciphertext, is ...
5
votes
1answer
832 views

Is ChaCha12 considered 256-bit secure?

ChaCha20 is considered 256-bit secure (no attack faster than brute force). However, the best known cryptanalysis that I know of is on ChaCha7. That gives ChaCha20 a rather large security margin (...
0
votes
1answer
208 views

Hardware optimized stream ciphers?

As I understand it, ChaCha20 is slower than AES-CTR in hardware. Are there any hardware-optimized stream ciphers?
5
votes
1answer
2k views

What happens if a nonce is reused in ChaCha20-Poly1305?

In ChaCha20-Poly1305, I know that reusing a nonce loses confidentiality and integrity for all messages encrypted with the (key, nonce) pair. However, is security affected for those messages encrypted ...
4
votes
1answer
112 views

Symmetric encryption algorithms with large IVs and authentication?

Most modern symmetric ciphers require a nonce/IV. If the nonce is reused, security is lost. If the nonce is large enough, it can be generated securely by using a CSPRNG. This avoids needing to keep ...
6
votes
1answer
2k views

Is ChaCha20 alone sufficient for securing data-at-rest?

I wonder if ChaCha20 alone is sufficient for securing files stored on a disk or should Poly1305 should be used along with it? AFAIK, Poly1305 is used to secure the authentication channel, but for ...
2
votes
1answer
345 views

Why is there no 'ECDSA' version of 'DHE-RSA-CHACHA20-POLY1305'?

So I was just checking my TLS cipherlist and noticed that there was a 'DSS' / DSA / ECDSA version of every ...
9
votes
1answer
321 views

Why is the whole initial state used in the final addition of Salsa20 and ChaCha?

Both Salsa20 and ChaCha basically work like this: Put the key, the nonce, the sequence number and a constant into a 4x4 matrix of 32-bit words. Transform the matrix invertibly with a number of ARX ...
15
votes
2answers
5k views

Why should one prefer Salsa20 over ChaCha?

We are all aware of Google's approach to introduce ChaCha/Poly1305 as TLS cipher suite. The rationale seems clear: ChaCha is newer and seems to provide better security (and maybe speed?) gained from ...
19
votes
3answers
644 views

Collision or second preimage for the ChaCha core?

Daniel J. Bernstein's ChaCha core is an evolution of the Salsa20 core. Both are functions over the set of 512-bit bitstrings, partitioned as sixteen 32-bit words. Can we exhibit collisions, or second-...
4
votes
1answer
543 views

chacha20-poly1305 padding and length encoding

The AEAD construction for chacha20-poly1305 described in the IETF proposal encodes message lengths into the text that is to be hashed. The newer proposal goes further and pads associated data and ...
8
votes
2answers
3k views

Where are the ChaCha20 test vectors/examples?

I see in the Salsa20 specification there are test examples throughout the document to help an implementer make sure every function works as designed. Consequently the whole algorithm would work ...
6
votes
1answer
1k views

Extending key sizes in Salsa20 and ChaCha?

I've written implementations of Salsa20 and ChaCha that accept 384 and 448 bit keys. It was fairly trivial to implement, the 'sigma' constant is replaced with key material, and the counter, (which was ...
10
votes
1answer
716 views

Can I use the ChaCha core as a 256-bit to 256-bit one-way function?

I'm looking to implement Lamport signatures as a little fun project, and I need a fast one way function that maps $\{0,1\}^{256} \rightarrow \{0,1\}^{256}$. I was wondering whether I could safely use ...