Questions tagged [salsa20]

Salsa20 by Daniel J. Bernstein is a family of stream ciphers built on a pseudo-random function.

Filter by
Sorted by
Tagged with
2 votes
1 answer
109 views

Recommended output filter for Rumba20 [closed]

Rumba20 is a compression function that maps a 192-byte (1536-bit) string to a 64-byte (512-bit) string. It's designed to provide collision resistance by using Salsa20 (or ChaCha20) with the ...
samuel-lucas6's user avatar
2 votes
1 answer
145 views

Salsa20 offers speeds of around 4–14 cycles per byte, but is it parallelized?

On Wikipedia: https://en.wikipedia.org/wiki/Salsa20#cite_note-5 they wrote Salsa20 offers speeds of around 4–14 cycles per byte in software on modern x86 processors. But is it implemented that way, it ...
Tom's user avatar
  • 1,211
0 votes
1 answer
114 views

Various attacks on cipher-images & tools, especially stream-cipher?

What kind of attack of image encryption that exist out there, especially if the cipherimage was created using secure stream-cipher like Salsa20 (256 key) or ChaCha20 (256 key)? From https://cr.yp.to/...
akez's user avatar
  • 87
2 votes
2 answers
977 views

What are the performance reasons behind "xor-a-rotated-sum" instead of "add-a-rotated-xor" in Salsa20?

I'm currently reading the specification of Salsa20 (link). DJB on whether he chooses "xor-a-rotated-sum" instead of "add-a-rotated-xor" states the following : Should there be ...
tur11ng's user avatar
  • 878
2 votes
1 answer
181 views

Salsa20 encryption process

I am studying the Salsa20 algorithm and I was wondering if you could help me understanding the expansion function. I don´t understand what the Pos or stream position as I have read in other places ...
Pedro's user avatar
  • 21
0 votes
1 answer
146 views

Can the security of Salsa20/Chacha20 be expanded to 448-bits if I fill the nonce and the Nothing-up-my-sleeve numbers with key material?

As I studied, Salsa20/Chacha20 is basically a hash function that accepts a 64-byte input and returns a output of the same size of input. 128-bits of the input are filled with four "Nothing-up-my-...
phantomcraft's user avatar
0 votes
1 answer
82 views

How to test Salsa20/8 Core RFC 7914 implementation with the test vectors?

I wanted to test the implementation of the Salsa20/8 Core function provided in the RFC 7914, with the test vectors provided, and I do not get the expected output from provided input. I guess that I am ...
Patrice's user avatar
  • 11
0 votes
1 answer
111 views

Understanding non-linearity in Salsa20 over various rings

In his design of Salsa20, Bernstein writes to ensure non-linearity he chose 32-bit addition (breaking linearity over $Z/2$), 32-bit xor (breaking linearity over $Z/2^32), and constant-distance 32-bit ...
SRobertJames's user avatar
1 vote
1 answer
367 views

Does Salsa20/ChaCha20 still provide Integrity when Encrypt Bitmap?

Forgive me for this question. I have an idea to encrypt *.bmp bitmap files using ChaCha20/Salsa20 without Poly1305. This is just a simple program, where I can encrypt *.bmp bitmap images, with the ...
akez's user avatar
  • 87
2 votes
3 answers
426 views

Benchmark for CSPRNG as stream ciphers?

My limitation in my security protocol is that I want my RNG as CSPRNG and I also want it to be super fast. If I use Salsa20 or ChaCha or AES counter mode, I don't get the desired speed. I want my PRNG ...
Masab Iqbal's user avatar
1 vote
0 answers
80 views

Serious Cryptography by Jean-Philippe Aumasson - Chapter 5 Stream Ciphers - Attacking Salsa20/8 - Page 100 Last Paragraph

I'm currently reading "Serious Cryptography - A Practical Introduction to Modern Encryption" written by "Jean-Philippe Aumasson" published by NoStarch in 2018. In "Chapter 5 ...
Anthony Monday's user avatar
1 vote
1 answer
192 views

Salsa20 expands a 256-bit key and a 64-bit nonce into a 2^70 byte stream - where did the 2^70 come from?

From Section 3.1 in DJB's document on The Salsa20 family of stream ciphers- https://cr.yp.to/snuffle/salsafamily-20071225.pdf Salsa20 expands a 256-bit key and a 64-bit nonce (unique message number) ...
user93353's user avatar
  • 2,169
0 votes
0 answers
35 views

Strange for loop in salsa20_word_specification function

This is wrt to implementation of the salsa20_word_specification function at https://cr.yp.to/salsa20.html The 2nd for loop goes like this ...
user93353's user avatar
  • 2,169
3 votes
0 answers
179 views

Does varying ChaCha rounds add any security?

This paper introduces 'Freestyle' a randomized, and variable round version of the ChaCha cipher. It uses the concept of hash based halting condition, where a decryption attempt with an incorrect key ...
Modal Nest's user avatar
  • 1,443
1 vote
1 answer
413 views

Is it possible to acquire the next keystream of Salsa20? (If you know part of the keystream)

When you know the Salsa20's keystream, how do you know the next keystream? In other words, can I infer the next keystream when I don't know the Key and IV of Salsa20, but the keystream is ...
YGK's user avatar
  • 13
1 vote
1 answer
424 views

ECRYPT Salsa20 Test Vectors Interpretation

I am currently implementing Salsa20 for my bachelor thesis. After having verified all the functions needed for the final encryption function with the given test data in the specification from DJB, I ...
ekzyis's user avatar
  • 43
0 votes
0 answers
210 views

salsa20 (Key, Nonce) repeatable?

in Salsa20, the Key is 128 or 256 bits, the Nonce is 64 bits. the pair (k,r) should never be reused. Does it means, if the key is fixed, the encryption can only run 2^64 times? if the key is not fixed,...
dbloldb's user avatar
2 votes
4 answers
2k views

Is Salsa20+Poly1305 an AEAD?

I see Chacha20Poly1305, XsalsaPoly1305 and AES GCM usually used and mentioned in literature and implementations as AEAD cyphers. My question is that Poly1305 provides authentication and Salsa20 ...
drequinox's user avatar
  • 123
2 votes
1 answer
4k views

Is XChacha20 - Poly1305 Quantum resistant?

This is a question just out of curiosity, as I am a newbie to Post Quantum Cryptography. I have read several articles where they emphasize that current standardised symmetric encryption algorithms (...
Aravind A's user avatar
  • 1,000
17 votes
2 answers
3k views

Where did ChaCha20 and Salsa20 stream ciphers get their names from?

This is not a question targeted at a specific crypto implementation, but a question out of curiosity. What's the reason for calling the stream ciphers ChaCha/Salsa? I couldn't find any information ...
Aravind A's user avatar
  • 1,000
0 votes
1 answer
292 views

is this implementation real salsa20?

https://raw.githubusercontent.com/andres-erbsen/salsa20/master/salsa20.c I tried it, and it's working fine. Now question: is it real salsa20?
dr.computer's user avatar
1 vote
1 answer
217 views

Is it OK to just hash a symmetric key to derive an authentication key?

I'm using xsalsa20poly1305 for encryption in my program from libsodium. The recommended size for chunks is 4 kB. In that case, poly1305 will have authentication only for the the individual 4k chunks. ...
The Quantum Physicist's user avatar
1 vote
1 answer
870 views

XChacha20poly1305 vulnerability to known plaintext attacks

During a security audit, the guy said our cryptosystem is vulnerable to known-plaintext attacks. He said that's because «the implementation uses a crypto_stream_xor() approach» (from libsodium). That'...
Chacha123's user avatar
1 vote
1 answer
293 views

(Whitebox Crypto) Using ChaCha20, is it safe to reduce the nonce length in a single block cipher?

I am willing to write a Whitebox Crypto unit using ChaCha20 algorithm (Bernstein, D. 2008) for an input consisting of a single block. The fact it is going to be a single block cipher is of special ...
Guilherme Balena Versiani's user avatar
2 votes
1 answer
452 views

Related-key attacks against Salsa20 and ChaCha

From the Salsa20 security document, DJB states that he doesn't care about related key attacks: The standard solutions to all the standard cryptographic problems—encryption, authentication, etc.—are ...
forest's user avatar
  • 15.1k
5 votes
1 answer
495 views

Fundamental difference between the constant, key, nonce, and counter bits in Salsa20/ChaCha20 or AES-Encrypt?

The Salsa20 core function takes a 128-bit constant, 256-bit key, 64-bit counter, and 64-bit nonce and produces a 512-bit value. Or more generically, it is a mapping from 512-bit values to 512-bit ...
Kannan Goundan's user avatar
5 votes
2 answers
461 views

Append data to authenticated ciphertext encrypted using a stream cipher

Say we have xSalsa20 authenticated using Poly1305. If $ X $ is the ciphertext, $N$ is the nonce value, and $H$ is the authentication tag such that the final ciphertext is $ N || X || H $, then given ...
Awn's user avatar
  • 1,532
1 vote
1 answer
110 views

What's the safest way to encrypt a messenger application?

How can I safely encrypt a messenger application that sends data over the Internet via TCP? I've already taken a look at Salsa20, but I don't know if that's a good algorithm to use for this. What ...
thebear8's user avatar
  • 123
3 votes
1 answer
2k views

How resistant are stream ciphers like Salsa20 or ChaCha in a post-quantum world?

What kind of quantum computer would be required, if it is possible to break such ciphers?
Bobisnotyouruncle's user avatar
1 vote
1 answer
72 views

How can I get select messages ciphers for salsa20poly1305 for unit tests?

In order to avoid memory errors, I always write safe C++ wrappers with strong type-safety for any C encryption library I use. To test my wrapper of ...
The Quantum Physicist's user avatar
1 vote
2 answers
216 views

How can I follow the validation and verification recommendations of the NaCl (sodium) secretbox library?

I was advised to use crypto_secretbox_xsalsa20poly1305 due to its simplicity and because it's safe against timing attacks. I'm reading the secretbox tutorial, and ...
The Quantum Physicist's user avatar
5 votes
0 answers
109 views

Effect of block size on diffusion rate

I've always been under the belief that larger block sizes require more rounds to achieve full diffusion. Rijndael, SPECK, and SIMON, for example, have a round multiplier based on the block size. The ...
forest's user avatar
  • 15.1k
4 votes
1 answer
465 views

Salsa20 Implementation: Sum of 2 Words with Carries Suppressed

I'm working on the 2nd part of the Salsa20 spec, and I want to implement a closure for the exclusive-or of two words(u32). The author defines the operation as the sum of two words with carries ...
whole_lotta_coins's user avatar
1 vote
1 answer
90 views

How is overflow handled in word addition steps in Salsa20?

I feel like I'm completely missing something there. The quarter-round proceeds as follows: ...
Bastien's user avatar
  • 511
0 votes
1 answer
148 views

Starting stream cypher, first block (Salsa20)

I'm implementing Salsa20 in Rust for fun. I have the initial state (4x4 32-bit matrix) setup from the key, nonce, and stream position 0. I'm using the Wikipedia Salsa20 article as reference, and I'm ...
Lev's user avatar
  • 103
2 votes
2 answers
1k views

Salsa20 / ChaCha with 128 bit keys

According to wikipedia both Salsa20 and ChaCha support both 128 and 256-bit keys. The initial state for each has 8 words of key, where each word is 32 bits. 32*8 = 256. My question is... how is one ...
neubert's user avatar
  • 2,895
4 votes
1 answer
728 views

Salsa20 as a PRNG with streams

Can I use Salsa20 as a good non-cryptographic PRNG with different streams if I reduce the number of rounds to 8 and omit the addition step at the end? I want to omit the final step because I don't ...
Thorham's user avatar
  • 223
6 votes
3 answers
447 views

Mixing x into permutation through XOR vs. modular addition

Block ciphers mix key material into the permutation through XOR. Also do pre and post whitening this way. Chacha/Salsa finishes by 32-bit modular adding key and iv material (among other bits but ...
user avatar
5 votes
1 answer
225 views

Latin dance family in block cipher

Is it secure to use Salsa20/ChaCha as the key schedule for a 512-bit block cipher using a public permutation in Even-Mansour construction?
comepradz's user avatar
5 votes
2 answers
776 views

Purpose of repeating a 16-byte key for Salsa20

The core of the Salsa20 family of stream ciphers is a hash function that takes a 64-byte block, using it to generate a pseudorandom 64-byte output. The 64 bytes contain space for a 32-byte key a 16-...
forest's user avatar
  • 15.1k
3 votes
1 answer
1k views

384-bit ChaCha20 / Salsa20

The standard Salsa20 core is a $\{0,1\}^{384} \to \{0,1\}^{512}$ random function with a 16 byte constant ($\sigma$ for a 32-byte key), an 8 byte nonce, an 8 byte counter, and a 32 byte key. The hash ...
forest's user avatar
  • 15.1k
5 votes
0 answers
205 views

Why Salsa20 rotates columns vertically to optimize for SIMD?

I'm writing a school assignment and I'm trying to fully grasp the differences between Salsa20 and ChaCha. I've come to understand that by rotating upwards the initial matrix columns, DJB says that ...
Fabrizio Mele's user avatar
6 votes
1 answer
201 views

Replacing a block cipher's key schedule with a stream cipher

Take Rijndael (AES) of block size 128 and reformulate it with a tweakable number of rounds and no key schedule. Suppose we obtain: Rijndael128(r, k) where r is ...
user avatar
4 votes
1 answer
251 views

Why does Salsa20 algorithm require incrementing word[8] and word[9] after producing cipher text message

I'm trying to get understanding of Salsa20 algorithm. There is an official specification from Daniel J. Bernstein at link. Everything in spec is clear and I could write an implementation on Swift. ...
Ihar Katkavets's user avatar
0 votes
1 answer
369 views

Does Salsa20 protect integrity?

I was reading about the differences between block ciphers and stream ciphers. One thing that hit me was that stream ciphers like RC4 tend to be susceptible to bit-flipping attacks, in which flipping a ...
id01's user avatar
  • 141
2 votes
1 answer
184 views

Output size of Salsa20

Salsa12 is in eStream portfolio. How many random bits one can generate in Salsa12 using single key? Is it $512\times 2^{128}$?
user5020's user avatar
2 votes
3 answers
2k views

Using a PRNG for a stream cipher instead of a dedicated algorithm

I am aware, that it is possible to build a stream cipher using some deterministic PRNG (like HASH_DRBG or CTR_DRBG) with good key material as the seed. What are the advantages of using a purpose ...
mat's user avatar
  • 2,508
1 vote
1 answer
304 views

Would using two keys for Salsa20 or ChaCha increase security?

Would using the keys (as in two passes with a key each) increase security for Salsa20 or ChaCha stream ciphers increase security?
Hbaughet's user avatar
14 votes
2 answers
1k views

Interesting implementation practices in popular crypto library

So reading through the salsa20 implementation for the crypto library for go-lang, I noticed something interesting. Specifically this portion. It looks like something I would expect from someone ...
abrahimladha's user avatar
3 votes
1 answer
402 views

Parameters for comparison of Salsa, HC-128 and SOSEMANUK

I am doing my final project of computer science and I need some help. I understand how Salsa works, but I don't have the same knowledge of HC-128 and SOSEMANUK. I have to do a table with the ...
Robert NN's user avatar
  • 115