The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [salsa20]

Salsa20 by Daniel J. Bernstein is a family of stream ciphers built on a pseudo-random function.

Filter by
Sorted by
Tagged with
1
vote
1answer
78 views

(Whitebox Crypto) Using ChaCha20, is it safe to reduce the nonce length in a single block cipher?

I am willing to write a Whitebox Crypto unit using ChaCha20 algorithm (Bernstein, D. 2008) for an input consisting of a single block. The fact it is going to be a single block cipher is of special ...
2
votes
1answer
119 views

Related-key attacks against Salsa20 and ChaCha

From the Salsa20 security document, DJB states that he doesn't care about related key attacks: The standard solutions to all the standard cryptographic problems—encryption, authentication, etc.—are ...
4
votes
1answer
78 views

Fundamental difference between the constant, key, nonce, and counter bits in Salsa20/ChaCha20 or AES-Encrypt?

The Salsa20 core function takes a 128-bit constant, 256-bit key, 64-bit counter, and 64-bit nonce and produces a 512-bit value. Or more generically, it is a mapping from 512-bit values to 512-bit ...
5
votes
2answers
109 views

Append data to authenticated ciphertext encrypted using a stream cipher

Say we have xSalsa20 authenticated using Poly1305. If $ X $ is the ciphertext, $N$ is the nonce value, and $H$ is the authentication tag such that the final ciphertext is $ N || X || H $, then given ...
1
vote
1answer
50 views

What's the safest way to encrypt a messenger application?

How can I safely encrypt a messenger application that sends data over the Internet via TCP? I've already taken a look at Salsa20, but I don't know if that's a good algorithm to use for this. What ...
1
vote
1answer
140 views

How resistant are stream ciphers like Salsa20 or ChaCha in a post-quantum world?

What kind of quantum computer would be required, if it is possible to break such ciphers?
1
vote
1answer
48 views

How can I get select messages ciphers for salsa20poly1305 for unit tests?

In order to avoid memory errors, I always write safe C++ wrappers with strong type-safety for any C encryption library I use. To test my wrapper of ...
0
votes
2answers
50 views

How can I follow the validation and verification recommendations of the NaCl (sodium) secretbox library?

I was advised to use crypto_secretbox_xsalsa20poly1305 due to its simplicity and because it's safe against timing attacks. I'm reading the secretbox tutorial, and ...
4
votes
1answer
398 views

Salsa20 Implementation: Sum of 2 Words with Carries Suppressed

I'm working on the 2nd part of the Salsa20 spec, and I want to implement a closure for the exclusive-or of two words(u32). The author defines the operation as the sum of two words with carries ...
1
vote
1answer
57 views

How is overflow handled in word addition steps in Salsa20?

I feel like I'm completely missing something there. The quarter-round proceeds as follows: ...
0
votes
1answer
49 views

Starting stream cypher, first block (Salsa20)

I'm implementing Salsa20 in Rust for fun. I have the initial state (4x4 32-bit matrix) setup from the key, nonce, and stream position 0. I'm using the Wikipedia Salsa20 article as reference, and I'm ...
2
votes
1answer
197 views

Salsa20 / ChaCha with 128 bit keys

According to wikipedia both Salsa20 and ChaCha support both 128 and 256-bit keys. The initial state for each has 8 words of key, where each word is 32 bits. 32*8 = 256. My question is... how is one ...
4
votes
1answer
396 views

Salsa20 as a PRNG with streams

Can I use Salsa20 as a good non-cryptographic PRNG with different streams if I reduce the number of rounds to 8 and omit the addition step at the end? I want to omit the final step because I don't ...
6
votes
3answers
138 views

Mixing x into permutation through XOR vs. modular addition

Block ciphers mix key material into the permutation through XOR. Also do pre and post whitening this way. Chacha/Salsa finishes by 32-bit modular adding key and iv material (among other bits but ...
5
votes
1answer
128 views

Latin dance family in block cipher

Is it secure to use Salsa20/ChaCha as the key schedule for a 512-bit block cipher using a public permutation in Even-Mansour construction?
5
votes
2answers
227 views

Purpose of repeating a 16-byte key for Salsa20

The core of the Salsa20 family of stream ciphers is a hash function that takes a 64-byte block, using it to generate a pseudorandom 64-byte output. The 64 bytes contain space for a 32-byte key a 16-...
3
votes
1answer
573 views

384-bit ChaCha20 / Salsa20

The standard Salsa20 core is a $\{0,1\}^{384} \to \{0,1\}^{512}$ random function with a 16 byte constant ($\sigma$ for a 32-byte key), an 8 byte nonce, an 8 byte counter, and a 32 byte key. The hash ...
5
votes
0answers
117 views

Why Salsa20 rotates columns vertically to optimize for SIMD?

I'm writing a school assignment and I'm trying to fully grasp the differences between Salsa20 and ChaCha. I've come to understand that by rotating upwards the initial matrix columns, DJB says that ...
6
votes
1answer
134 views

Replacing a block cipher's key schedule with a stream cipher

Take Rijndael (AES) of block size 128 and reformulate it with a tweakable number of rounds and no key schedule. Suppose we obtain: Rijndael128(r, k) where r is ...
3
votes
1answer
143 views

Why does Salsa20 algorithm require incrementing word[8] and word[9] after producing cipher text message

I'm trying to get understanding of Salsa20 algorithm. There is an official specification from Daniel J. Bernstein at link. Everything in spec is clear and I could write an implementation on Swift. ...
0
votes
1answer
245 views

Does Salsa20 protect integrity?

I was reading about the differences between block ciphers and stream ciphers. One thing that hit me was that stream ciphers like RC4 tend to be susceptible to bit-flipping attacks, in which flipping a ...
2
votes
1answer
117 views

Output size of Salsa20

Salsa12 is in eStream portfolio. How many random bits one can generate in Salsa12 using single key? Is it $512\times 2^{128}$?
2
votes
3answers
1k views

Using a PRNG for a stream cipher instead of a dedicated algorithm

I am aware, that it is possible to build a stream cipher using some deterministic PRNG (like HASH_DRBG or CTR_DRBG) with good key material as the seed. What are the advantages of using a purpose ...
1
vote
1answer
262 views

Would using two keys for Salsa20 or ChaCha increase security?

Would using the keys (as in two passes with a key each) increase security for Salsa20 or ChaCha stream ciphers increase security?
14
votes
2answers
1k views

Interesting implementation practices in popular crypto library

So reading through the salsa20 implementation for the crypto library for go-lang, I noticed something interesting. Specifically this portion. It looks like something I would expect from someone ...
3
votes
1answer
289 views

Parameters for comparison of Salsa, HC-128 and SOSEMANUK

I am doing my final project of computer science and I need some help. I understand how Salsa works, but I don't have the same knowledge of HC-128 and SOSEMANUK. I have to do a table with the ...
1
vote
1answer
285 views

Reuse nonce with Salsa20 stream cipher with counter

It is often said to never use a nonce for more than one message when using a stream cipher. It seems this is to prevent something like this: Taking advantage of one-time pad key reuse? Yet what if I ...
5
votes
1answer
238 views

Can you help me understand Bernstein’s Notes on Diagonal constant of Salsa20?

Explaining the choice of the Salsa20 constant Bernstein explains: [...] shifting the entire Salsa20 hash-function input array along the diagonal has exactly the same effect on the output. The ...
6
votes
2answers
521 views

Is there an upper limit to plaintext size in XSalsa20Poly1305?

While fiddling with the NaCl implementation in Go, specifically SecretBox, a general crypto question came up after reading the documentation. Quote: Package secretbox encrypts and authenticates ...
9
votes
1answer
755 views

The Salsa20 core preserves diagonal shifts?

What do we mean by the Salsa core preserves diagonal shifts
6
votes
2answers
4k views

How secure is Salsa20?

I have been hearing about Salsa20 from quite some time. It is even the favorite cipher in the ransomware world. Some ransomware used this cipher, probably because of speed. I want to know how secure ...
3
votes
1answer
183 views

Determining strength of a crypto algorithm - clarification with the salsa paper

I am reading through the salsa family paper and on the second page DJB says this -- One can reasonably conjecture, for example, that every function that encrypts data in 0.5 Core-2 cycles/byte is ...
1
vote
1answer
300 views

Bouncycastle and Salsa rounds

Salsa by Daniel J. Bernstein was meant to run with 20 rounds. As i can configure the rounds in Bouncycastle with Salsa20Engine, do i have better security by increasing the rounds to 1000? The ...
6
votes
1answer
206 views

Can NORX32-f be used in a Salsa20 style stream cipher?

#include <std_roll_your_own_crypto_warning.h> With the third round CAESAR candidates about to be announced, the design[0] of Salsa20/ChaCha + Poly1305 is ...
0
votes
1answer
589 views

Is a KDF needed when using X25519 for ECDH and XChaCha20-Poly1305 for AEAD?

Is a KDF needed when using X25519 for ECDH and XChaCha20-Poly1305 or XSalsa20-Poly1305 for authenticated encryption? My hypothesis is "no" because the key from X25519 is less than 256 bits long; ...
1
vote
1answer
107 views

What kind of analysis can I perform on my implementation of Salsa20 and Rabbit ciphers?

I've implemented both the Salsa20 and Rabbit ciphers in C#. My implementation is for academic purposes and I've tested both of them against the test vectors. I implemented a system that encrypts a ...
4
votes
0answers
97 views

Creating an SPN cipher from ChaCha20 or Salsa20's double round function

Given that ChaCha20's building blocks have been also used to construct a hash function, can the double round function from either ChaCha20 or Salsa20 be used to construct a secure SP-network cipher? ...
4
votes
2answers
413 views

Can one extend the nonce of ChaCha/Salsa20 by XORing the extra bits with the key?

Can one extend the ChaCha and Salsa20 nonces by XORing the extra nonce bits with the key? My reasoning is as follows: the Rumba compression function allows attackers to supply any 48-byte input to ...
2
votes
1answer
512 views

Is XSalsa20-Poly1305-SIV a reasonable choice for nonce-misuse-resistant authenticated encryption?

Consider XSalsa20-Poly1305-SIV. This is obtained by: computing a MAC $t_{secret}$ of the plaintext from the key and nonce, as in ChaCha20-Poly1305 except that the plaintext, not the ciphertext, is ...
5
votes
1answer
782 views

Is ChaCha12 considered 256-bit secure?

ChaCha20 is considered 256-bit secure (no attack faster than brute force). However, the best known cryptanalysis that I know of is on ChaCha7. That gives ChaCha20 a rather large security margin (...
6
votes
3answers
3k views

Can elliptic curve (25519) be used to encrypt file?

This is probably a simple question, but I haven't been able to see it stated anywhere. Is it possible to directly encrypt a file (of any length) with some form of EC using the 25519 curve. I know it'...
1
vote
0answers
81 views

IV re-use for Salsa20 [duplicate]

Are their any specific requirements for the IV when using Salsa20? Is it for example allowed to re-use the same IV when encrypting with the same session key? Should the IV be random? etc I tried to ...
9
votes
1answer
304 views

Why is the whole initial state used in the final addition of Salsa20 and ChaCha?

Both Salsa20 and ChaCha basically work like this: Put the key, the nonce, the sequence number and a constant into a 4x4 matrix of 32-bit words. Transform the matrix invertibly with a number of ARX ...
15
votes
2answers
5k views

Why should one prefer Salsa20 over ChaCha?

We are all aware of Google's approach to introduce ChaCha/Poly1305 as TLS cipher suite. The rationale seems clear: ChaCha is newer and seems to provide better security (and maybe speed?) gained from ...
18
votes
3answers
604 views

Collision or second preimage for the ChaCha core?

Daniel J. Bernstein's ChaCha core is an evolution of the Salsa20 core. Both are functions over the set of 512-bit bitstrings, partitioned as sixteen 32-bit words. Can we exhibit collisions, or second-...
1
vote
3answers
554 views

Is the Salsa20/ChaCha20 keystream generation one-way?

Is it possible to recompute the Salsa20 or ChaCha20 key in a realistic time if the keystream and the nonce are given to an attacker? Or is the keystream generation one-way, like a cryptographic hash ...
1
vote
3answers
264 views

Is the Salsa20-GCM composition secure?

AES-GCM seems to be used by everyone, but I have never seen even one post about Salsa20-GCM. Is it secure? Wikipedia mentions ...
8
votes
2answers
2k views

Where are the ChaCha20 test vectors/examples?

I see in the Salsa20 specification there are test examples throughout the document to help an implementer make sure every function works as designed. Consequently the whole algorithm would work ...
2
votes
1answer
774 views

How to implement the Salsa20 hash function?

I am currently implementing Salsa20 from the specification as an exercise in learning and self-flagellation. I have Sections 1-7 passing the test examples provided. I am now stuck on Section 8, The ...
4
votes
2answers
4k views

Encryption for a short packet size

I have an 8051 microcontroller with a radio that can send packets with up to 32 bytes and I want to have the messages encrypted. It is a sensor network so I really only want to send one packet per ...