Questions tagged [salsa20]
Salsa20 by Daniel J. Bernstein is a family of stream ciphers built on a pseudo-random function.
87
questions
2
votes
1
answer
137
views
Salsa20 offers speeds of around 4–14 cycles per byte, but is it parallelized?
On Wikipedia:
https://en.wikipedia.org/wiki/Salsa20#cite_note-5
they wrote Salsa20 offers speeds of around 4–14 cycles per byte in software on modern x86 processors. But is it implemented that way, it ...
- 1,181
0
votes
1
answer
91
views
Various attacks on cipher-images & tools, especially stream-cipher?
What kind of attack of image encryption that exist out there, especially if the cipherimage was created using secure stream-cipher like Salsa20 (256 key) or ChaCha20 (256 key)?
From https://cr.yp.to/...
- 77
2
votes
2
answers
918
views
What are the performance reasons behind "xor-a-rotated-sum" instead of "add-a-rotated-xor" in Salsa20?
I'm currently reading the specification of Salsa20 (link). DJB on whether he chooses
"xor-a-rotated-sum" instead of "add-a-rotated-xor" states the following :
Should there be ...
- 826
2
votes
1
answer
152
views
Salsa20 encryption process
I am studying the Salsa20 algorithm and I was wondering if you could help me understanding the expansion function. I don´t understand what the Pos or stream position as I have read in other places ...
- 21
0
votes
1
answer
123
views
Can the security of Salsa20/Chacha20 be expanded to 448-bits if I fill the nonce and the Nothing-up-my-sleeve numbers with key material?
As I studied, Salsa20/Chacha20 is basically a hash function that accepts a 64-byte input and returns a output of the same size of input.
128-bits of the input are filled with four "Nothing-up-my-...
- 867
0
votes
1
answer
64
views
How to test Salsa20/8 Core RFC 7914 implementation with the test vectors?
I wanted to test the implementation of the Salsa20/8 Core function provided in the RFC 7914, with the test vectors provided, and I do not get the expected output from provided input. I guess that I am ...
- 11
0
votes
1
answer
100
views
Understanding non-linearity in Salsa20 over various rings
In his design of Salsa20, Bernstein writes to ensure non-linearity he chose
32-bit addition (breaking linearity over $Z/2$),
32-bit xor (breaking linearity over $Z/2^32), and constant-distance 32-bit ...
- 135
1
vote
1
answer
327
views
Does Salsa20/ChaCha20 still provide Integrity when Encrypt Bitmap?
Forgive me for this question. I have an idea to encrypt *.bmp bitmap files using ChaCha20/Salsa20 without Poly1305.
This is just a simple program, where I can encrypt *.bmp bitmap images, with the ...
- 77
2
votes
3
answers
390
views
Benchmark for CSPRNG as stream ciphers?
My limitation in my security protocol is that I want my RNG as CSPRNG and I also want it to be super fast.
If I use Salsa20 or ChaCha or AES counter mode, I don't get the desired speed. I want my PRNG ...
- 39
1
vote
0
answers
78
views
Serious Cryptography by Jean-Philippe Aumasson - Chapter 5 Stream Ciphers - Attacking Salsa20/8 - Page 100 Last Paragraph
I'm currently reading "Serious Cryptography - A Practical Introduction to Modern Encryption" written by "Jean-Philippe Aumasson" published by NoStarch in 2018.
In "Chapter 5 ...
1
vote
1
answer
174
views
Salsa20 expands a 256-bit key and a 64-bit nonce into a 2^70 byte stream - where did the 2^70 come from?
From Section 3.1 in DJB's document on The Salsa20 family of stream ciphers- https://cr.yp.to/snuffle/salsafamily-20071225.pdf
Salsa20 expands a 256-bit key and a 64-bit nonce (unique message number) ...
- 2,290
0
votes
0
answers
34
views
Strange for loop in salsa20_word_specification function
This is wrt to implementation of the salsa20_word_specification function at https://cr.yp.to/salsa20.html
The 2nd for loop goes like this
...
- 2,290
3
votes
0
answers
156
views
Does varying ChaCha rounds add any security?
This paper introduces 'Freestyle' a randomized, and variable round version of the ChaCha cipher. It uses the concept of hash based halting condition, where a decryption attempt with an incorrect key ...
- 1,443
1
vote
1
answer
380
views
Is it possible to acquire the next keystream of Salsa20? (If you know part of the keystream)
When you know the Salsa20's keystream, how do you know the next keystream?
In other words, can I infer the next keystream when I don't know the Key and IV of Salsa20, but the keystream is ...
- 13
1
vote
1
answer
371
views
ECRYPT Salsa20 Test Vectors Interpretation
I am currently implementing Salsa20 for my bachelor thesis. After having verified all the functions needed for the final encryption function with the given test data in the specification from DJB, I ...
- 43
0
votes
0
answers
175
views
salsa20 (Key, Nonce) repeatable?
in Salsa20, the Key is 128 or 256 bits, the Nonce is 64 bits. the pair (k,r) should never be reused. Does it means, if the key is fixed, the encryption can only run 2^64 times? if the key is not fixed,...
- 1
2
votes
4
answers
1k
views
Is Salsa20+Poly1305 an AEAD?
I see Chacha20Poly1305, XsalsaPoly1305 and AES GCM usually used and mentioned in literature and implementations as AEAD cyphers. My question is that Poly1305 provides authentication and Salsa20 ...
- 123
2
votes
1
answer
3k
views
Is XChacha20 - Poly1305 Quantum resistant?
This is a question just out of curiosity, as I am a newbie to Post Quantum Cryptography. I have read several articles where they emphasize that current standardised symmetric encryption algorithms (...
- 978
17
votes
2
answers
3k
views
Where did ChaCha20 and Salsa20 stream ciphers get their names from?
This is not a question targeted at a specific crypto implementation, but a question out of curiosity. What's the reason for calling the stream ciphers ChaCha/Salsa?
I couldn't find any information ...
- 978
0
votes
1
answer
206
views
is this implementation real salsa20?
https://raw.githubusercontent.com/andres-erbsen/salsa20/master/salsa20.c
I tried it, and it's working fine. Now question: is it real salsa20?
- 63
1
vote
1
answer
210
views
Is it OK to just hash a symmetric key to derive an authentication key?
I'm using xsalsa20poly1305 for encryption in my program from libsodium. The recommended size for chunks is 4 kB. In that case, poly1305 will have authentication only for the the individual 4k chunks. ...
1
vote
1
answer
703
views
XChacha20poly1305 vulnerability to known plaintext attacks
During a security audit, the guy said our cryptosystem is vulnerable to known-plaintext attacks. He said that's because «the implementation uses a crypto_stream_xor() approach» (from libsodium). That'...
- 11
1
vote
1
answer
276
views
(Whitebox Crypto) Using ChaCha20, is it safe to reduce the nonce length in a single block cipher?
I am willing to write a Whitebox Crypto unit using ChaCha20 algorithm (Bernstein, D. 2008) for an input consisting of a single block. The fact it is going to be a single block cipher is of special ...
2
votes
1
answer
402
views
Related-key attacks against Salsa20 and ChaCha
From the Salsa20 security document, DJB states that he doesn't care about related key attacks:
The standard solutions to all the standard cryptographic problems—encryption, authentication, etc.—are ...
- 14.9k
5
votes
1
answer
458
views
Fundamental difference between the constant, key, nonce, and counter bits in Salsa20/ChaCha20 or AES-Encrypt?
The Salsa20 core function takes a 128-bit constant, 256-bit key, 64-bit counter, and 64-bit nonce and produces a 512-bit value. Or more generically, it is a mapping from 512-bit values to 512-bit ...
- 331
5
votes
2
answers
384
views
Append data to authenticated ciphertext encrypted using a stream cipher
Say we have xSalsa20 authenticated using Poly1305. If $ X $ is the ciphertext, $N$ is the nonce value, and $H$ is the authentication tag such that the final ciphertext is $ N || X || H $, then given ...
- 1,512
1
vote
1
answer
107
views
What's the safest way to encrypt a messenger application?
How can I safely encrypt a messenger application that sends data over the Internet via TCP?
I've already taken a look at Salsa20, but I don't know if that's a good algorithm to use for this.
What ...
- 23
2
votes
1
answer
1k
views
How resistant are stream ciphers like Salsa20 or ChaCha in a post-quantum world?
What kind of quantum computer would be required, if it is possible to break such ciphers?
1
vote
1
answer
71
views
How can I get select messages ciphers for salsa20poly1305 for unit tests?
In order to avoid memory errors, I always write safe C++ wrappers with strong type-safety for any C encryption library I use.
To test my wrapper of ...
1
vote
2
answers
209
views
How can I follow the validation and verification recommendations of the NaCl (sodium) secretbox library?
I was advised to use crypto_secretbox_xsalsa20poly1305 due to its simplicity and because it's safe against timing attacks. I'm reading the secretbox tutorial, and ...
5
votes
0
answers
104
views
Effect of block size on diffusion rate
I've always been under the belief that larger block sizes require more rounds to achieve full diffusion. Rijndael, SPECK, and SIMON, for example, have a round multiplier based on the block size. The ...
- 14.9k
4
votes
1
answer
462
views
Salsa20 Implementation: Sum of 2 Words with Carries Suppressed
I'm working on the 2nd part of the Salsa20 spec, and I want to implement a closure for the exclusive-or of two words(u32). The author defines the operation as the sum of two words with carries ...
1
vote
1
answer
86
views
How is overflow handled in word addition steps in Salsa20?
I feel like I'm completely missing something there. The quarter-round proceeds as follows:
...
- 511
0
votes
1
answer
136
views
Starting stream cypher, first block (Salsa20)
I'm implementing Salsa20 in Rust for fun.
I have the initial state (4x4 32-bit matrix) setup from the key, nonce, and stream position 0. I'm using the Wikipedia Salsa20 article as reference, and I'm ...
- 103
2
votes
2
answers
1k
views
Salsa20 / ChaCha with 128 bit keys
According to wikipedia both Salsa20 and ChaCha support both 128 and 256-bit keys.
The initial state for each has 8 words of key, where each word is 32 bits. 32*8 = 256. My question is... how is one ...
- 2,855
4
votes
1
answer
680
views
Salsa20 as a PRNG with streams
Can I use Salsa20 as a good non-cryptographic PRNG with different streams if I reduce the number of rounds to 8 and omit the addition step at the end? I want to omit the final step because I don't ...
- 223
6
votes
3
answers
417
views
Mixing x into permutation through XOR vs. modular addition
Block ciphers mix key material into the permutation through XOR. Also do pre and post whitening this way.
Chacha/Salsa finishes by 32-bit modular adding key and iv material (among other bits but ...
user63513
5
votes
1
answer
212
views
Latin dance family in block cipher
Is it secure to use Salsa20/ChaCha as the key schedule for a 512-bit block cipher using a public permutation in Even-Mansour construction?
- 77
5
votes
2
answers
690
views
Purpose of repeating a 16-byte key for Salsa20
The core of the Salsa20 family of stream ciphers is a hash function that takes a 64-byte block, using it to generate a pseudorandom 64-byte output. The 64 bytes contain space for
a 32-byte key
a 16-...
- 14.9k
3
votes
1
answer
1k
views
384-bit ChaCha20 / Salsa20
The standard Salsa20 core is a $\{0,1\}^{384} \to \{0,1\}^{512}$ random function with a 16 byte constant ($\sigma$ for a 32-byte key), an 8 byte nonce, an 8 byte counter, and a 32 byte key. The hash ...
- 14.9k
5
votes
0
answers
179
views
Why Salsa20 rotates columns vertically to optimize for SIMD?
I'm writing a school assignment and I'm trying to fully grasp the differences between Salsa20 and ChaCha.
I've come to understand that by rotating upwards the initial matrix columns, DJB says that ...
- 181
6
votes
1
answer
199
views
Replacing a block cipher's key schedule with a stream cipher
Take Rijndael (AES) of block size 128 and reformulate it with a tweakable number of rounds and no key schedule.
Suppose we obtain:
Rijndael128(r, k)
where r is ...
user10653
4
votes
1
answer
243
views
Why does Salsa20 algorithm require incrementing word[8] and word[9] after producing cipher text message
I'm trying to get understanding of Salsa20 algorithm. There is an official specification from Daniel J. Bernstein at link. Everything in spec is clear and I could write an implementation on Swift.
...
- 143
0
votes
1
answer
361
views
Does Salsa20 protect integrity?
I was reading about the differences between block ciphers and stream ciphers. One thing that hit me was that stream ciphers like RC4 tend to be susceptible to bit-flipping attacks, in which flipping a ...
- 141
2
votes
1
answer
177
views
Output size of Salsa20
Salsa12 is in eStream portfolio. How many random bits one can generate in Salsa12 using single key? Is it $512\times 2^{128}$?
- 23
2
votes
3
answers
2k
views
Using a PRNG for a stream cipher instead of a dedicated algorithm
I am aware, that it is possible to build a stream cipher using some deterministic PRNG (like HASH_DRBG or CTR_DRBG) with good key material as the seed.
What are the advantages of using a purpose ...
- 2,508
1
vote
1
answer
299
views
Would using two keys for Salsa20 or ChaCha increase security?
Would using the keys (as in two passes with a key each) increase security for Salsa20 or ChaCha stream ciphers increase security?
- 11
14
votes
2
answers
1k
views
Interesting implementation practices in popular crypto library
So reading through the salsa20 implementation for the crypto library for go-lang, I noticed something interesting. Specifically this portion. It looks like something I would expect from someone ...
- 195
3
votes
1
answer
395
views
Parameters for comparison of Salsa, HC-128 and SOSEMANUK
I am doing my final project of computer science and I need some help.
I understand how Salsa works, but I don't have the same knowledge of HC-128 and SOSEMANUK. I have to do a table with the ...
- 115
1
vote
1
answer
635
views
Reuse nonce with Salsa20 stream cipher with counter
It is often said to never use a nonce for more than one message when using a stream cipher. It seems this is to prevent something like this:
Taking advantage of one-time pad key reuse?
Yet what if I ...
