Questions tagged [salsa20]

Salsa20 by Daniel J. Bernstein is a family of stream ciphers built on a pseudo-random function.

Filter by
Sorted by
Tagged with
0
votes
1answer
39 views

Understanding non-linearity in Salsa20 over various rings

In his design of Salsa20, Bernstein writes to ensure non-linearity he chose 32-bit addition (breaking linearity over $Z/2$), 32-bit xor (breaking linearity over $Z/2^32), and constant-distance 32-bit ...
1
vote
1answer
106 views

Does Salsa20/ChaCha20 still provide Integrity when Encrypt Bitmap?

Forgive me for this question. I have an idea to encrypt *.bmp bitmap files using ChaCha20/Salsa20 without Poly1305. This is just a simple program, where I can encrypt *.bmp bitmap images, with the ...
2
votes
2answers
251 views

Benchmark for CSPRNG as stream ciphers?

My limitation in my security protocol is that I want my RNG as CSPRNG and I also want it to be super fast. If I use Salsa20 or ChaCha or AES counter mode, I don't get the desired speed. I want my PRNG ...
1
vote
0answers
63 views

Serious Cryptography by Jean-Philippe Aumasson - Chapter 5 Stream Ciphers - Attacking Salsa20/8 - Page 100 Last Paragraph

I'm currently reading "Serious Cryptography - A Practical Introduction to Modern Encryption" written by "Jean-Philippe Aumasson" published by NoStarch in 2018. In "Chapter 5 ...
1
vote
1answer
88 views

Salsa20 expands a 256-bit key and a 64-bit nonce into a 2^70 byte stream - where did the 2^70 come from?

From Section 3.1 in DJB's document on The Salsa20 family of stream ciphers- https://cr.yp.to/snuffle/salsafamily-20071225.pdf Salsa20 expands a 256-bit key and a 64-bit nonce (unique message number) ...
0
votes
0answers
26 views

Strange for loop in salsa20_word_specification function

This is wrt to implementation of the salsa20_word_specification function at https://cr.yp.to/salsa20.html The 2nd for loop goes like this ...
3
votes
0answers
85 views

Does varying ChaCha rounds add any security?

This paper introduces 'Freestyle' a randomized, and variable round version of the ChaCha cipher. It uses the concept of hash based halting condition, where a decryption attempt with an incorrect key ...
1
vote
1answer
223 views

Is it possible to acquire the next keystream of Salsa20? (If you know part of the keystream)

When you know the Salsa20's keystream, how do you know the next keystream? In other words, can I infer the next keystream when I don't know the Key and IV of Salsa20, but the keystream is ...
1
vote
1answer
195 views

ECRYPT Salsa20 Test Vectors Interpretation

I am currently implementing Salsa20 for my bachelor thesis. After having verified all the functions needed for the final encryption function with the given test data in the specification from DJB, I ...
0
votes
0answers
60 views

salsa20 (Key, Nonce) repeatable?

in Salsa20, the Key is 128 or 256 bits, the Nonce is 64 bits. the pair (k,r) should never be reused. Does it means, if the key is fixed, the encryption can only run 2^64 times? if the key is not fixed,...
2
votes
4answers
721 views

Is Salsa20+Poly1305 an AEAD?

I see Chacha20Poly1305, XsalsaPoly1305 and AES GCM usually used and mentioned in literature and implementations as AEAD cyphers. My question is that Poly1305 provides authentication and Salsa20 ...
1
vote
1answer
589 views

Is XChacha20 - Poly1305 Quantum resistant?

This is a question just out of curiosity, as I am a newbie to Post Quantum Cryptography. I have read several articles where they emphasize that current standardised symmetric encryption algorithms (...
16
votes
2answers
3k views

Where did ChaCha20 and Salsa20 stream ciphers get their names from?

This is not a question targeted at a specific crypto implementation, but a question out of curiosity. What's the reason for calling the stream ciphers ChaCha/Salsa? I couldn't find any information ...
0
votes
1answer
82 views

is this implementation real salsa20?

https://raw.githubusercontent.com/andres-erbsen/salsa20/master/salsa20.c I tried it, and it's working fine. Now question: is it real salsa20?
1
vote
1answer
171 views

Is it OK to just hash a symmetric key to derive an authentication key?

I'm using xsalsa20poly1305 for encryption in my program from libsodium. The recommended size for chunks is 4 kB. In that case, poly1305 will have authentication only for the the individual 4k chunks. ...
1
vote
1answer
319 views

XChacha20poly1305 vulnerability to known plaintext attacks

During a security audit, the guy said our cryptosystem is vulnerable to known-plaintext attacks. He said that's because «the implementation uses a crypto_stream_xor() approach» (from libsodium). That'...
1
vote
1answer
193 views

(Whitebox Crypto) Using ChaCha20, is it safe to reduce the nonce length in a single block cipher?

I am willing to write a Whitebox Crypto unit using ChaCha20 algorithm (Bernstein, D. 2008) for an input consisting of a single block. The fact it is going to be a single block cipher is of special ...
2
votes
1answer
259 views

Related-key attacks against Salsa20 and ChaCha

From the Salsa20 security document, DJB states that he doesn't care about related key attacks: The standard solutions to all the standard cryptographic problems—encryption, authentication, etc.—are ...
5
votes
1answer
283 views

Fundamental difference between the constant, key, nonce, and counter bits in Salsa20/ChaCha20 or AES-Encrypt?

The Salsa20 core function takes a 128-bit constant, 256-bit key, 64-bit counter, and 64-bit nonce and produces a 512-bit value. Or more generically, it is a mapping from 512-bit values to 512-bit ...
5
votes
2answers
211 views

Append data to authenticated ciphertext encrypted using a stream cipher

Say we have xSalsa20 authenticated using Poly1305. If $ X $ is the ciphertext, $N$ is the nonce value, and $H$ is the authentication tag such that the final ciphertext is $ N || X || H $, then given ...
1
vote
1answer
96 views

What's the safest way to encrypt a messenger application?

How can I safely encrypt a messenger application that sends data over the Internet via TCP? I've already taken a look at Salsa20, but I don't know if that's a good algorithm to use for this. What ...
1
vote
1answer
615 views

How resistant are stream ciphers like Salsa20 or ChaCha in a post-quantum world?

What kind of quantum computer would be required, if it is possible to break such ciphers?
1
vote
1answer
62 views

How can I get select messages ciphers for salsa20poly1305 for unit tests?

In order to avoid memory errors, I always write safe C++ wrappers with strong type-safety for any C encryption library I use. To test my wrapper of ...
1
vote
2answers
134 views

How can I follow the validation and verification recommendations of the NaCl (sodium) secretbox library?

I was advised to use crypto_secretbox_xsalsa20poly1305 due to its simplicity and because it's safe against timing attacks. I'm reading the secretbox tutorial, and ...
5
votes
0answers
87 views

Effect of block size on diffusion rate

I've always been under the belief that larger block sizes require more rounds to achieve full diffusion. Rijndael, SPECK, and SIMON, for example, have a round multiplier based on the block size. The ...
4
votes
1answer
448 views

Salsa20 Implementation: Sum of 2 Words with Carries Suppressed

I'm working on the 2nd part of the Salsa20 spec, and I want to implement a closure for the exclusive-or of two words(u32). The author defines the operation as the sum of two words with carries ...
1
vote
1answer
72 views

How is overflow handled in word addition steps in Salsa20?

I feel like I'm completely missing something there. The quarter-round proceeds as follows: ...
0
votes
1answer
85 views

Starting stream cypher, first block (Salsa20)

I'm implementing Salsa20 in Rust for fun. I have the initial state (4x4 32-bit matrix) setup from the key, nonce, and stream position 0. I'm using the Wikipedia Salsa20 article as reference, and I'm ...
2
votes
2answers
625 views

Salsa20 / ChaCha with 128 bit keys

According to wikipedia both Salsa20 and ChaCha support both 128 and 256-bit keys. The initial state for each has 8 words of key, where each word is 32 bits. 32*8 = 256. My question is... how is one ...
4
votes
1answer
548 views

Salsa20 as a PRNG with streams

Can I use Salsa20 as a good non-cryptographic PRNG with different streams if I reduce the number of rounds to 8 and omit the addition step at the end? I want to omit the final step because I don't ...
6
votes
3answers
297 views

Mixing x into permutation through XOR vs. modular addition

Block ciphers mix key material into the permutation through XOR. Also do pre and post whitening this way. Chacha/Salsa finishes by 32-bit modular adding key and iv material (among other bits but ...
5
votes
1answer
189 views

Latin dance family in block cipher

Is it secure to use Salsa20/ChaCha as the key schedule for a 512-bit block cipher using a public permutation in Even-Mansour construction?
5
votes
2answers
467 views

Purpose of repeating a 16-byte key for Salsa20

The core of the Salsa20 family of stream ciphers is a hash function that takes a 64-byte block, using it to generate a pseudorandom 64-byte output. The 64 bytes contain space for a 32-byte key a 16-...
3
votes
1answer
859 views

384-bit ChaCha20 / Salsa20

The standard Salsa20 core is a $\{0,1\}^{384} \to \{0,1\}^{512}$ random function with a 16 byte constant ($\sigma$ for a 32-byte key), an 8 byte nonce, an 8 byte counter, and a 32 byte key. The hash ...
5
votes
0answers
146 views

Why Salsa20 rotates columns vertically to optimize for SIMD?

I'm writing a school assignment and I'm trying to fully grasp the differences between Salsa20 and ChaCha. I've come to understand that by rotating upwards the initial matrix columns, DJB says that ...
6
votes
1answer
170 views

Replacing a block cipher's key schedule with a stream cipher

Take Rijndael (AES) of block size 128 and reformulate it with a tweakable number of rounds and no key schedule. Suppose we obtain: Rijndael128(r, k) where r is ...
3
votes
1answer
195 views

Why does Salsa20 algorithm require incrementing word[8] and word[9] after producing cipher text message

I'm trying to get understanding of Salsa20 algorithm. There is an official specification from Daniel J. Bernstein at link. Everything in spec is clear and I could write an implementation on Swift. ...
0
votes
1answer
316 views

Does Salsa20 protect integrity?

I was reading about the differences between block ciphers and stream ciphers. One thing that hit me was that stream ciphers like RC4 tend to be susceptible to bit-flipping attacks, in which flipping a ...
2
votes
1answer
134 views

Output size of Salsa20

Salsa12 is in eStream portfolio. How many random bits one can generate in Salsa12 using single key? Is it $512\times 2^{128}$?
2
votes
3answers
2k views

Using a PRNG for a stream cipher instead of a dedicated algorithm

I am aware, that it is possible to build a stream cipher using some deterministic PRNG (like HASH_DRBG or CTR_DRBG) with good key material as the seed. What are the advantages of using a purpose ...
1
vote
1answer
282 views

Would using two keys for Salsa20 or ChaCha increase security?

Would using the keys (as in two passes with a key each) increase security for Salsa20 or ChaCha stream ciphers increase security?
14
votes
2answers
1k views

Interesting implementation practices in popular crypto library

So reading through the salsa20 implementation for the crypto library for go-lang, I noticed something interesting. Specifically this portion. It looks like something I would expect from someone ...
3
votes
1answer
339 views

Parameters for comparison of Salsa, HC-128 and SOSEMANUK

I am doing my final project of computer science and I need some help. I understand how Salsa works, but I don't have the same knowledge of HC-128 and SOSEMANUK. I have to do a table with the ...
1
vote
1answer
460 views

Reuse nonce with Salsa20 stream cipher with counter

It is often said to never use a nonce for more than one message when using a stream cipher. It seems this is to prevent something like this: Taking advantage of one-time pad key reuse? Yet what if I ...
5
votes
1answer
345 views

Can you help me understand Bernstein’s Notes on Diagonal constant of Salsa20?

Explaining the choice of the Salsa20 constant Bernstein explains: [...] shifting the entire Salsa20 hash-function input array along the diagonal has exactly the same effect on the output. The Salsa20 ...
7
votes
2answers
679 views

Is there an upper limit to plaintext size in XSalsa20Poly1305?

While fiddling with the NaCl implementation in Go, specifically SecretBox, a general crypto question came up after reading the documentation. Quote: Package secretbox encrypts and authenticates ...
9
votes
1answer
762 views

The Salsa20 core preserves diagonal shifts?

What do we mean by the Salsa core preserves diagonal shifts
6
votes
2answers
7k views

How secure is Salsa20?

I have been hearing about Salsa20 from quite some time. It is even the favorite cipher in the ransomware world. Some ransomware used this cipher, probably because of speed. I want to know how secure ...
3
votes
1answer
199 views

Determining strength of a crypto algorithm - clarification with the salsa paper

I am reading through the salsa family paper and on the second page DJB says this -- One can reasonably conjecture, for example, that every function that encrypts data in 0.5 Core-2 cycles/byte is ...
2
votes
1answer
334 views

Bouncycastle and Salsa rounds

Salsa by Daniel J. Bernstein was meant to run with 20 rounds. As i can configure the rounds in Bouncycastle with Salsa20Engine, do i have better security by increasing the rounds to 1000? The ...