Questions tagged [salsa20]

Salsa20 by Daniel J. Bernstein is a family of stream ciphers built on a pseudo-random function.

Filter by
Sorted by
Tagged with
19
votes
3answers
643 views

Collision or second preimage for the ChaCha core?

Daniel J. Bernstein's ChaCha core is an evolution of the Salsa20 core. Both are functions over the set of 512-bit bitstrings, partitioned as sixteen 32-bit words. Can we exhibit collisions, or second-...
15
votes
2answers
5k views

Why should one prefer Salsa20 over ChaCha?

We are all aware of Google's approach to introduce ChaCha/Poly1305 as TLS cipher suite. The rationale seems clear: ChaCha is newer and seems to provide better security (and maybe speed?) gained from ...
14
votes
2answers
1k views

Interesting implementation practices in popular crypto library

So reading through the salsa20 implementation for the crypto library for go-lang, I noticed something interesting. Specifically this portion. It looks like something I would expect from someone ...
14
votes
1answer
2k views

Dancing confusion with Daniel J. Bernstein's stream ciphers

I know of Salsa20 which won the ESTREAM competition. This is dated of 25 Dec 2007. There is also the ChaCha20 stream cipher (cr.yp.to/chacha.html). This claims to increase the amount of diffusion ...
13
votes
3answers
3k views

What is the PRG period of stream ciphers such as RC4 or Salsa20?

I am confused about how long a stream cipher can be used before you should change the key. To be concrete, let me use the stream cipher based on RC4 as an example. Let's say I want to encrypt a very ...
9
votes
1answer
756 views

The Salsa20 core preserves diagonal shifts?

What do we mean by the Salsa core preserves diagonal shifts
9
votes
1answer
2k views

Security considerations on “expand 32-byte k”-magic number in the Salsa20 family of stream ciphers?

I'm currently examining the NaCl library written by Daniel J. Bernstein and I noticed that the library hard codes the sigma: ...
9
votes
1answer
321 views

Why is the whole initial state used in the final addition of Salsa20 and ChaCha?

Both Salsa20 and ChaCha basically work like this: Put the key, the nonce, the sequence number and a constant into a 4x4 matrix of 32-bit words. Transform the matrix invertibly with a number of ARX ...
8
votes
2answers
3k views

Where are the ChaCha20 test vectors/examples?

I see in the Salsa20 specification there are test examples throughout the document to help an implementer make sure every function works as designed. Consequently the whole algorithm would work ...
6
votes
2answers
5k views

How secure is Salsa20?

I have been hearing about Salsa20 from quite some time. It is even the favorite cipher in the ransomware world. Some ransomware used this cipher, probably because of speed. I want to know how secure ...
6
votes
2answers
546 views

Is there an upper limit to plaintext size in XSalsa20Poly1305?

While fiddling with the NaCl implementation in Go, specifically SecretBox, a general crypto question came up after reading the documentation. Quote: Package secretbox encrypts and authenticates ...
6
votes
1answer
3k views

Fast Salsa20 in java?

For Java I'm only aware of the Bouncy Castle implementation of Salsa20. However, that version is significantly slower than AES-CTR and ARC4. There are plenty of libraries in C, but are there any good ...
6
votes
3answers
3k views

Can elliptic curve (25519) be used to encrypt file?

This is probably a simple question, but I haven't been able to see it stated anywhere. Is it possible to directly encrypt a file (of any length) with some form of EC using the 25519 curve. I know it'...
6
votes
1answer
137 views

Replacing a block cipher's key schedule with a stream cipher

Take Rijndael (AES) of block size 128 and reformulate it with a tweakable number of rounds and no key schedule. Suppose we obtain: Rijndael128(r, k) where r is ...
6
votes
1answer
1k views

Extending key sizes in Salsa20 and ChaCha?

I've written implementations of Salsa20 and ChaCha that accept 384 and 448 bit keys. It was fairly trivial to implement, the 'sigma' constant is replaced with key material, and the counter, (which was ...
6
votes
1answer
212 views

Can NORX32-f be used in a Salsa20 style stream cipher?

#include <std_roll_your_own_crypto_warning.h> With the third round CAESAR candidates about to be announced, the design[0] of Salsa20/ChaCha + Poly1305 is ...
6
votes
3answers
175 views

Mixing x into permutation through XOR vs. modular addition

Block ciphers mix key material into the permutation through XOR. Also do pre and post whitening this way. Chacha/Salsa finishes by 32-bit modular adding key and iv material (among other bits but ...
5
votes
1answer
1k views

Secure AES Key Generation via Salsa20?

I am not creating my own cryptography or anything, but to learn about the Dos and Donts of cryptography, I am looking into AES encryption and ways to generate keys for that. As far as I've understood,...
5
votes
1answer
503 views

hardware and software optimizations for Salsa20

I'm using the Crypto++ implementation of Salsa20 for a software project we are working on and I'd like to know if there are any SSE or software optimizations that will increase the speed of the CSPNG?
5
votes
2answers
116 views

Append data to authenticated ciphertext encrypted using a stream cipher

Say we have xSalsa20 authenticated using Poly1305. If $ X $ is the ciphertext, $N$ is the nonce value, and $H$ is the authentication tag such that the final ciphertext is $ N || X || H $, then given ...
5
votes
2answers
257 views

Purpose of repeating a 16-byte key for Salsa20

The core of the Salsa20 family of stream ciphers is a hash function that takes a 64-byte block, using it to generate a pseudorandom 64-byte output. The 64 bytes contain space for a 32-byte key a 16-...
5
votes
1answer
334 views

Is it safe to assume Salsa20 to be a PRP?

Often in security proofs a certain block cipher is assumed to be a pseudorandom permutation or PRP. I wonder if this goes for stream ciphers as well, and specifically for Salsa20. If limit ourselves ...
5
votes
1answer
261 views

Can you help me understand Bernstein’s Notes on Diagonal constant of Salsa20?

Explaining the choice of the Salsa20 constant Bernstein explains: [...] shifting the entire Salsa20 hash-function input array along the diagonal has exactly the same effect on the output. The ...
5
votes
1answer
830 views

Is ChaCha12 considered 256-bit secure?

ChaCha20 is considered 256-bit secure (no attack faster than brute force). However, the best known cryptanalysis that I know of is on ChaCha7. That gives ChaCha20 a rather large security margin (...
5
votes
1answer
158 views

Latin dance family in block cipher

Is it secure to use Salsa20/ChaCha as the key schedule for a 512-bit block cipher using a public permutation in Even-Mansour construction?
5
votes
1answer
262 views

When do I need to renew keys for Salsa20 or HMAC?

I currently have a system which uses two keys sourced from a single key subjected to HKDF. One key is used in the Salsa20 stream ...
5
votes
0answers
121 views

Why Salsa20 rotates columns vertically to optimize for SIMD?

I'm writing a school assignment and I'm trying to fully grasp the differences between Salsa20 and ChaCha. I've come to understand that by rotating upwards the initial matrix columns, DJB says that ...
4
votes
2answers
430 views

Can one extend the nonce of ChaCha/Salsa20 by XORing the extra bits with the key?

Can one extend the ChaCha and Salsa20 nonces by XORing the extra nonce bits with the key? My reasoning is as follows: the Rumba compression function allows attackers to supply any 48-byte input to ...
4
votes
1answer
409 views

Salsa20 Implementation: Sum of 2 Words with Carries Suppressed

I'm working on the 2nd part of the Salsa20 spec, and I want to implement a closure for the exclusive-or of two words(u32). The author defines the operation as the sum of two words with carries ...
4
votes
2answers
4k views

Encryption for a short packet size

I have an 8051 microcontroller with a radio that can send packets with up to 32 bytes and I want to have the messages encrypted. It is a sensor network so I really only want to send one packet per ...
4
votes
1answer
411 views

Salsa20 as a PRNG with streams

Can I use Salsa20 as a good non-cryptographic PRNG with different streams if I reduce the number of rounds to 8 and omit the addition step at the end? I want to omit the final step because I don't ...
4
votes
1answer
102 views

Fundamental difference between the constant, key, nonce, and counter bits in Salsa20/ChaCha20 or AES-Encrypt?

The Salsa20 core function takes a 128-bit constant, 256-bit key, 64-bit counter, and 64-bit nonce and produces a 512-bit value. Or more generically, it is a mapping from 512-bit values to 512-bit ...
4
votes
0answers
97 views

Creating an SPN cipher from ChaCha20 or Salsa20's double round function

Given that ChaCha20's building blocks have been also used to construct a hash function, can the double round function from either ChaCha20 or Salsa20 be used to construct a secure SP-network cipher? ...
3
votes
1answer
292 views

Parameters for comparison of Salsa, HC-128 and SOSEMANUK

I am doing my final project of computer science and I need some help. I understand how Salsa works, but I don't have the same knowledge of HC-128 and SOSEMANUK. I have to do a table with the ...
3
votes
1answer
153 views

Why does Salsa20 algorithm require incrementing word[8] and word[9] after producing cipher text message

I'm trying to get understanding of Salsa20 algorithm. There is an official specification from Daniel J. Bernstein at link. Everything in spec is clear and I could write an implementation on Swift. ...
3
votes
1answer
186 views

Determining strength of a crypto algorithm - clarification with the salsa paper

I am reading through the salsa family paper and on the second page DJB says this -- One can reasonably conjecture, for example, that every function that encrypts data in 0.5 Core-2 cycles/byte is ...
3
votes
1answer
311 views

Salsa20 in Davies-Meyer mode with a fixed key (message): is it one-way?

Say I have a function that calculates a pseudo random permutation and this function is easy to invert. For example $P(i) = AES_k(i)$ where $k$ is a publicly known key. So anyone can compute $P(i)$ ...
3
votes
1answer
612 views

384-bit ChaCha20 / Salsa20

The standard Salsa20 core is a $\{0,1\}^{384} \to \{0,1\}^{512}$ random function with a 16 byte constant ($\sigma$ for a 32-byte key), an 8 byte nonce, an 8 byte counter, and a 32 byte key. The hash ...
2
votes
3answers
1k views

Using a PRNG for a stream cipher instead of a dedicated algorithm

I am aware, that it is possible to build a stream cipher using some deterministic PRNG (like HASH_DRBG or CTR_DRBG) with good key material as the seed. What are the advantages of using a purpose ...
2
votes
2answers
959 views

salsa20 is invertible, useless in CTR mode?

I'm reading the salsa20 spec (sorry for the newbie question, i'm really a newbie here). Every paragraph ends with : "this operation is invertible", I suppose the whole salsa20 algorithm is. If I use ...
2
votes
1answer
303 views

Bouncycastle and Salsa rounds

Salsa by Daniel J. Bernstein was meant to run with 20 rounds. As i can configure the rounds in Bouncycastle with Salsa20Engine, do i have better security by increasing the rounds to 1000? The ...
2
votes
1answer
243 views

Salsa20 / ChaCha with 128 bit keys

According to wikipedia both Salsa20 and ChaCha support both 128 and 256-bit keys. The initial state for each has 8 words of key, where each word is 32 bits. 32*8 = 256. My question is... how is one ...
2
votes
1answer
663 views

Security of Salsa20 with some known plaintext?

Basic question- if I'm encoding a bunch of known filetypes with salsa20, will it still be secure if the plaintext header is known? Assume that a different IV and Key are generated before each file is ...
2
votes
1answer
117 views

Output size of Salsa20

Salsa12 is in eStream portfolio. How many random bits one can generate in Salsa12 using single key? Is it $512\times 2^{128}$?
2
votes
1answer
597 views

Is XSalsa20-Poly1305-SIV a reasonable choice for nonce-misuse-resistant authenticated encryption?

Consider XSalsa20-Poly1305-SIV. This is obtained by: computing a MAC $t_{secret}$ of the plaintext from the key and nonce, as in ChaCha20-Poly1305 except that the plaintext, not the ciphertext, is ...
2
votes
1answer
807 views

How to implement the Salsa20 hash function?

I am currently implementing Salsa20 from the specification as an exercise in learning and self-flagellation. I have Sections 1-7 passing the test examples provided. I am now stuck on Section 8, The ...
2
votes
1answer
154 views

Related-key attacks against Salsa20 and ChaCha

From the Salsa20 security document, DJB states that he doesn't care about related key attacks: The standard solutions to all the standard cryptographic problems—encryption, authentication, etc.—are ...
1
vote
3answers
588 views

Is the Salsa20/ChaCha20 keystream generation one-way?

Is it possible to recompute the Salsa20 or ChaCha20 key in a realistic time if the keystream and the nonce are given to an attacker? Or is the keystream generation one-way, like a cryptographic hash ...
1
vote
1answer
58 views

How is overflow handled in word addition steps in Salsa20?

I feel like I'm completely missing something there. The quarter-round proceeds as follows: ...
1
vote
1answer
52 views

What's the safest way to encrypt a messenger application?

How can I safely encrypt a messenger application that sends data over the Internet via TCP? I've already taken a look at Salsa20, but I don't know if that's a good algorithm to use for this. What ...