Hot answers tagged

68 votes

What's the appeal of using ChaCha20 instead of AES?

I believe there are three main reasons why ChaCha20 is sometimes preferred to AES. On a general-purpose 32-bit (or greater) CPU without dedicated instructions, ChaCha20 is generally faster than AES. ...
user avatar
  • 6,369
19 votes

What's the appeal of using ChaCha20 instead of AES?

Unless we find information from Google - such as white papers & mailinglist posts - we can only speculate why ChaCha20 is chosen. I think that efficient software implementation is still the most ...
user avatar
  • 85.8k
14 votes

What should the nonce value be for client-side encryption?

The library uses XChaCha20Poly1305 and that requires a nonce of 192-bit (24-byte). It is an extension of ChaCha20Poly1305 to increase the nonce size, ChaCha20 had ...
user avatar
  • 43.5k
13 votes

What's the appeal of using ChaCha20 instead of AES?

Quoting RFC 8439 (emphasis mine): The Advanced Encryption Standard (AES — [FIPS-197]) has become the gold standard in encryption. Its efficient design, widespread implementation, and hardware ...
user avatar
  • 231
13 votes
Accepted

Is it safe to use a random numbers instead of a counter in ChaCha20?

I am using here the description and terminology from RFC 7539. ChaCha20 is meant to process messages, each message being a sequence of bytes; ChaCha20 produces pseudorandom blocks of 64 bytes each, ...
user avatar
13 votes
Accepted

Why is the core ChaCha primitive not good for use in a CRCF? Why create BLAKE?

I'm answering the following which was asked in the original question: Why is stock chacha20 not good as a cryptographic hash? Why create BLAKE? Why not simply apply the one-way compression function ...
user avatar
  • 7,266
12 votes

Where are the ChaCha20 test vectors/examples?

There are in the RFC : https://datatracker.ietf.org/doc/html/draft-agl-tls-chacha20poly1305-04#section-7 The following blocks contain test vectors for ChaCha20. The first line contains the 256-...
user avatar
  • 407
12 votes
Accepted

Why should one prefer Salsa20 over ChaCha?

I agree that conservatism is the likely reason for the choice in McBits. ChaCha was published while eSTREAM was still running. Salsa20/12 is now in the final eSTREAM portfolio. Even in the XSalsa ...
user avatar
  • 31.3k
11 votes
Accepted

Nonce encryption with Poly1305-Chacha20

Do all TLS cipher suites using "ChaCha20-Poly1305" use Poly1305-AES? Nope, AES is indeed replaced with ChaCha20 in TLS. The Poly1305 one-time key is generated pseudorandomly using the ...
user avatar
  • 2,704
11 votes
Accepted

Is ChaCha20 alone sufficient for securing data-at-rest?

You really don't want to use ChaCha20 alone in (nearly) any situation. What ChaCha20 does for you is to prevent attackers from (passively) reading your data, which is good. But ChaCha is a so-called ...
user avatar
  • 44.7k
11 votes
Accepted

What happens if a nonce is reused in ChaCha20-Poly1305?

If you reuse a nonce, you lose confidentiality for the messages with that nonce. Messages with other nonces retain their confidentiality. However, the attacker can also attack the MAC part (Poly1305) ...
user avatar
  • 31.3k
11 votes
Accepted

Can reduced-round ChaCha be used as non-cryptographic fast PRNG to produce output indistinguishable from random data?

As cypherfox had correctly pointed out during our chat, two rounds is not enough to reliably diffuse a single changed bit throughout the entire output. My question appears to have been answered ...
user avatar
  • 13.5k
11 votes
Accepted

Does ChaCha20-Poly1305 need random nonce?

No, it doesn't need a random nonce. Yes, if you use an incrementing counter, that works. As the RFC says, the only requirement is uniqueness; as long as you make sure that each nonce you use is ...
user avatar
  • 133k
11 votes

Does ChaCha20/Salsa have the same bit strength as AES for identical key sizes?

Attacks on a cryptosystem with a 128-bit key are often much cheaper than $2^{128}$. If you have the strings $\operatorname{AES}_{k_1}(812738)$, $\operatorname{AES}_{k_2}(812738)$, $\dots$, $\...
user avatar
11 votes
Accepted

What are best practices for long term storage (~20 years) of encrypted / sensitive files?

There's simply no way to know. I find it very unlikely that AES will be vulnerable to a ciphertext-only attack in the next 20 years (remember, it has been around for over 20 years already and attacks ...
user avatar
  • 13.5k
10 votes
Accepted

Is a KDF needed when using X25519 for ECDH and XChaCha20-Poly1305 for AEAD?

Generally speaking, there are (at least) three reasons to put a KDF in between an DH shared secret and the bulk encryption. Improved re-usability. If you don't post-process the shared secret with a ...
user avatar
  • 44.7k
10 votes
Accepted

Is ChaCha20 safer than AES with respect to side-channel attacks?

It basically depends on what you consider side-channel attacks. If you consider time/cache side channel attacks than chacha20 has been design with resistance to such attacks in mind while AES didn't. ...
user avatar
  • 6,369
10 votes
Accepted

Is XChaCha20-Poly1305 nonce misuse-resistant?

The documentation on libsodium AEAD constructions provides more details. Namely, it lists Hk(random ‖ m) as a way to compute a synthetic XChaCha20 nonce. Even if <...
user avatar
  • 2,829
10 votes

Where did ChaCha20 and Salsa20 stream ciphers get their names from?

idle speculation, my personal favourite! i always thought it was after the dance... Salsa dance - see the video (Video demonstrating salsa dancing fundamentals) and jump to ~1min05sec in, the ...
user avatar
  • 278
9 votes

ChaCha20 immune to timing attacks

The obvious way of implementing ChaCha20 involves nothing but additions, fixed rotations, and XORs. All of these are constant time, so the obvious way of implementing ChaCha20 is secure against ...
user avatar
  • 4,653
9 votes
Accepted

Would it be safe to use the message hash as the IV in ChaCha?

First, this is not safe with ChaCha because the ChaCha nonce is only 64 bits long, since ChaCha nonces are normally chosen sequentially, so there would be a nonnegligible danger of collision with a ...
user avatar
8 votes
Accepted

Does ChaCha20/Salsa have the same bit strength as AES for identical key sizes?

Yes, all modern symmetric ciphers strife to offer (approximately) x bits of key strength for an x-bit key size, just like AES. If they don't, we presume they are broken. Although there have been ...
user avatar
  • 85.8k
8 votes

Why is the core ChaCha primitive not good for use in a CRCF? Why create BLAKE?

OK, so the core ChaCha primitive (for any fixed number of rounds) is a function $\operatorname{ChaCha}: \{0,1\}^{256}\times \{0,1\}^{64}\times\{0,1\}^{64}\to \{0,1\}^{512}$ which is believed to be a ...
user avatar
  • 44.7k
7 votes
Accepted

ChaCha20 core vs ideal unkeyed PRP

It would be extremily surprising if the ChaCha core was a permutation (as the last P in PRP), although we have no proof it is not (if it was a permutation, it would at least be one we do not known how ...
user avatar
  • 125k
7 votes
Accepted

Does XChaCha20 exist with similar properties to XSalsa20?

Unfortunately, there is no specification for XChaCha20. But several implementations provide a HChaCha20 function, built the same way as HSalsa20. XChaCha20 can be built with HChaCha20 + ChaCha20, and ...
user avatar
  • 2,829
7 votes
Accepted

In Fortuna, can I use ChaCha20 instead of a block cipher and Blake2b instead of iterated SHA256?

TL;DR: Fortuna is a CSPRNG so you can replace components pretty arbitrarily, because you're not bound by compatibility requirements and the modifications should work, although there are some points ...
user avatar
  • 44.7k
7 votes

Is it safe to use a random numbers instead of a counter in ChaCha20?

Besides the IV, ChaCha20 takes a random number and a counter as input. No it doesn't (sec. 2.4): The inputs to ChaCha20 are: A 256-bit key A 32-bit initial counter. This can be set to any number, ...
user avatar
7 votes
Accepted

Does chacha20-poly1305 require new key for every encryption process?

You do not require a new key. You use a different initialization vector (IV) for every message. As long as you use a different pair of (key, nonce) for each message you retain the confidentiality and ...
user avatar
7 votes

How secure is ChaCha20?

Aumasson et al. Showed that ChaCha6 can be attacked with time complexity $2^{139}$ and ChaCha7 with $2^{248}$. Shi et al. gave an attack based on second-order differential with $2^{136}$ for ChaCha6 ...
user avatar
  • 43.5k
7 votes

ChaCha20: is this a potentially safe way of using nonce derived from private key if the key/nonce pair is never reused, for a given plaintext?

I realize in ChaCha20 the nonce should be random and unique each time… Nope! For the ChaCha stream cipher, it is not safe to choose the nonce at random. At 64 bits long, the ChaCha nonce is too ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible