16
votes
Accepted
Why is the core ChaCha primitive not good for use in a CRCF? Why create BLAKE?
I'm answering the following which was asked in the original question:
Why is stock chacha20 not good as a cryptographic hash? Why create BLAKE?
Why not simply apply the one-way compression function ...
- 7,789
16
votes
What should the nonce value be for client-side encryption?
The library also uses XChaCha20Poly1305 and that requires a nonce of 192-bit (24-byte). It is an extension of ChaCha20Poly1305 ...
- 49.5k
16
votes
Accepted
Fast cipher without needing hardware support (like ChaCha20) for disk encryption
Adiantum1 is a wide-block cipher built out of ChaCha12, NH-Poly1305, and—for only a small part of the computation—AES.
Being a wide-block cipher, Adiantum can encrypt, for example, entire 512-byte or ...
15
votes
What's the appeal of using ChaCha20 instead of AES?
Quoting RFC 8439 (emphasis mine):
The Advanced Encryption Standard (AES — [FIPS-197]) has become the
gold standard in encryption. Its efficient design, widespread
implementation, and hardware ...
- 251
13
votes
Accepted
Is it safe to use a random numbers instead of a counter in ChaCha20?
I am using here the description and terminology from RFC 7539.
ChaCha20 is meant to process messages, each message being a sequence of bytes; ChaCha20 produces pseudo-random blocks of 64 bytes each, ...
- 87.8k
12
votes
Accepted
Does ChaCha20/Salsa have the same bit strength as AES for identical key sizes?
Yes, all modern symmetric ciphers strife to offer (approximately) x bits of key strength for an x-bit key size, just like AES. If they don't, we presume they are broken.
Although there have been ...
- 94.5k
11
votes
Accepted
Can reduced-round ChaCha be used as non-cryptographic fast PRNG to produce output indistinguishable from random data?
As cypherfox had correctly pointed out during our chat, two rounds is not enough to reliably diffuse a single changed bit throughout the entire output.
My question appears to have been answered ...
- 15.5k
11
votes
Accepted
Would it be safe to use the message hash as the IV in ChaCha?
First, this is not safe with ChaCha because the ChaCha nonce is only 64 bits long, since ChaCha nonces are normally chosen sequentially, so there would be a nonnegligible danger of collision with a ...
- 49.5k
11
votes
Accepted
Does ChaCha20-Poly1305 need random nonce?
No, it doesn't need a random nonce. Yes, if you use an incrementing counter, that works.
As the RFC says, the only requirement is uniqueness; as long as you make sure that each nonce you use is ...
- 151k
11
votes
Does ChaCha20/Salsa have the same bit strength as AES for identical key sizes?
Attacks on a cryptosystem with a 128-bit key are often much cheaper than $2^{128}$. If you have the strings $\operatorname{AES}_{k_1}(812738)$, $\operatorname{AES}_{k_2}(812738)$, $\dots$, $\...
- 49.5k
11
votes
Where did ChaCha20 and Salsa20 stream ciphers get their names from?
idle speculation, my personal favourite! i always thought it was after the dance...
Salsa dance - see the video (Video demonstrating salsa dancing fundamentals) and jump to ~1min05sec in, the ...
- 318
11
votes
Accepted
What are best practices for long term storage (~20 years) of encrypted / sensitive files?
There's simply no way to know. I find it very unlikely that AES will be vulnerable to a ciphertext-only attack in the next 20 years (remember, it has been around for over 20 years already and attacks ...
- 15.5k
10
votes
Accepted
Is ChaCha20 safer than AES with respect to side-channel attacks?
It basically depends on what you consider side-channel attacks.
If you consider time/cache side channel attacks than chacha20 has been design with resistance to such attacks in mind while AES didn't. ...
- 7,184
10
votes
Accepted
Is XChaCha20-Poly1305 nonce misuse-resistant?
The documentation on libsodium AEAD constructions provides more details.
Namely, it lists Hk(random ‖ m) as a way to compute a synthetic XChaCha20 nonce. Even if <...
- 3,053
9
votes
Does ChaCha20 counter actually increment through iterations?
You seem a bit confused about how the various parts of the ChaCha20 cipher actually fit together, so let me start from the top down and see if I can clarify things.
At the highest level, the ChaCha20 ...
- 46.5k
9
votes
Changing an Encryption scheme from AES to ChaCha20
Now, how feasible it is to move from AES to ChaCha20? What are pros and cons of this?
This entirely depends on the platform and implementation. There's no way we can answer this definitively. However ...
- 15.5k
8
votes
How secure is ChaCha20?
Aumasson et al. Showed that ChaCha6 can be attacked with time complexity $2^{139}$ and ChaCha7 with $2^{248}$.
Shi et al. gave an attack based on second-order differential with $2^{136}$ for ChaCha6 ...
- 49.5k
8
votes
Why is the core ChaCha primitive not good for use in a CRCF? Why create BLAKE?
OK, so the core ChaCha primitive (for any fixed number of rounds) is a function $\operatorname{ChaCha}: \{0,1\}^{256}\times \{0,1\}^{64}\times\{0,1\}^{64}\to \{0,1\}^{512}$ which is believed to be a ...
- 46.4k
7
votes
Is it safe to use a random numbers instead of a counter in ChaCha20?
Besides the IV, ChaCha20 takes a random number and a counter as input.
No it doesn't (sec. 2.4):
The inputs to ChaCha20 are:
A 256-bit key
A 32-bit initial counter. This can be set to any number, ...
- 14.7k
7
votes
Accepted
Does chacha20-poly1305 require new key for every encryption process?
You do not require a new key. You use a different initialization vector (IV) for every message.
As long as you use a different pair of (key, nonce) for each message you retain the confidentiality and ...
- 568
7
votes
ChaCha20: is this a potentially safe way of using nonce derived from private key if the key/nonce pair is never reused, for a given plaintext?
I realize in ChaCha20 the nonce should be random and unique each time…
Nope!
For the ChaCha stream cipher, it is not safe to choose the nonce at random. At 64 bits long, the ChaCha nonce is too ...
- 49.5k
7
votes
Accepted
Which version of ChaCha is more secure?
The only difference between these is the nonce size (and, consequently, the internal counter size). The core function is exactly the same. They all offer the exact same security level if they are used ...
- 3,053
7
votes
Accepted
Is the ChaCha20 block function reversible using known plaintext?
The function which generates keystream blocks is based on a 512-bit permutation function. A permutation is, by definition, bijective.
The inverse of this permutation particular is trivial to ...
- 3,333
7
votes
Accepted
Where did ChaCha20 and Salsa20 stream ciphers get their names from?
When I was writing a paper for a cryptosystem which uses salsa20 as a CSPRNG I read some papers related to it, starting from those published by the designer of Salsa20 (2005) and Chacha20 (2008), ...
- 271
7
votes
Accepted
Can ChaCha20 provide integrity?
ChaCha20 has Ind-CPA security and beyond this ( Ind-CCAx.. [1]), you need integrity and authentication. And note that Authenticated Encryption > Ind-CCA.
ChaCha20 is already teamed with Poly1305 ...
- 49.5k
7
votes
is XChaCha20 stronger than ChaCha20?
The only difference is that XChaCha uses a 192-bit nonce rather than a 64-bit nonce. This allows you to use a random nonce without worrying about the risks of nonce-reuse, which makes picking nonces ...
- 15.5k
6
votes
Accepted
Message length limit induced by block counter size
From the RFC you can see that a ChaCha20 block is constructed as follows:
state = constants | key | counter | nonce
Which is then processed in a number of rounds....
- 94.5k
6
votes
Accepted
Is streaming API to ChaCha20-Poly1305 possible or recommended against?
This is not specific to this construction, but generally, you want to split the stream in smaller chunks, that are individually encrypted and authenticated.
If the encrypted stream doesn't have a ...
- 3,053
6
votes
Accepted
Negating the risk of a random 64-bit nonce
Without looking at the code I would say your construction is pretty much the same as XChaCha20:
From https://download.libsodium.org/doc/advanced/xchacha20.html
Internally, XChaCha20 works like a ...
- 4,933
6
votes
Accepted
ChaCha20-Poly1305 test vectors
For the complete picture, as was pointed out, you should use the final RFC, not drafts. There are two relevant RFC here:
RFC 7539 describes the stream cipher ChaCha20, the MAC algorithm Poly1305, and ...
- 87.8k
Only top scored, non community-wiki answers of a minimum length are eligible