68
votes
What's the appeal of using ChaCha20 instead of AES?
I believe there are three main reasons why ChaCha20 is sometimes preferred to AES.
On a general-purpose 32-bit (or greater) CPU without dedicated instructions, ChaCha20 is generally faster than AES. ...
- 6,369
19
votes
What's the appeal of using ChaCha20 instead of AES?
Unless we find information from Google - such as white papers & mailinglist posts - we can only speculate why ChaCha20 is chosen. I think that efficient software implementation is still the most ...
- 85.8k
14
votes
What should the nonce value be for client-side encryption?
The library uses XChaCha20Poly1305 and that requires a nonce of 192-bit (24-byte). It is an extension of ChaCha20Poly1305 to increase the nonce size, ChaCha20 had ...
- 43.5k
13
votes
What's the appeal of using ChaCha20 instead of AES?
Quoting RFC 8439 (emphasis mine):
The Advanced Encryption Standard (AES — [FIPS-197]) has become the
gold standard in encryption. Its efficient design, widespread
implementation, and hardware ...
- 231
13
votes
Accepted
Is it safe to use a random numbers instead of a counter in ChaCha20?
I am using here the description and terminology from RFC 7539.
ChaCha20 is meant to process messages, each message being a sequence of bytes; ChaCha20 produces pseudorandom blocks of 64 bytes each, ...
- 84.8k
13
votes
Accepted
Why is the core ChaCha primitive not good for use in a CRCF? Why create BLAKE?
I'm answering the following which was asked in the original question:
Why is stock chacha20 not good as a cryptographic hash? Why create BLAKE?
Why not simply apply the one-way compression function ...
- 7,266
12
votes
Where are the ChaCha20 test vectors/examples?
There are in the RFC : https://datatracker.ietf.org/doc/html/draft-agl-tls-chacha20poly1305-04#section-7
The following blocks contain test vectors for ChaCha20. The first line contains the 256-...
- 407
12
votes
Accepted
Why should one prefer Salsa20 over ChaCha?
I agree that conservatism is the likely reason for the choice in McBits.
ChaCha was published while eSTREAM was still running. Salsa20/12 is now in the final eSTREAM portfolio. Even in the XSalsa ...
- 31.3k
11
votes
Accepted
Nonce encryption with Poly1305-Chacha20
Do all TLS cipher suites using "ChaCha20-Poly1305" use Poly1305-AES?
Nope, AES is indeed replaced with ChaCha20 in TLS. The Poly1305 one-time key is generated pseudorandomly using the ...
- 2,704
11
votes
Accepted
Is ChaCha20 alone sufficient for securing data-at-rest?
You really don't want to use ChaCha20 alone in (nearly) any situation.
What ChaCha20 does for you is to prevent attackers from (passively) reading your data, which is good. But ChaCha is a so-called ...
- 44.7k
11
votes
Accepted
What happens if a nonce is reused in ChaCha20-Poly1305?
If you reuse a nonce, you lose confidentiality for the messages with that nonce. Messages with other nonces retain their confidentiality.
However, the attacker can also attack the MAC part (Poly1305) ...
- 31.3k
11
votes
Accepted
Can reduced-round ChaCha be used as non-cryptographic fast PRNG to produce output indistinguishable from random data?
As cypherfox had correctly pointed out during our chat, two rounds is not enough to reliably diffuse a single changed bit throughout the entire output.
My question appears to have been answered ...
- 13.5k
11
votes
Accepted
Does ChaCha20-Poly1305 need random nonce?
No, it doesn't need a random nonce. Yes, if you use an incrementing counter, that works.
As the RFC says, the only requirement is uniqueness; as long as you make sure that each nonce you use is ...
- 133k
11
votes
Does ChaCha20/Salsa have the same bit strength as AES for identical key sizes?
Attacks on a cryptosystem with a 128-bit key are often much cheaper than $2^{128}$. If you have the strings $\operatorname{AES}_{k_1}(812738)$, $\operatorname{AES}_{k_2}(812738)$, $\dots$, $\...
11
votes
Accepted
What are best practices for long term storage (~20 years) of encrypted / sensitive files?
There's simply no way to know. I find it very unlikely that AES will be vulnerable to a ciphertext-only attack in the next 20 years (remember, it has been around for over 20 years already and attacks ...
- 13.5k
10
votes
Accepted
Is a KDF needed when using X25519 for ECDH and XChaCha20-Poly1305 for AEAD?
Generally speaking, there are (at least) three reasons to put a KDF in between an DH shared secret and the bulk encryption.
Improved re-usability. If you don't post-process the shared secret with a ...
- 44.7k
10
votes
Accepted
Is ChaCha20 safer than AES with respect to side-channel attacks?
It basically depends on what you consider side-channel attacks.
If you consider time/cache side channel attacks than chacha20 has been design with resistance to such attacks in mind while AES didn't. ...
- 6,369
10
votes
Accepted
Is XChaCha20-Poly1305 nonce misuse-resistant?
The documentation on libsodium AEAD constructions provides more details.
Namely, it lists Hk(random ‖ m) as a way to compute a synthetic XChaCha20 nonce. Even if <...
- 2,829
10
votes
Where did ChaCha20 and Salsa20 stream ciphers get their names from?
idle speculation, my personal favourite! i always thought it was after the dance...
Salsa dance - see the video (Video demonstrating salsa dancing fundamentals) and jump to ~1min05sec in, the ...
- 278
9
votes
ChaCha20 immune to timing attacks
The obvious way of implementing ChaCha20 involves nothing but additions, fixed rotations, and XORs. All of these are constant time, so the obvious way of implementing ChaCha20 is secure against ...
- 4,653
9
votes
Accepted
Would it be safe to use the message hash as the IV in ChaCha?
First, this is not safe with ChaCha because the ChaCha nonce is only 64 bits long, since ChaCha nonces are normally chosen sequentially, so there would be a nonnegligible danger of collision with a ...
8
votes
Accepted
Does ChaCha20/Salsa have the same bit strength as AES for identical key sizes?
Yes, all modern symmetric ciphers strife to offer (approximately) x bits of key strength for an x-bit key size, just like AES. If they don't, we presume they are broken.
Although there have been ...
- 85.8k
8
votes
Why is the core ChaCha primitive not good for use in a CRCF? Why create BLAKE?
OK, so the core ChaCha primitive (for any fixed number of rounds) is a function $\operatorname{ChaCha}: \{0,1\}^{256}\times \{0,1\}^{64}\times\{0,1\}^{64}\to \{0,1\}^{512}$ which is believed to be a ...
- 44.7k
7
votes
Accepted
ChaCha20 core vs ideal unkeyed PRP
It would be extremily surprising if the ChaCha core was a permutation (as the last P in PRP), although we have no proof it is not (if it was a permutation, it would at least be one we do not known how ...
- 125k
7
votes
Accepted
Does XChaCha20 exist with similar properties to XSalsa20?
Unfortunately, there is no specification for XChaCha20. But several implementations provide a HChaCha20 function, built the same way as HSalsa20.
XChaCha20 can be built with HChaCha20 + ChaCha20, and ...
- 2,829
7
votes
Accepted
In Fortuna, can I use ChaCha20 instead of a block cipher and Blake2b instead of iterated SHA256?
TL;DR: Fortuna is a CSPRNG so you can replace components pretty arbitrarily, because you're not bound by compatibility requirements and the modifications should work, although there are some points ...
- 44.7k
7
votes
Is it safe to use a random numbers instead of a counter in ChaCha20?
Besides the IV, ChaCha20 takes a random number and a counter as input.
No it doesn't (sec. 2.4):
The inputs to ChaCha20 are:
A 256-bit key
A 32-bit initial counter. This can be set to any number, ...
- 14k
7
votes
Accepted
Does chacha20-poly1305 require new key for every encryption process?
You do not require a new key. You use a different initialization vector (IV) for every message.
As long as you use a different pair of (key, nonce) for each message you retain the confidentiality and ...
- 558
7
votes
How secure is ChaCha20?
Aumasson et al. Showed that ChaCha6 can be attacked with time complexity $2^{139}$ and ChaCha7 with $2^{248}$.
Shi et al. gave an attack based on second-order differential with $2^{136}$ for ChaCha6 ...
- 43.5k
7
votes
ChaCha20: is this a potentially safe way of using nonce derived from private key if the key/nonce pair is never reused, for a given plaintext?
I realize in ChaCha20 the nonce should be random and unique each time…
Nope!
For the ChaCha stream cipher, it is not safe to choose the nonce at random. At 64 bits long, the ChaCha nonce is too ...
Only top scored, non community-wiki answers of a minimum length are eligible