Skip to main content
29 votes
Accepted

Interesting implementation practices in popular crypto library

This appears to be a simple case of Loop Unrolling, which is a generic software optimization. Implementations of crypto algorithms are often times "unrolled", which means taking the statements that ...
Ella Rose's user avatar
  • 19.7k
14 votes

The Salsa20 core preserves diagonal shifts?

The input of the Salsa20 core is a 4x4 array of 32-bit words. If you move all the inputs diagonally (wrapping), the output will be the same as the original output, except that it's moved by the same ...
CodesInChaos's user avatar
  • 24.9k
11 votes

Where did ChaCha20 and Salsa20 stream ciphers get their names from?

idle speculation, my personal favourite! i always thought it was after the dance... Salsa dance - see the video (Video demonstrating salsa dancing fundamentals) and jump to ~1min05sec in, the ...
brynk's user avatar
  • 318
11 votes
Accepted

What are the performance reasons behind "xor-a-rotated-sum" instead of "add-a-rotated-xor" in Salsa20?

Three-operand means two source registers and one destination register. Most x86 instructions reuse one of the source registers as the destination, so you must use an extra MOV instruction to copy one ...
benrg's user avatar
  • 776
10 votes
Accepted

Is a KDF needed when using X25519 for ECDH and XChaCha20-Poly1305 for AEAD?

Generally speaking, there are (at least) three reasons to put a KDF in between an DH shared secret and the bulk encryption. Improved re-usability. If you don't post-process the shared secret with a ...
SEJPM's user avatar
  • 46.1k
10 votes
Accepted

Salsa20 Implementation: Sum of 2 Words with Carries Suppressed

The sum of two words with carries suppressed is just a convoluted way of saying XOR. You don't need to implement any kind of complicated summation operation. Just perform a bitwise-exclusive OR. I ...
forest's user avatar
  • 15.3k
9 votes
Accepted

How secure is Salsa20?

Pulling information from the wikipedia entry on Salsa20: eSTREAM selection Salsa20 has been selected as a Phase 3 design for Profile 1 (software) by the eSTREAM project, receiving the highest ...
Ella Rose's user avatar
  • 19.7k
7 votes
Accepted

Using a PRNG for a stream cipher instead of a dedicated algorithm

I use HMAC-DRBG in my python modules as a backup for when no "real" crypto package is installed. The python 2 standard library offers cryptographic hashes and HMAC, but no encryption primitives. The ...
Ella Rose's user avatar
  • 19.7k
7 votes

Using a PRNG for a stream cipher instead of a dedicated algorithm

Rather than giving the advantages of purpose build stream cipher I'll give the disadvantages of using a PRNG / DRBG (you are using a PRNG for the use case of a stream cipher after all): ...
Maarten Bodewes's user avatar
  • 93.2k
7 votes
Accepted

Where did ChaCha20 and Salsa20 stream ciphers get their names from?

When I was writing a paper for a cryptosystem which uses salsa20 as a CSPRNG I read some papers related to it, starting from those published by the designer of Salsa20 (2005) and Chacha20 (2008), ...
Maf's user avatar
  • 271
6 votes
Accepted

Is there an upper limit to plaintext size in XSalsa20Poly1305?

As a comment points out, it’s most probably a mistake/error in the docs. If you look at “What is the PRG period of stream ciphers such as RC4 or Salsa20?”, you’ll find an answer which explicitly ...
e-sushi's user avatar
  • 17.9k
6 votes
Accepted

Salsa20 as a PRNG with streams

Reducing the rounds to 8 would give you Salsa20/8, which is not just a fast PRNG operating at 1.88 cycles per byte on Core2Duo, but is still quite cryptographically secure with the best attack ...
forest's user avatar
  • 15.3k
6 votes
Accepted

How is overflow handled in word addition steps in Salsa20?

Per the Salsa20 page - Each modification involves xor'ing into one word a rotated version of the sum of two other words modulo 232. Adding two uint32s and ...
puzzlepalace's user avatar
  • 4,042
6 votes

Is XChacha20 - Poly1305 Quantum resistant?

TL;DR: Yes, it is. While it is weakened by quantum computers because of Grover's algorithm, it still has enough security margin to be considered "quantum safe". Does Grover's Search ...
Lery's user avatar
  • 7,709
6 votes
Accepted

Is Salsa20+Poly1305 an AEAD?

Yes, it can be implemented as an AEAD cipher, although the common definition uses ChaCha20 instead. ChaCha is a cipher with slightly better diffusion and better performance characteristics; both ...
Maarten Bodewes's user avatar
  • 93.2k
5 votes

Can one extend the nonce of ChaCha/Salsa20 by XORing the extra bits with the key?

Can one extend the ChaCha and Salsa20 nonces by XORing the extra nonce bits with the key? One can, but one probably should not. Security against related-key attacks is not claimed for either (...
otus's user avatar
  • 32.2k
5 votes

Replacing a block cipher's key schedule with a stream cipher

The requirements of a key schedule would be easily met by Salsa20, or any PRF for that matter. A key schedule is similar in purpose to a cryptographic hash functions (which Salsa20 is built off of), ...
forest's user avatar
  • 15.3k
5 votes
Accepted

Why does Salsa20 algorithm require incrementing word[8] and word[9] after producing cipher text message

This code only increments word 9 when word 8 is zero. Just like when counting you increment the next digit whenever the previous digit is zero, going from 9 to 10. This is equivalent to having a 64-...
CodesInChaos's user avatar
  • 24.9k
5 votes

Using a PRNG for a stream cipher instead of a dedicated algorithm

I think this question's answer becomes much clearer if we refine our terminology/classification of algorithms, to focus on the requirements instead of the mechanics. In particular, cryptographic uses ...
Luis Casillas's user avatar
5 votes

How resistant are stream ciphers like Salsa20 or ChaCha in a post-quantum world?

There is no known quantum attack better than the generic Grover attack on Salsa20 and ChaCha, which is inconsequential because it would take $2^{128}$ sequential steps. Even if parallelized $p$ ways ...
Squeamish Ossifrage's user avatar
5 votes

What's the safest way to encrypt a messenger application?

Writing a secure messenger application is difficult, and vulnerabilities have been found, and keep being found in all of them. This requires far more than just a stream cipher such as Salsa20. An ...
Frank Denis's user avatar
  • 2,973
5 votes

Benchmark for CSPRNG as stream ciphers?

The first thing to NOTE is that said by SEJPM in the comment, performance depends on the hardware - in both horizontal (core count, etc.) and vertical (clock speed, etc.) dimensions. The second thing ...
DannyNiu's user avatar
  • 9,421
4 votes
Accepted

Purpose of repeating a 16-byte key for Salsa20

If we fix the second half of the key to all zeros we have at least 2 potential issues: The zero-bits offer no additional diffusion effect, whereas repeating the key increases the diffusion effect. ...
cypherfox's user avatar
  • 1,422
4 votes
Accepted

Parameters for comparison of Salsa, HC-128 and SOSEMANUK

HC-128 and SOSEMANUK are two stream ciphers that were studied by the "eSTREAM" project. A bunch of candidates were evaluated, and the "best" (in some way) were kept in the final portfolio. From the ...
Thomas Pornin's user avatar
4 votes
Accepted

Does Salsa20 protect integrity?

Salsa20 alone does not protect integrity. Poly1305 protects integrity, as it is a Message Authentication Code (MAC). A MAC takes a secret key and a message, and outputs an authentication tag. Any ...
SAI Peregrinus's user avatar
4 votes

Can you help me understand Bernstein’s Notes on Diagonal constant of Salsa20?

The Salsa20 core is defined on a $4\times4$ matrix $x$ of 32-bit words by $\operatorname{Salsa20}(x) = \pi(x) + x$, where $\pi$ is a permutation. Consider a matrix: \begin{equation} x = \begin{...
Squeamish Ossifrage's user avatar
4 votes
Accepted

Bouncycastle and Salsa rounds

In general you should avoid changing the cipher for no particular reason. It is unlikely that simply increasing the number of rounds will significantly change the security of the cipher. Although ...
Maarten Bodewes's user avatar
  • 93.2k
4 votes
Accepted

Salsa20 / ChaCha with 128 bit keys

As Luis Casillas said in his comment, the spec of Salsa is short and well explained. Namely, if you are interested in the expansion function, you can find a description with two examples (one with a ...
Faulst's user avatar
  • 852
3 votes

Is XSalsa20-Poly1305-SIV a reasonable choice for nonce-misuse-resistant authenticated encryption?

This can be a secure construction, if by MAC you mean universal hash family, like Poly1305. Call this hash family $H_r$ and the short pseudorandom function family $F_k$. Rough justification for why ...
Squeamish Ossifrage's user avatar
3 votes

Is ChaCha12 considered 256-bit secure?

Yes, the best attack still seems to be on 7 rounds. Namely, "Improved Key Recovery Attacks on Reduced-Round Salsa20 and ChaCha" shows a $2^{246.5}$ time attack on the 7-round variant. So even the 12-...
otus's user avatar
  • 32.2k

Only top scored, non community-wiki answers of a minimum length are eligible