Skip to main content
10 votes
Accepted

Is a KDF needed when using X25519 for ECDH and XChaCha20-Poly1305 for AEAD?

Generally speaking, there are (at least) three reasons to put a KDF in between an DH shared secret and the bulk encryption. Improved re-usability. If you don't post-process the shared secret with a ...
SEJPM's user avatar
  • 46.1k
7 votes
Accepted

Does XChaCha20 exist with similar properties to XSalsa20?

Unfortunately, there is no specification for XChaCha20. But several implementations provide a HChaCha20 function, built the same way as HSalsa20. XChaCha20 can be built with HChaCha20 + ChaCha20, and ...
Frank Denis's user avatar
  • 2,973
6 votes
Accepted

Is there an upper limit to plaintext size in XSalsa20Poly1305?

As a comment points out, it’s most probably a mistake/error in the docs. If you look at “What is the PRG period of stream ciphers such as RC4 or Salsa20?”, you’ll find an answer which explicitly ...
e-sushi's user avatar
  • 18k
5 votes
Accepted

Understanding the impact of partitioning oracle attacks on stream ciphers

In short, we can call this a speed-up password search on non-committing AEAD schemes like AES-GCM and ChaCha20-Poly1305 with low oracle calls. If your password has good strength then you are safe. A ...
kelalaka's user avatar
  • 49k
5 votes

Can one extend the nonce of ChaCha/Salsa20 by XORing the extra bits with the key?

Can one extend the ChaCha and Salsa20 nonces by XORing the extra nonce bits with the key? One can, but one probably should not. Security against related-key attacks is not claimed for either (...
otus's user avatar
  • 32.2k
5 votes
Accepted

Composition of X25519+XSalsa20+Poly1305

Poly1305 itself has the requirement that its keys can only ever be used to generate a tag for a single message. That means that when Poly1305-AES (or another Poly1305-based authenticated encryption ...
Future Security's user avatar
4 votes
Accepted

Bouncycastle and Salsa rounds

In general you should avoid changing the cipher for no particular reason. It is unlikely that simply increasing the number of rounds will significantly change the security of the cipher. Although ...
Maarten Bodewes's user avatar
  • 93.2k
3 votes
Accepted

How to choose between AES256-GCM, XSalsa20Poly1305 and XChaCha20Poly1305?

This is kinda subjective. All options are supposed to be good. If I would have to pick one I would pick XChaCha20Poly1305 as AES hardware support is limited. It is usually faster than software AES and ...
LightBit's user avatar
  • 1,659
3 votes

Is XSalsa20-Poly1305-SIV a reasonable choice for nonce-misuse-resistant authenticated encryption?

This can be a secure construction, if by MAC you mean universal hash family, like Poly1305. Call this hash family $H_r$ and the short pseudorandom function family $F_k$. Rough justification for why ...
Squeamish Ossifrage's user avatar
2 votes
Accepted

Authenticated encryption using libsodium's crypto_box_curve25519xsalsa20poly1305

crypto_box_easy() doesn't generate a random nonce. But as documented, using a random nonce is safe, and can be done using ...
Frank Denis's user avatar
  • 2,973
2 votes

Is there an upper limit to plaintext size in XSalsa20Poly1305?

(To clarify the answer in general about why small bounds and why not init/update/finalize streaming, for anyone who doesn't want to bother following the whole discussion about Go in particular on ...
Squeamish Ossifrage's user avatar
2 votes
Accepted

XSalsa20 + Poly1305 authentication wtihout tag

The documentation is a bit misleading about crypto_secretbox_xsalsa20poly1305 that uses a 16-byte authentication tag of poly1305. The libsodium has more clear ...
kelalaka's user avatar
  • 49k
1 vote
Accepted

Can we encrypt part of the XChaCha/XSalsa nonce?

First the XChaCha20-Poly1305 basics Why one may need XChaCha20 ChaCha20 is 20 round from the ChaCha family. The Bernstein version of ChaChax has a 64-bit nonce and 64 bit counter. Bernstein argued ...
kelalaka's user avatar
  • 49k
1 vote
Accepted

Is it OK to just hash a symmetric key to derive an authentication key?

Yes this is "OK". Please correct me if I'm wrong there. You are correct. It's effectively ratcheting the original key. However there may be a more elegant solution such as using static keys for ...
Woodstock's user avatar
  • 1,424

Only top scored, non community-wiki answers of a minimum length are eligible