Re: [Cfrg] I-D Action: draft-irtf-cfrg-xchacha-00.txt

[Ted Krovetz <[e-mail]>]

Is an extended nonce processor necessary? It seems that if we think of the Salsa/Chacha core as the primitive rather than Salsa/Chacha itself, then one could achieve the same goals without the addition of the nonce preprocessing.

If you view the Salsa/Chacha core as a PRF from 384 bit inputs to 512 bit outputs -- which is essentially what the Rhumba hash function does -- then you could allocate 192 bits of the input for a key, 128 bits for nonce, and 64 bits for counter.

Assuming the Salsa/Chacha core is a PRF, then you could go farther by XORing the nonce into the key, allowing up to 320 bits of nonce and 64 bits of counter.

It would be nice if some cryptanalysts looked at this hypothesis. Since high quality implementations of Chacha are making their way into crypto libraries, it would be nice to know that the Chacha core could be co-opted as a PRF.


> On Jun 12, 2019, at 9:10 AM, [e-mail] wrote:
> 
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Crypto Forum RG of the IRTF.
> 
>        Title           : XChaCha: eXtended-nonce ChaCha and AEAD_XChaCha20_Poly1305