[Cfrg] ChaCha20

[Watson Ladd <[e-mail]>]

Dear all,
In the past 6 years only one cryptanalysis result has been published
against ChaCha, and that was against a variant before the final
version was announced. While Salsa20 was an eStream finalist, ChaCha
wasn't.

The ChaCha20+Poly1305 mode we are considering could have been
submitted to CAESER, but wasn't. I thought about submitting it instead
of McMambo, but ended up winning a durian instead for my troubles.
ChaCha was used in BLAKE, so the differential characteristics of the
round function should work. Unfortunately BLAKE changed ChaCha just
enough to make comparison hard.

I'd like to see some more cryptanalytic attention on ChaCha: in
particular are the differentials from "Latin Dances" still valid for
the published version of ChaCha? What are the best differential
characteristics? And can we figure this out quickly?

Using Salsa20 instead of ChaCha20 would solve this problem somewhat:
at least it won eStream, so we have someone else to blame. However, it
comes at a slight performance loss: how much I don't know. There also
are concerns about nonce size. However, XSalsa20 solves these, while
having the same strength as Salsa20.

(Note that this is the only issue: the Poly1305 security reduces to
PRF security of ChaCha, at least the last time I took a look)

Sincerely,
Watson Ladd