Re: [Cfrg] ChaCha20

["Paterson, Kenny" <[e-mail]>]

Watson,

Thanks for this summary. I agree that more cryptanalysis of ChaCha20 would
be very welcome in the very short term.

So has anyone else out there had a look at the design for ChaCha and the
existing analysis of Salsa? Even a summary of the existing analysis work
on ChaCha would be most welcome.

Regards

Kenny


On 08/08/2014 02:23, "Watson Ladd" <[e-mail]> wrote:

>Dear all,
>In the past 6 years only one cryptanalysis result has been published
>against ChaCha, and that was against a variant before the final
>version was announced. While Salsa20 was an eStream finalist, ChaCha
>wasn't.
>
>The ChaCha20+Poly1305 mode we are considering could have been
>submitted to CAESER, but wasn't. I thought about submitting it instead
>of McMambo, but ended up winning a durian instead for my troubles.
>ChaCha was used in BLAKE, so the differential characteristics of the
>round function should work. Unfortunately BLAKE changed ChaCha just
>enough to make comparison hard.
>
>I'd like to see some more cryptanalytic attention on ChaCha: in
>particular are the differentials from "Latin Dances" still valid for
>the published version of ChaCha? What are the best differential
>characteristics? And can we figure this out quickly?
>
>Using Salsa20 instead of ChaCha20 would solve this problem somewhat:
>at least it won eStream, so we have someone else to blame. However, it
>comes at a slight performance loss: how much I don't know. There also
>are concerns about nonce size. However, XSalsa20 solves these, while
>having the same strength as Salsa20.
>
>(Note that this is the only issue: the Poly1305 security reduces to
>PRF security of ChaCha, at least the last time I took a look)
>
>Sincerely,
>Watson Ladd
>
>_______________________________________________
>Cfrg mailing list
>[e-mail]
>http://www.irtf.org/mailman/listinfo/cfrg
>