Re: [Cfrg] Review of draft-arciszewski-xchacha-02

Just another voice for an argument I'm sure has been made before: I agree
with the original spec, the best possible name is XChaCha20 and not
XNChaCha20 or whatever. Here's why:

- XSalsa20 already exists. "XNChaCha20" or whatever suggests that it's...
like XSalsa but with ChaCha and... whatever an N is. The N does not clarify
anything by itself; you'd have to read the spec anyway, and reading the
introductory paragraphs seems like a pretty low bar for using a
crytpographic primitive. Once you do that, you couldn't have any confusion
anymore about what's extended about this cipher. And you'd need to read
that anyway to know what the X meant in the first place :-
- A extended number of rounds wouldn't make sense for these ciphers. For
reduced rounds, that namespace already exists in e.g. Salsa20/8 (which is
Salsa20 but with 8 rounds [1]). There is no Salsa20 with more than 20
rounds because 20 rounds are already considered quite conservative; but if
you were to make a 24-round ChaCha, ChaCha20/24 would be the consistent
name for it.
- An extended key space wouldn't make sense for these ciphers, because they
already have 256 bit keys and target the security level you'd expect from
that.
- The name XChaCha20 is already in use in the popular libsodium library[2]
-- who arrived at the same name because, well, IMO the derivation is
obvious it's much more surprising to me anyone is suggesting something else
than that someone else got at the same name via the same process :-)

[1]: https://cr.yp.to/snuffle/812.pdf
[2]: https://libsodium.gitbook.io/doc/advanced/stream_ciphers/xchacha20

lvh

On Tue, Dec 18, 2018 at 7:17 AM Salz, Rich <rsalz@akamai.com> wrote:

> To repeat what I said earlier, "XChaCha" is a bad name.  Can we use
> XNChaCha or something similar to show that is an extended NONCE, and not
> something like extended keysize or number of rounds?
>
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>