Re: [Cfrg] Task for the CFRG

[zooko <[e-mail]>]

Another point in favor of Salsa20 and especially ChaCha is that the latter
formed the core of the BLAKE candidate for SHA3. BLAKE was one of the three
most thoroughly-studied candidates in the SHA3 process (according to NIST's
final report ¹, the most "depthof analysis" was applied to BLAKE, Skein, and
Grøst).

¹ http://nvlpubs.nist.gov/nistpubs/ir/2012/NIST.IR.7896.pdf

Of course, the requirements of a secure hash function aren't the same as those
for a cipher, but I still think that having all those cryptographers studying
that core function so closely, and not finding any major weakness in it when
used as a secure hash function, gives confidence that there isn't any major
weakness in it when used as a cipher.

Disclosure: I'm an author of a successor hash function based on BLAKE, named
"BLAKE2", but not an author of the original BLAKE. Here are my slides about
that, from ACNS'13, which includes a few quotes from the NIST report:

https://tahoe-lafs.org/~zooko/acns/slides.html

Regards,

Zooko