Re: [Cfrg] [RFC] [DRAFT] eXtended-nonce ChaCha and AEAD_XChaCha20-Poly1305 (updated)

["D. J. Bernstein" <[e-mail]>]

Jason Cooper writes:
> So, my question is: Why is this ok?

Alice has hired Bob to build a box that computes HSalsa20 using Alice's
secret key. She isn't giving Bob her secret key, but she's giving Bob a
box that computes Salsa20 using her secret key.

Can Bob still do his job? Yes! Bob builds his HSalsa20 box around
Alice's Salsa20 box. Whatever input comes into Bob's HSalsa20 box, Bob
passes the same input to the Salsa20 box. Bob then extracts certain
words from the Salsa20 output, and subtracts the corresponding input
words, to obtain the HSalsa20 output.

Salsa20 is designed so that an attacker given access to Alice's Salsa20
box can't detect any patterns in the outputs produced by the box. Is it
possible that HSalsa20 is weaker---that an attacker can detect patterns
in the outputs of the HSalsa20 box that Bob built?

The answer is no. Show me an attacker who can see patterns in the
outputs of Bob's HSalsa20 box, and I'll show you an attacker who can see
patterns in the outputs of Alice's Salsa20 box. The second attacker
simply builds the same box that Bob did, and hires the first attacker!

---Dan