Subject: [Cfrg] ChaCha20

From: Watson Ladd <[email-masked]>
Date: Thu, 7 Aug 2014 18:23:05 -0700

Dear all,
In the past 6 years only one cryptanalysis result has been published
against ChaCha, and that was against a variant before the final
version was announced. While Salsa20 was an eStream finalist, ChaCha
wasn't.

The ChaCha20+Poly1305 mode we are considering could have been
submitted to CAESER, but wasn't. I thought about submitting it instead
of McMambo, but ended up winning a durian instead for my troubles.
ChaCha was used in BLAKE, so the differential characteristics of the
round function should work. Unfortunately BLAKE changed ChaCha just
enough to make comparison hard.

I'd like to see some more cryptanalytic attention on ChaCha: in
particular are the differentials from "Latin Dances" still valid for
the published version of ChaCha? What are the best differential
characteristics? And can we figure this out quickly?

Using Salsa20 instead of ChaCha20 would solve this problem somewhat:
at least it won eStream, so we have someone else to blame. However, it
comes at a slight performance loss: how much I don't know. There also
are concerns about nonce size. However, XSalsa20 solves these, while
having the same strength as Salsa20.

(Note that this is the only issue: the Poly1305 security reduces to
PRF security of ChaCha, at least the last time I took a look)

Sincerely,
Watson Ladd

---

From: Ilari Liusvaara <[email-masked]>
Date: Fri, 8 Aug 2014 16:36:14 +0300

> characteristics? And can we figure this out quickly?

Trying to find paper about "Latin Dances", I ran into these:

https://eprint.iacr.org/2007/472
https://eprint.iacr.org/2012/065

Both seem to analyze final version of Chacha, and seemingly make
worse job than on Salsa (e.g. the first "breaks" Salsa8, but not
Chacha8).

-Ilari

---

From: "Paterson, Kenny" <[email-masked]>
Date: Fri, 8 Aug 2014 18:05:46 +0000

Watson,

Thanks for this summary. I agree that more cryptanalysis of ChaCha20 would
be very welcome in the very short term.

So has anyone else out there had a look at the design for ChaCha and the
existing analysis of Salsa? Even a summary of the existing analysis work
on ChaCha would be most welcome.

Regards

Kenny

On 08/08/2014 02:23, "Watson Ladd" <[email-masked]> wrote:

>_______________________________________________
>Cfrg mailing list
>[email-masked]
>http://www.irtf.org/mailman/listinfo/cfrg
>

---

From: Yoav Nir <[email-masked]>
Date: Sat, 9 Aug 2014 00:38:27 +0300

> worse job than on Salsa (e.g. the first "breaks" Salsa8, but not

Thanks, Ilari

The second of those is not (yet) referenced in the draft. I will add this to the next revision.

Yoav