3 ms·
AES is a block cipher, Salsa/ChaCha are streams. This makes them very useful for, say, file encryption with random access.
by TillE 10y ago
AES is a block cipher, Salsa/ChaCha are streams.
This makes them very useful for, say, file encryption with random access.
- wolf550e 10y agoThese days people use AES-CTR (or authenticated encryption modes based on AES-CTR, like AES-GCM), which can be treated as stream ciphers.
- tptacek 10y agoThere's virtually no difference in utility, since pretty much the only thing we ever do with a block cipher is adapt it to encrypt streams --- this is true conceptually even when we're not literally turning the block cipher into a PRF with something like CTR mode.
- the8472 10y agoUnder the hood chacha is a block cipher too. It just happens to have counter mode baked in, which turns it into a stream cipher.
- nightcracker 10y agoUnder the hood ChaCha is a 128 bit -> 512 bit hash function with a 128 bit key, running in CTR mode to get a stream cipher. It is most assuredly NOT a block cipher under the hood.
- loup-vaillant 10y agoErr, the key can be 256-bits. This is the preferred key size these days.
- nightcracker 10y agoOops, that should indeed be 256 bits (8 * 32 = 256). The rest of the comment stands though.
- loup-vaillant 10y agoChacha20 can do random access. See the end of my article, when I talk about counter mode. To get the part of the stream you want, you just generate the block you need (they're all the same, only the counter changes), then encrypt it. No need to generate all previous blocks. Indeed, one reason for using AES in counter mode is this random access, which among other things enables parallel encryption. The same strategy works with Chacha20.
- rakoo 10y agoI'm probably stating the obvious here, but whatever your strategy for decrypting is you still must verify the ciphertext integrity, which unfortunately for you is calculated on the whole ciphertext. You may win some time by not reading the stuff before the block you're interested, but you will have to read the whole stuff anyway if you want to be safe. I'm no expert of course so I don't even know if there's an AEAD that can bring you integrity on parts of the input; at least I know that minilock (https://github.com/kaepora/miniLock/blob/master/README.md#-minilock https://github.com/kaepora/miniLock/blob/master/README.md#-m...) builds some kind of counter mode where each chunk is properly encrypted and has everything needed to check its integrity.
- tptacek 10y agoThe most widespread way of using Salsa/ChaCha is in the "Chapoly" construction, which combines ChaCha20 with DJB's Poly1305 polynomial MAC; this is an authenticated construction. Pretty much every mainstream application of Salsa20 is in fact a Salsa/Poly1305 construction. You can also just combine Salsa and HMAC. It's true that you need to authenticate your data, but this is true for any cipher that you use. It's a bad idea to implement your own cipher code, no matter what you're doing. If you're looking to include Salsa/ChaCha in an application, use Nacl, which refuses to give you unauthenticated ciphertext.