4 ms·
As implemented in jedisct1's libraries, it allows authenticating associated data, unlike XSalsaPoly from NaCl.
by dchest 9y ago
As implemented in jedisct1's libraries, it allows authenticating associated data, unlike XSalsaPoly from NaCl.
- jedisct1 9y agoChaCha is generally faster and has more implementations, including OpenSSL. Salsa is essentially limited to NaCl and Sodium. From a security perspective, there is nothing wrong with Salsa. But libraries implementing ChaCha today are unlikely to add Salsa. It wouldn't take much effort for libraries currently having high-quality implementations of ChaCha to add an extended nonce variant. The only reason it didn't happen is that there is no formal specification.
- loup-vaillant 9y agoIt may help if we point out that we now have at least two independent implementations of XChacha20: your Libsodium and my Monocypher. This should raise confidence. I'd love to add the extended nonce to RFC 7539, though.
- tptacek 9y agoWhy would implementation in your own library raise confidence? Sodium is interesting because thousands of people use it.
- loup-vaillant 9y ago> Why would implementation in your own library raise confidence? I thought this would be obvious. I didn't look at Sodium to implement XChacha20, but I did compare our two implementations (my test vectors come from Sodium). At the very least, this is evidence that Sodium did things right. > Sodium is interesting because thousands of people use it. By that metric, OpenSSL is even more interesting. Have those users also tested Sodium? I personally put more weight in Matthew Green's security audit. Likewise, Monocypher is interesting because of its small size (easy to audit, won't take months like Sodium), its paranoid test suite, and to a lesser degree the proof that Poly1305 works. https://monocypher.org/poly1305-proof https://monocypher.org/poly1305-proof