2 ms·
> Two rounds of XChaCha12 are followed by an AES-256 encryption, but of just 16 bytes I am not a cryptographer so I am a bit clueless on topics like this but I
by AnaniasAnanas 8y ago
> Two rounds of XChaCha12 are followed by an AES-256 encryption, but of just 16 bytes
I am not a cryptographer so I am a bit clueless on topics like this but I am wondering, why are they doing this? Does this provide any significant benefit to just chacha12 or chacha12 + poly1305?
- coolspot 8y agoI was curious too, found answer in comments of original publication: > Normally there is just one XChaCha12 invocation per encryption or decryption. There's another to derive subkeys, but that's only needed when setting a new key.
- AnaniasAnanas 8y agoI don't understand why they use AES though.