3 ms·
It can be easy to forget because we all sort of mentally accept it, but ChaCha20 is length preserving, and so is trivially vulnerable to by far the simplest net
by colmmacc 8y ago
It can be easy to forget because we all sort of mentally accept it, but ChaCha20 is length preserving, and so is trivially vulnerable to by far the simplest network side channel: size based traffic analysis. AES-GCM is too, in the same way, but AES-CBC was actually a /little/ better because it's padded to the nearest block which provides a small measure of length hiding.
Imagine you're a state authority who wants to know who is looking at what on the internet. It's pretty easy to fingerprint websites and webpages by size; the pattern of HTML, images, video, and CSS, is highly unique. There are published papers doing this against Google Maps tiles, and Netflix movies. It's very very practical. It's utterly feasible for authorities to build these fingerprint DBs, and to fingerprint any traffic they have visibility of.