4 ms·

I don't know what his arguments are, and I don't have much of a clue about crypto, but perhaps his argument could go along the lines of "a secure algorithm shou

I don't know what his arguments are, and I don't have much of a clue about crypto, but perhaps his argument could go along the lines of "a secure algorithm shouldn't be secured just by increasing the number of rounds too much"?

microcolonel 7y ago
His argument is that since a cryptosystem has a set of different algorithms, each of which could compromise the whole system, the number of rounds should be chosen to match the margins across the primitives used, since strengthening one primitive does not improve the overall margins of the system. Specifically at the end of the paper he argues that the choice of AES rounds is close to reasonable (and warrants little round reduction), and that ChaCha8 matches a reasonable number of rounds on AES (yielding a substantial 2.5x improvement in throughput vs. ChaCha20). Following from these conclusions, I guess you could say that ChaCha12 is already quite ludicrously good, so ChaCha20 is downright wasteful. Not totally sure I agree yet with the specific numbers, but he makes a good point. The paper also includes some helpful advice for those attempting to read cryptanalysis papers.