3 ms·
This says very little about the strength of the cipher. The initial state of ChaCha20 also has only at most 320 unknown bits (512 bits - 128 constant bits - 64
by adrian_b 1y ago
This says very little about the strength of the cipher.
The initial state of ChaCha20 also has only at most 320 unknown bits (512 bits - 128 constant bits - 64 bits of a nonce). Actually you normally also know the counter, so there are only 256 unknown bits.
Of course the actual strength of the cipher cannot exceed the size of the state, but the design strength must be much lower for this cipher. It competes with AES-128, which is designed for an 128-bit strength.
320 bits of state is more than enough for a cipher that must have an 128-bit strength, or even for a cipher designed for a 256-bit strength, like AES-256 or ChaCha20.