3 ms·
In addition to what others said, there's even fewer differences between them internally. Salsa20 <stream cipher> is not a "traditional" stream cipher -- basic
by dchest 14y ago
In addition to what others said, there's even fewer differences between them internally.
Salsa20 <stream cipher> is not a "traditional" stream cipher -- basically it's Salsa20 <hash function> (not collision resistant) in counter mode. The hash function itself is implemented as permutation with final addition of input words to make it irreversible. With this permutation you can build a block cipher, and by the way that's what SHA-3 finalist BLAKE does by introducing addition of key words during rounds (except it's built on a variant of Salsa20 called ChaCha20).
(I'm not saying that you should build your own block cipher from Salsa20, of course :)
The original sentence, though, is:
try Salsa20 rather than AES and Poly1305 rather than GCM.
AES-GCM is also not a "block cipher".
- tptacek 14y agoFor those playing along at home, AES-GCM is AES in CTR mode plus a variant of Wegman-Carter MAC function to authenticate the data.