4 ms·

That last sentence is paraphrasing a recent djb cfrg post: http://www.ietf.org/mail-archive/web/cfrg/current/msg04880.html http://www.ietf.org/mail-archive/web/

• tptacek 12y ago
  Unless I'm missing something, the point he's making about holding onto keys hasn't much to do with the algorithms you're using.
  • pbsd 12y ago
    Correct, it's algorithm-agnostic. FWIW, Salsa20/12 is the officially-sanctioned eSTREAM winner; it's a perfectly fine cipher choice.
    • tptacek 12y ago
      If you had to use Salsa20, could you foresee a design where you'd choose Salsa20/12?
      • pbsd 12y ago
        Maybe in some high-throughput application, or something under hard performance constraints. IIRC VMWare uses Salsa20/12 for its remote desktop encryption thing. 20 rounds gives a more comfortable security margin, though, so it's a default that lets you sleep well at night. That said, an attack that convincingly broke 12 rounds could be enough to start thinking of switching to something else.