From: Samuel Neves Subject: Re: [RFC PATCH 3/9] crypto: chacha20-generic - refactor to allow varying number of rounds Date: Tue, 7 Aug 2018 11:21:04 +0100 Message-ID: References: <20180806223300.113891-1-ebiggers@kernel.org> <20180806223300.113891-4-ebiggers@kernel.org> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Cc: "Jason A. Donenfeld" , ebiggers@kernel.org, Linux Crypto Mailing List , linux-fscrypt@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Herbert Xu , Greg Kaiser , Michael Halcrow , tomer.ashur@esat.kuleuven.be, Eric Biggers , "D. J. Bernstein" To: Paul Crowley Return-path: In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org List-Id: linux-crypto.vger.kernel.org > The best attack on ChaCha breaks 7 rounds, and that attack requires 2^248 operations. This number, as far as I can tell, comes from the "New features of Latin dances" paper. There have been some minor improvements in the intervening 10 years, e.g., [1, 2, 3, 4], which pull back the complexity of breaking ChaCha7 down to 2^235. In any case, every attack so far appears to hit a wall at 8 rounds, with 12 rounds---the recommended eSTREAM round number for Salsa20---seeming to offer a reasonable security margin, still somewhat better than that of the AES. Best regards, Samuel Neves [1] https://eprint.iacr.org/2015/698 [2] https://eprint.iacr.org/2015/217 [3] https://eprint.iacr.org/2016/1034 [4] https://doi.org/10.1016/j.dam.2017.04.034