Received-SPF: pass (google.com: domain of linux-crypto+bounces-3993-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Date: Wed, 1 May 2024 08:02:03 -0600
From: Aaron Toponce <aaron.toponce@gmail.com>
To: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Cc: Theodore Ts'o <tytso@mit.edu>, Eric Biggers <ebiggers@kernel.org>,
	"Jason A. Donenfeld" <Jason@zx2c4.com>,
	Herbert Xu <herbert@gondor.apana.org.au>,
	"David S. Miller" <davem@davemloft.net>,
	linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org
Subject: Re: [PATCH] random: add chacha8_block and swtich the rng to it
Message-ID: <ZjJLWy4Y5Y__JCUF@hercules>
References: <20240429134942.2873253-1-aaron.toponce@gmail.com>
 <20240430031105.GA10165@sol.localdomain>
 <ZjB2ZjkebZyC7FZp@hercules>
 <20240430162632.GA1924352@mit.edu>
 <ZjEf2VV4igcCtkRE@hercules>
 <20240501022201.GD1743554@mit.edu>
 <CAGiyFddFb1yZ3kC5MP+UgqsCATcAcFvZLTXm_bCv3MsSnwAWcQ@mail.gmail.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAGiyFddFb1yZ3kC5MP+UgqsCATcAcFvZLTXm_bCv3MsSnwAWcQ@mail.gmail.com>

On Wed, May 01, 2024 at 02:38:52PM +0200, Jean-Philippe Aumasson wrote:
> Switching from ChaCha20 to ChaCha12 might still raise eyebrows but I
> dont think any respectable crypto/security expert will suspect a
> JiaTan situation.

I also mentioned this earlier in the thread; that is, to switch to ChaCha12 if
ChaCha8 makes us uncomfortable. It's not without precedent also:

- eSTREAM recommends Salsa20/12 in their final portfolio
- Adiantum uses XChaCha12 
- Rust uses ChaCha12 rand::rngs::StdRng

There may be other precedent of ChaCha12 with from non-trivial projects I'm
unfamiliar with.

-- 
. o .   o . o   . . o   o . .   . o .
. . o   . o o   o . o   . o o   . . o
o o o   . o .   . o o   o o .   o o o