Re: [RFC PATCH 3/9] crypto: chacha20-generic - refactor to allow varying number of rounds

From: Eric Biggers <ebiggers@kernel.org>
To: Samuel Neves <samuel.c.p.neves@gmail.com>
Cc: Paul Crowley <paulcrowley@google.com>,
	"Jason A. Donenfeld" <Jason@zx2c4.com>,
	Linux Crypto Mailing List <linux-crypto@vger.kernel.org>,
	linux-fscrypt@vger.kernel.org,
	linux-arm-kernel@lists.infradead.org,
	linux-kernel@vger.kernel.org,
	Herbert Xu <herbert@gondor.apana.org.au>,
	Greg Kaiser <gkaiser@google.com>,
	Michael Halcrow <mhalcrow@google.com>,
	tomer.ashur@esat.kuleuven.be, Eric Biggers <ebiggers@google.com>,
	"D. J. Bernstein" <djb@cr.yp.to>
Subject: Re: [RFC PATCH 3/9] crypto: chacha20-generic - refactor to allow varying number of rounds
Date: Tue, 7 Aug 2018 17:15:24 -0700	[thread overview]
Message-ID: <20180808001524.GD25300@gmail.com> (raw)
In-Reply-To: <20180807215121.GB25300@gmail.com>

On Tue, Aug 07, 2018 at 02:51:21PM -0700, Eric Biggers wrote:
> On Tue, Aug 07, 2018 at 11:21:04AM +0100, Samuel Neves wrote:
> > > The best attack on ChaCha breaks 7 rounds, and that attack requires 2^248 operations.
> > 
> > This number, as far as I can tell, comes from the "New features of
> > Latin dances" paper. There have been some minor improvements in the
> > intervening 10 years, e.g., [1, 2, 3, 4], which pull back the
> > complexity of breaking ChaCha7 down to 2^235. In any case, every
> > attack so far appears to hit a wall at 8 rounds, with 12 rounds---the
> > recommended eSTREAM round number for Salsa20---seeming to offer a
> > reasonable security margin, still somewhat better than that of the
> > AES.
> > 
> > Best regards,
> > Samuel Neves
> > 
> > [1] https://eprint.iacr.org/2015/698
> > [2] https://eprint.iacr.org/2015/217
> > [3] https://eprint.iacr.org/2016/1034
> > [4] https://doi.org/10.1016/j.dam.2017.04.034
> 
> Thanks Samuel, I'll fix that number in the next iteration of the patchset.
> 

Oops, sorry, for some reason I thought you had quoted one of my commit messages,
but it was actually Paul's email.  I did mention in "crypto: chacha - add
XChaCha12 support" that "the best known attack on ChaCha makes it through only 7
rounds", but I didn't specify the complexity.

- Eric