lkml.org 
[lkml]   [2018]   [Aug]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [RFC PATCH 3/9] crypto: chacha20-generic - refactor to allow varying number of rounds
    On Tue, Aug 07, 2018 at 11:21:04AM +0100, Samuel Neves wrote:
    > > The best attack on ChaCha breaks 7 rounds, and that attack requires 2^248 operations.
    >
    > This number, as far as I can tell, comes from the "New features of
    > Latin dances" paper. There have been some minor improvements in the
    > intervening 10 years, e.g., [1, 2, 3, 4], which pull back the
    > complexity of breaking ChaCha7 down to 2^235. In any case, every
    > attack so far appears to hit a wall at 8 rounds, with 12 rounds---the
    > recommended eSTREAM round number for Salsa20---seeming to offer a
    > reasonable security margin, still somewhat better than that of the
    > AES.
    >
    > Best regards,
    > Samuel Neves
    >
    > [1] https://eprint.iacr.org/2015/698
    > [2] https://eprint.iacr.org/2015/217
    > [3] https://eprint.iacr.org/2016/1034
    > [4] https://doi.org/10.1016/j.dam.2017.04.034

    Thanks Samuel, I'll fix that number in the next iteration of the patchset.

    - Eric

    \
     
     \ /
      Last update: 2018-08-07 23:52    [W:4.507 / U:0.720 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site