On Tue, Aug 07, 2018 at 02:51:21PM -0700, Eric Biggers wrote: > On Tue, Aug 07, 2018 at 11:21:04AM +0100, Samuel Neves wrote: > > > The best attack on ChaCha breaks 7 rounds, and that attack requires 2^248 operations. > > > > This number, as far as I can tell, comes from the "New features of > > Latin dances" paper. There have been some minor improvements in the > > intervening 10 years, e.g., [1, 2, 3, 4], which pull back the > > complexity of breaking ChaCha7 down to 2^235. In any case, every > > attack so far appears to hit a wall at 8 rounds, with 12 rounds---the > > recommended eSTREAM round number for Salsa20---seeming to offer a > > reasonable security margin, still somewhat better than that of the > > AES. > > > > Best regards, > > Samuel Neves > > > > [1] https://eprint.iacr.org/2015/698 > > [2] https://eprint.iacr.org/2015/217 > > [3] https://eprint.iacr.org/2016/1034 > > [4] https://doi.org/10.1016/j.dam.2017.04.034 > > Thanks Samuel, I'll fix that number in the next iteration of the patchset. > Oops, sorry, for some reason I thought you had quoted one of my commit messages, but it was actually Paul's email. I did mention in "crypto: chacha - add XChaCha12 support" that "the best known attack on ChaCha makes it through only 7 rounds", but I didn't specify the complexity. - Eric
