The Salsa20 stream cipher Salsa20: additive stream cipher, expanding key and nonce D. J. Bernstein into long stream of bytes Thanks to: to add to plaintext. University of Illinois at Chicago Key : 16 or 32 bytes. NSF CCR–9983950 Same speed either way, Alfred P. Sloan Foundation simplifying hardware. � : 8 bytes. Nonce Can send 2 64 messages under one key. � ): Stream Salsa20 ✁ ( 2 70 bytes for each message.
� � ☎ ✁ ✄ � � stream cipher Salsa20: additive stream cipher, For authentication, expanding key and nonce combine Salsa20 with into long stream of bytes http://cr.yp.to/mac.html to add to plaintext. Given message Illinois at Chicago � Poly1305 �✂✁ �✆☎ Key : 16 or 32 bytes. Send ( CCR–9983950 �✝✁ ) = Salsa20 Same speed either way, ( ✁ ( Foundation simplifying hardware. �✟✞ Very fast; short secret � : 8 bytes. Nonce provably secure if Salsa20 Can send 2 64 messages better than encrypt-then-MA under one key. Easily adapt to “AEAD,” � ): Stream Salsa20 ✁ ( i.e., allow unencrypted 2 70 bytes for each message.
� ☎ ✁ � Salsa20: additive stream cipher, For authentication, expanding key and nonce combine Salsa20 with Poly1305, into long stream of bytes http://cr.yp.to/mac.html . to add to plaintext. � : Given message with nonce � Poly1305 �✆☎ )) where �✂✁ Key : 16 or 32 bytes. Send ( ✄ ( �✝✁ ) = Salsa20 � ) Same speed either way, ( ✁ ( (0 ). simplifying hardware. �✟✞ ); Very fast; short secret key ( � : 8 bytes. Nonce provably secure if Salsa20 is secure; Can send 2 64 messages better than encrypt-then-MAC. under one key. Easily adapt to “AEAD,” � ): Stream Salsa20 ✁ ( i.e., allow unencrypted header. 2 70 bytes for each message.
� � � � � � � � ☎ � � � � ✁ � additive stream cipher, For authentication, Let’s watch how Salsa20 and nonce combine Salsa20 with Poly1305, generates block of � 2 � 3 of bytes http://cr.yp.to/mac.html . from key (1 � 227 � 11 plaintext. nonce (255 � : Given message with nonce � Poly1305 �✆☎ )) where �✂✁ bytes. Send ( ✄ ( Notation: means �✝✁ ) = Salsa20 � ) either way, ( ✁ ( (0 ). Little-endian everywhere. are. �✟✞ ); Very fast; short secret key ( Key: ytes. provably secure if Salsa20 is secure; messages better than encrypt-then-MAC. Easily adapt to “AEAD,” Nonce: � ): ✁ ( i.e., allow unencrypted header. each message.
� ✁ � � � � ☎ � For authentication, Let’s watch how Salsa20 combine Salsa20 with Poly1305, generates block of 64 bytes � 2 � 3 � 16), http://cr.yp.to/mac.html . from key (1 � 227 � 11 � 84 � 2 � 0 � 0 � 0). nonce (255 � : Given message with nonce � Poly1305 �✆☎ )) where �✂✁ Send ( ✄ ( Notation: means 1 + 2 + 16. �✝✁ ) = Salsa20 � ) ( ✁ ( (0 ). Little-endian everywhere. �✟✞ ); Very fast; short secret key ( Key: provably secure if Salsa20 is secure; better than encrypt-then-MAC. . Easily adapt to “AEAD,” Nonce: i.e., allow unencrypted header. .
� � � � � � � ✁ � ☎ authentication, Let’s watch how Salsa20 Build 4 4 array of with Poly1305, generates block of 64 bytes � 2 � 3 � 16), http://cr.yp.to/mac.html . from key (1 � 227 � 11 � 84 � 2 � 0 � 0 � 0). nonce (255 � : with nonce �✆☎ )) where �✂✁ oly1305 ✄ ( Notation: means 1 + 2 + 16. � ) �✝✁ ✁ ( (0 ). Little-endian everywhere. Diagonal entries are �✟✞ ); secret key ( Key: if Salsa20 is secure; Other entries are k encrypt-then-MAC. . “AEAD,” Nonce: ; blo unencrypted header. . ; key
� � � � � Let’s watch how Salsa20 Build 4 4 array of 4-byte words: generates block of 64 bytes � 2 � 3 � 16), from key (1 � 227 � 11 � 84 � 2 � 0 � 0 � 0). nonce (255 Notation: means 1 + 2 + 16. Little-endian everywhere. Diagonal entries are constants: Key: Other entries are key . ; nonce Nonce: ; block counter . ; key again.
� � � � � � � � Salsa20 Build 4 4 array of 4-byte words: Modify one word using of 64 bytes � 16), � 11 � 84 � 2 � 0 � 0 � 0). means 1 + 2 + 16. everywhere. Diagonal entries are constants: The modification is add two underlined rotate left by 7 bits; Other entries are key . xor into next word ; nonce ; block counter x[9] ^= (x[1]+x[5]) . ; key again. Will do long series simple modifications,
� Build 4 4 array of 4-byte words: Modify one word using two others: Diagonal entries are constants: The modification is very simple: add two underlined words; rotate left by 7 bits; Other entries are key xor into next word down. ; nonce ; block counter x[9] ^= (x[1]+x[5]) <<< 7 ; key again. Will do long series of these simple modifications, as in TEA.
� y of 4-byte words: Modify one word using two others: Modify other columns: are constants: The modification is very simple: Columns wrap around add two underlined words; from bottom to top. rotate left by 7 bits; key x[4] ^= (x[12]+x[0]) xor into next word down. ; nonce x[14] ^= (x[6]+x[10]) block counter x[9] ^= (x[1]+x[5]) <<< 7 x[3] ^= (x[11]+x[15]) key again. Will do long series of these Total: 4 modifications. simple modifications, as in TEA.
Modify one word using two others: Modify other columns: The modification is very simple: Columns wrap around add two underlined words; from bottom to top. rotate left by 7 bits; x[4] ^= (x[12]+x[0]) <<< 7 xor into next word down. x[14] ^= (x[6]+x[10]) <<< 7 x[9] ^= (x[1]+x[5]) <<< 7 x[3] ^= (x[11]+x[15]) <<< 7 Will do long series of these Total: 4 modifications. simple modifications, as in TEA.
using two others: Modify other columns: Modify each column is very simple: Columns wrap around This time rotate by underlined words; from bottom to top. x[8] ^= (x[0]+x[4]) bits; x[4] ^= (x[12]+x[0]) <<< 7 x[13] ^= (x[5]+x[9]) rd down. x[14] ^= (x[6]+x[10]) <<< 7 x[2] ^= (x[10]+x[14]) (x[1]+x[5]) <<< 7 x[3] ^= (x[11]+x[15]) <<< 7 x[7] ^= (x[15]+x[3]) series of these Total: 4 modifications. Total: 8 modifications. difications, as in TEA.
Modify other columns: Modify each column again: Columns wrap around This time rotate by 9 bits. from bottom to top. x[8] ^= (x[0]+x[4]) <<< 9 x[4] ^= (x[12]+x[0]) <<< 7 x[13] ^= (x[5]+x[9]) <<< 9 x[14] ^= (x[6]+x[10]) <<< 7 x[2] ^= (x[10]+x[14]) <<< 9 x[3] ^= (x[11]+x[15]) <<< 7 x[7] ^= (x[15]+x[3]) <<< 9 Total: 4 modifications. Total: 8 modifications.
columns: Modify each column again: Modify each column round This time rotate by 9 bits. This time rotate by top. x[8] ^= (x[0]+x[4]) <<< 9 x[12] ^= (x[4]+x[8]) (x[12]+x[0]) <<< 7 x[13] ^= (x[5]+x[9]) <<< 9 x[1] ^= (x[9]+x[13]) (x[6]+x[10]) <<< 7 x[2] ^= (x[10]+x[14]) <<< 9 x[6] ^= (x[14]+x[2]) (x[11]+x[15]) <<< 7 x[7] ^= (x[15]+x[3]) <<< 9 x[11] ^= (x[3]+x[7]) difications. Total: 8 modifications. Total: 12 modifications.
Modify each column again: Modify each column again: This time rotate by 9 bits. This time rotate by 13 bits. x[8] ^= (x[0]+x[4]) <<< 9 x[12] ^= (x[4]+x[8]) <<< 13 x[13] ^= (x[5]+x[9]) <<< 9 x[1] ^= (x[9]+x[13]) <<< 13 x[2] ^= (x[10]+x[14]) <<< 9 x[6] ^= (x[14]+x[2]) <<< 13 x[7] ^= (x[15]+x[3]) <<< 9 x[11] ^= (x[3]+x[7]) <<< 13 Total: 8 modifications. Total: 12 modifications.
column again: Modify each column again: Modify each column by 9 bits. This time rotate by 13 bits. This time rotate by (x[0]+x[4]) <<< 9 x[12] ^= (x[4]+x[8]) <<< 13 x[0] ^= (x[8]+x[12]) (x[5]+x[9]) <<< 9 x[1] ^= (x[9]+x[13]) <<< 13 x[5] ^= (x[13]+x[1]) (x[10]+x[14]) <<< 9 x[6] ^= (x[14]+x[2]) <<< 13 x[10] ^= (x[2]+x[6]) (x[15]+x[3]) <<< 9 x[11] ^= (x[3]+x[7]) <<< 13 x[15] ^= (x[7]+x[11]) difications. Total: 12 modifications. Total: 16 modifications.
Modify each column again: Modify each column again: This time rotate by 13 bits. This time rotate by 18 bits. x[12] ^= (x[4]+x[8]) <<< 13 x[0] ^= (x[8]+x[12]) <<< 18 x[1] ^= (x[9]+x[13]) <<< 13 x[5] ^= (x[13]+x[1]) <<< 18 x[6] ^= (x[14]+x[2]) <<< 13 x[10] ^= (x[2]+x[6]) <<< 18 x[11] ^= (x[3]+x[7]) <<< 13 x[15] ^= (x[7]+x[11]) <<< 18 Total: 12 modifications. Total: 16 modifications.
� � � column again: Modify each column again: Modify rows by 7 by 13 bits. This time rotate by 18 bits. Now every word has been modified (x[4]+x[8]) <<< 13 x[0] ^= (x[8]+x[12]) <<< 18 Total: 32 modifications. (x[9]+x[13]) <<< 13 x[5] ^= (x[13]+x[1]) <<< 18 (x[14]+x[2]) <<< 13 x[10] ^= (x[2]+x[6]) <<< 18 That’s 2 rounds of (x[3]+x[7]) <<< 13 x[15] ^= (x[7]+x[11]) <<< 18 difications. Total: 16 modifications.
Recommend
More recommend
