Salsa20 Stream 暗号 Specification
Salsa20 は an ARX-based stream 暗号 によって Daniel Bernstein, the predecessor の ChaCha20, part の the eSTREAM portfolio.
Algorithm Design
Salsa20 uses a 256-bit key and a 64-bit nonce to generate a keystream from a 4x4 state matrix. Each round consists of quarter-rounds applying add-rotate-xor operations on 32-bit words. The standard version uses 20 rounds (Salsa20), with reduced variants Salsa20/12 and Salsa20/8 for speed. It was selected for the eSTREAM software portfolio.
- key size
- 256 bits (or 128)
- nonce
- 64 bits
- rounds
- 20 (or 12, 8)
32 bytes8 bytesARX quarter-roundsSecurity Analysis
No practical attacks are known on full Salsa20. The best published attacks cover 8 rounds with related-key techniques. The design is naturally constant-time as it uses only arithmetic and rotations. ChaCha20 was created as a variant with slightly better diffusion for the same performance.
- best attack
- 8 rounds (related-key)
- constant-time
- Yes, no tables
- eSTREAM
- Software portfolio
no full breakside-channel saferecommended