2

My knowledge of cryptography nothing beyond basic so I am by no means an expert, but I do know a bit of undergraduate mathematics including number theory.

I know that stream ciphers like ChaCha20 is inspired by the one-time pad, but is there a way to use ChaCha20 or modify it to guarantee the same information-theoretic properties like that one-time pad assuming the keys used by ChaCha20 are truly random, one-time use, and is greater than or equal to the length of the plaintext? I was originally planning to combine the one-time pad XOR with Poly1305 for an information-theoretic AEAD, but I guess it's safer to use Bernstein's ChaCha20-Poly1305 instead.

cryptobro
  • 21
  • 2

2 Answers2

1

No, probably not. For it to be theoretically secure each resulting key stream should be as likely any other after going over the entire key space, given a nonce. This is unlikely as the output is basically randomized using the keys, so just by chance some outputs will be more likely than others. Thus if one plaintext is more likely than another you'd "leak" an almost infinitely small amount of information after performing a gargantuan (i.e. computationally infeasible) amount of work.

This, of course, is not practical, but if we would want "practical" we would not bother with the question about theoretic security in the first place. For all intents and purposes ChaCha20 is fine.

Maarten Bodewes
  • 92,551
  • 13
  • 161
  • 313
1

Are you entirely clear as to what a one time pad is exactly? If you can input one time, truly random keys into the ChaCha state, you don't need the ChaCha bit. You could just use the key generator directly to XOR with the plain text. Consider that great speed (bits/s) is not required for home enthusiasts.

It might be worth perusing the OTP tag.

Paul Uszak
  • 15,390
  • 2
  • 28
  • 77
  • I thought of using ChaCha20-Poly1305 instead since it is a proven construct. I was, however, originally planning to use XOR-Poly1305, but I don't have a source whether this is a valid construct with information-theoretic properties. I do know for a fact that Poly1305 is a type of Wegman-Carter MAC though – cryptobro Mar 26 '24 at 21:07