I know that the ChaCha20 core (without the initial constant) is not an ideal PRP and must not be used as such. I also know that $\text{ChaChaCore}(0) = 0$. Are there any other differences?
Asked
Active
Viewed 265 times
3
-
1
- I think the ChaCha(0)=0 property generalizes to all words being identical. 2) ChaCha has obvious rotational symmetries.
– CodesInChaos Mar 25 '16 at 10:21
1 Answers
7
It would be extremily surprising if the ChaCha core was a permutation (as the last P in PRP), although we have no proof it is not (if it was a permutation, it would at least be one we do not known how to invert, see this question).
A better approximation is that the ChaCha core behaves as a Pseudo-Random Function with the additional property $\text{ChaChaCore}(0)=0$. When we use as part of the input a constant secret key, the ChaCha core becomes a plausible Pseudo Random Function family.
The ChaCha core has less remarkable externally visible properties than the Salsa20 core has. $\text{ChaChaCore}(0)=0$ is a simple one. There are however others, including keeping some symmetries in the input into the output; and other properties that a true PRF would not have.
In particular: by definition, $\text{ChaChaCore}(x)=P(x)\boxplus x$ where $\boxplus$ is 512-bit addition with carry removed between 32-bit chunks, and $P$ is some public permutation (with $P(0)=0$) that can be trivially inverted. It follows that knowledge of $\text{ChaChaCore}(x)\boxminus x$ is enough to find $x$, by computing $P^{-1}(\text{ChaChaCore}(x)\boxminus x)$, where $\boxminus$ is to $\boxplus$ what subtraction is to addition.
-
1I think the OP considers ChaCha without the final addition when they talk about the core. – CodesInChaos Mar 25 '16 at 10:20
-
@CodesInChaos: perhaps the OP considers ChaCha without the final $\boxplus$; but unambiguously, the Salsa20 core includes $\boxplus$, and I see that a lot for the term Chacha core; e.g. here; here; and even arguably by the author here. – fgrieu Mar 25 '16 at 15:25
-