Skip to main content
Cryptography

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

4
  • $\begingroup$ Perhaps you should note that Salsa20 is a PRF, so you can continue using it safely right up until the point where the counter wraps. When using a PRP like AES on the other hand, going through a significant fraction of the counter leads to revealing a fraction of the codebook, which is not an issue for a PRF like Salsa20. $\endgroup$ Commented Apr 19, 2019 at 1:06
  • $\begingroup$ @forest So noted! $\endgroup$ Commented Apr 19, 2019 at 3:49
  • $\begingroup$ So it's an obvious and well known 'problem?', but we don't base any recommendations on it because we do not expect it to cause big issues. And yes, there are many authenticated encryption methods where this has less impact. $\endgroup$ Commented Apr 24, 2019 at 12:39
  • $\begingroup$ @SapChicken Pretty much. Read any paper on the security in the literature, like the AES-GCM paper (or a corrected paper for the case of non-96-bit nonces), and you'll find a quantitative statement of bounds on the adversary's advantage which can easily be translated into safe data volumes. But, sometimes this gets lost in translation to API documentation and standards documents. That's justifiable when the limits are unimaginably huge, but less so for, e.g., AES-GCM. $\endgroup$ Commented Apr 24, 2019 at 14:29