Module salsa20 

Salsa20 stream cipher (Bernstein, eSTREAM / DJB spec).

The original ARX stream cipher from the eSTREAM portfolio, and the direct ancestor of ChaCha20 (super::chacha20). Salsa20 uses the same “expand 32-byte k” / “expand 16-byte k” constants, a 4×4 u32 state, and 20 rounds (10 double-rounds), but with a different quarter-round and a different word layout (constants on the diagonal, key on two rows, counter+nonce on a row).

This is the DJB / eSTREAM variant, not the IETF one: the nonce is 8 bytes and the block counter is a 64-bit little-endian value stored in the two words that follow the nonce. The keystream block is 64 bytes. Both the 256-bit and 128-bit key sizes are supported (matching the two sets of expansion constants); see Salsa20::new and Salsa20::new_128.

Salsa20 is still used, mostly through XSalsa20 (super::xsalsa20) and the NaCl / libsodium secretbox construction, which pairs XSalsa20 with Poly1305.

Layout

state (4x4 u32 little-endian):

  const  key    key    key
  key    const  nonce  nonce
  ctr    ctr    const  key
  key    key    key    const

The four constant words sit on the diagonal (indices 0, 5, 10, 15); the key fills the eight off-diagonal border words; the 8-byte nonce is at words 6, 7 and the 64-bit block counter at words 8, 9.

Each 64-byte block is computed as serialize(rounds(state) ⊞ state), exactly the structure of ChaCha20 but with the Salsa20 quarter-round and column/row ordering. Successive blocks increment the 64-bit counter.

Side-channel posture

Salsa20 is a pure ARX design: every operation is a 32-bit add, XOR, or constant-distance rotate on public-position words. There are no table lookups, no secret-dependent branches, and no secret-dependent memory addressing. The key and counter only ever flow through add/xor/rotate, so the core and the keystream application are constant-time (data-oblivious) by construction — the same posture as ChaCha20 and the reason both are preferred over table-based AES on shared-cache targets.

The block-counter loop bound in Salsa20::apply_keystream depends only on the (public) message length, not on any secret.

References

• D. J. Bernstein, “The Salsa20 family of stream ciphers”, in New Stream Cipher Designs (2008); “Salsa20 specification” (eSTREAM, 2005). https://cr.yp.to/snuffle/spec.pdf
• eSTREAM “verified.test-vectors” ECRYPT test suite.

Structs

Salsa20

Salsa20 stream cipher state (DJB / eSTREAM variant).