Expand description
XSalsa20 stream cipher (DJB, “Extending the Salsa20 nonce”).
Extension of Salsa20 (super::salsa20) to a 24-byte nonce
via the HSalsa20 subkey derivation — the Salsa20 analogue of
XChaCha20 (super::xchacha20poly1305). The larger nonce makes it
safe to pick nonces at random without a counter, and it is the
stream cipher underlying NaCl / libsodium’s crypto_secretbox
(XSalsa20-Poly1305).
§Construction
Given a 32-byte key K and a 24-byte nonce N:
subkey = HSalsa20(K, N[0..16])— a 32-byte derived key.- Run
Salsa20(subkey, N[16..24], counter)— an 8-byte nonce.
HSalsa20 runs the 20-round Salsa20 core over a state built exactly like Salsa20’s (constants on the diagonal, key in the border, the 16-byte input in the counter+nonce words) but does not add the input back and serializes only the eight “invariant” words (indices 0, 5, 10, 15 and 6, 7, 8, 9).
§Side-channel posture
XSalsa20 inherits Salsa20’s posture: pure ARX, no tables, no
secret-dependent branches or memory addressing. HSalsa20 uses the
same constant-time core (super::salsa20::rounds); the only
extra work is a fixed-position gather of eight words, which is
data-oblivious. Constant-time by construction.
§References
- D. J. Bernstein, “Extending the Salsa20 nonce” (2011). https://cr.yp.to/snuffle/xsalsa-20110204.pdf
- NaCl / libsodium
crypto_stream_xsalsa20.
Structs§
- XSalsa20
- XSalsa20 stream cipher with a 24-byte nonce.