Re: [PATCH] random: add chacha8_block and swtich the rng to it

[Eric Biggers <ebiggers@kernel.org>]

On Mon, Apr 29, 2024 at 07:48:49AM -0600, Aaron Toponce wrote:
> According to Jean-Philippe Aumasson in his paper "Too Much Crypto" [1]:
> 
> > "The best result on ChaCha is a key recovery attack on the 7-round version
> > with 2^237.7 time complexity using output data from 2^96 instances of ChaCha,
> > that is, 2^105 bytes of data."
> 
> He then proposes that ChaCha use 8 rounds instead of 20, providing a 2.5x
> speed-up. As such, this patch adds chacha8_block and chacha12_block and switches
> the RNG from ChaCha20 to ChaCha8 to take advantage of that efficiency without
> sacrificing security.
> 

I don't think there is consensus on ChaCha8 being recommended.  Adiantum uses
ChaCha12, but even that received some pushback.

The Linux RNG is also usually used only for small amounts of data, and its
security (and the perception of its security) is extremely important.

So just staying with ChaCha20 seems appropriate.

Note also that currently the Linux RNG is using a portable C implementation of
ChaCha20.  If there is actually a desire to accelerate large reads (which again,
aren't the main use case of the Linux RNG), it would be possible to use a SIMD
implementation of ChaCha20, which already exists in the kernel.  That would
speed up ChaCha20 by roughly 2-5x depending on the CPU.

- Eric