Salsa20

eSTREAM selection of Salsa20

Salsa20/12 has been selected as a Phase 3 design for Profile 1 (software) by the eSTREAM project, receiving the highest weighted voting score of any Profile 1 algorithm at the end of Phase 2. Salsa20 had previously been selected as a Phase 2 Focus design for Profile 1 (software) and as a Phase 2 design for Profile 2 (hardware) by the eSTREAM project, but was not advanced to Phase 3 for Profile 2 because eSTREAM felt that it was probably not a good candidate for extremely resource-constrained hardware environments.

The eSTREAM committee recommends the use of Salsa20/12, the 12-round variant, for "combining very good performance with a comfortable margin of security."

Cryptanalysis of Salsa20

As of 2015, there are no published attacks on Salsa20/12 or the full Salsa20/20; the best attack known breaks 8 of the 12 or 20 rounds.

In 2005, Paul Crowley reported an attack on Salsa20/5 with an estimated time complexity of 2¹⁶⁵ and won Bernstein's US$1000 prize for "most interesting Salsa20 cryptanalysis". This attack and all subsequent attacks are based on truncated differential cryptanalysis. In 2006, Fischer, Meier, Berbain, Biasse, and Robshaw reported an attack on Salsa20/6 with estimated time complexity of 2¹⁷⁷, and a related-key attack on Salsa20/7 with estimated time complexity of 2²¹⁷.

In 2007, Tsunoo et al. announced a cryptanalysis of Salsa20 which breaks 8 out of 20 rounds to recover the 256-bit secret key in 2²⁵⁵ operations, using 2^11.37 keystream pairs. However, this attack does not seem to be competitive with the brute force attack.

In 2008, Aumasson, Fischer, Khazaei, Meier, and Rechberger reported a cryptanalytic attack against Salsa20/7 with a time complexity of 2¹⁵¹, and they reported an attack against Salsa20/8 with an estimated time complexity of 2²⁵¹. This attack makes use of the new concept of probabilistic neutral key bits for probabilistic detection of a truncated differential. The attack can be adapted to break Salsa20/7 with a 128-bit key.

In 2012, the attack by Aumasson et al. was improved by Shi et al. against Salsa20/7 (128-bit key) to a time complexity of 2¹⁰⁹ and Salsa20/8 (256-bit key) to 2²⁵⁰.

In 2013, Mouha and Preneel published a proof that 15 rounds of Salsa20 was 128-bit secure against differential cryptanalysis. (Specifically, it has no differential characteristic with higher probability than 2⁻¹³⁰, so differential cryptanalysis would be more difficult than 128-bit key exhaustion.)

In 2025, Dey et al. reported a cryptanalytic attack against Salsa20/8 with a time complexity of 2^245.84 and data amounting to 2^99.47.

ChaCha variant

In 2008, Bernstein published the closely related ChaCha family of ciphers, which aim to increase the diffusion per round while achieving the same or slightly better performance. The Aumasson et al. paper also attacks ChaCha, achieving one round fewer (for 256-bit ChaCha6 with complexity 2¹³⁹, ChaCha7 with complexity 2²⁴⁸, and 128-bit ChaCha6 within 2¹⁰⁷) but claims that the attack fails to break 128-bit ChaCha7.

Like Salsa20, ChaCha's initial state includes a 128-bit constant, a 256-bit key, a 64-bit counter, and a 64-bit nonce (in the original version; as described later, a version of ChaCha from RFC 7539 is slightly different), arranged as a 4×4 matrix of 32-bit words. But ChaCha re-arranges some of the words in the initial state:

The constant is the same as Salsa20 ("expand 32-byte k"). ChaCha replaces the Salsa20 quarter-round QR(a, b, c, d) with:

a += b; d ^= a; d <<<= 16; c += d; b ^= c; b <<<= 12; a += b; d ^= a; d <<<= 8; c += d; b ^= c; b <<<= 7;

Notice that this version updates each word twice, while Salsa20's quarter round updates each word only once. In addition, the ChaCha quarter-round diffuses changes more quickly. On average, after changing 1 input bit the Salsa20 quarter-round will change 8 output bits while ChaCha will change 12.5 output bits.

The ChaCha quarter round has the same number of adds, xors, and bit rotates as the Salsa20 quarter-round, but the fact that two of the rotates are multiples of 8 allows for a small optimization on some architectures including x86. Additionally, the input formatting has been rearranged to support an efficient SSE implementation optimization discovered for Salsa20. Rather than alternating rounds down columns and across rows, they are performed down columns and along diagonals. Like Salsa20, ChaCha arranges the sixteen 32-bit words in a 4×4 matrix. If we index the matrix elements from 0 to 15

then a double round in ChaCha is:

// Odd round QR(0, 4, 8, 12) // column 1 QR(1, 5, 9, 13) // column 2 QR(2, 6, 10, 14) // column 3 QR(3, 7, 11, 15) // column 4 // Even round QR(0, 5, 10, 15) // diagonal 1 (main diagonal) QR(1, 6, 11, 12) // diagonal 2 QR(2, 7, 8, 13) // diagonal 3 QR(3, 4, 9, 14) // diagonal 4

ChaCha20 uses 10 iterations of the double round. An implementation in C/C++ appears below.

<span id="mwArM"></span><span class="cp" id="mwArQ">#include</span><span class="w" id="mwArU"> </span><span class="cpf" id="mwArY"><stdint.h></span> <span class="cp" id="mwArc">#define ROTL(a,b) (((a) << (b)) | ((a) >> (32 - (b))))</span> <span class="cp" id="mwArg">#define QR(a, b, c, d) ( \</span> <span class="cp" id="mwArk"> a += b, d ^= a, d = ROTL(d, 16), \</span> <span class="cp" id="mwAro"> c += d, b ^= c, b = ROTL(b, 12), \</span> <span class="cp" id="mwArs"> a += b, d ^= a, d = ROTL(d, 8), \</span> <span class="cp" id="mwArw"> c += d, b ^= c, b = ROTL(b, 7))</span> <span class="cp" id="mwAr0">#define ROUNDS 20</span> <span class="kt" id="mwAr4">void</span><span class="w" id="mwAr8"> </span><span class="nf" id="mwAsA">chacha_block</span><span class="p" id="mwAsE">(</span><span class="kt" id="mwAsI">uint32_t</span><span class="w" id="mwAsM"> </span><span class="n" id="mwAsQ">out</span><span class="p" id="mwAsU">[</span><span class="mi" id="mwAsY">16</span><span class="p" id="mwAsc">],</span><span class="w" id="mwAsg"> </span><span class="kt" id="mwAsk">uint32_t</span><span class="w" id="mwAso"> </span><span class="k" id="mwAss">const</span><span class="w" id="mwAsw"> </span><span class="n" id="mwAs0">in</span><span class="p" id="mwAs4">[</span><span class="mi" id="mwAs8">16</span><span class="p" id="mwAtA">])</span> <span class="p" id="mwAtE">{</span> <span class="w" id="mwAtI"> </span><span class="kt" id="mwAtM">int</span><span class="w" id="mwAtQ"> </span><span class="n" id="mwAtU">i</span><span class="p" id="mwAtY">;</span> <span class="w" id="mwAtc"> </span><span class="kt" id="mwAtg">uint32_t</span><span class="w" id="mwAtk"> </span><span class="n" id="mwAto">x</span><span class="p" id="mwAts">[</span><span class="mi" id="mwAtw">16</span><span class="p" id="mwAt0">];</span> <span class="w" id="mwAt4"> </span><span class="k" id="mwAt8">for</span><span class="w" id="mwAuA"> </span><span class="p" id="mwAuE">(</span><span class="n" id="mwAuI">i</span><span class="w" id="mwAuM"> </span><span class="o" id="mwAuQ">=</span><span class="w" id="mwAuU"> </span><span class="mi" id="mwAuY">0</span><span class="p" id="mwAuc">;</span><span class="w" id="mwAug"> </span><span class="n" id="mwAuk">i</span><span class="w" id="mwAuo"> </span><span class="o" id="mwAus"><</span><span class="w" id="mwAuw"> </span><span class="mi" id="mwAu0">16</span><span class="p" id="mwAu4">;</span><span class="w" id="mwAu8"> </span><span class="o" id="mwAvA">++</span><span class="n" id="mwAvE">i</span><span class="p" id="mwAvI">)</span> <span class="w" id="mwAvM"> </span><span class="n" id="mwAvQ">x</span><span class="p" id="mwAvU">[</span><span class="n" id="mwAvY">i</span><span class="p" id="mwAvc">]</span><span class="w" id="mwAvg"> </span><span class="o" id="mwAvk">=</span><span class="w" id="mwAvo"> </span><span class="n" id="mwAvs">in</span><span class="p" id="mwAvw">[</span><span class="n" id="mwAv0">i</span><span class="p" id="mwAv4">];</span> <span class="w" id="mwAv8"> </span><span class="c1" id="mwAwA">// 10 loops × 2 rounds/loop = 20 rounds</span> <span class="w" id="mwAwE"> </span><span class="k" id="mwAwI">for</span><span class="w" id="mwAwM"> </span><span class="p" id="mwAwQ">(</span><span class="n" id="mwAwU">i</span><span class="w" id="mwAwY"> </span><span class="o" id="mwAwc">=</span><span class="w" id="mwAwg"> </span><span class="mi" id="mwAwk">0</span><span class="p" id="mwAwo">;</span><span class="w" id="mwAws"> </span><span class="n" id="mwAww">i</span><span class="w" id="mwAw0"> </span><span class="o" id="mwAw4"><</span><span class="w" id="mwAw8"> </span><span class="n" id="mwAxA">ROUNDS</span><span class="p" id="mwAxE">;</span><span class="w" id="mwAxI"> </span><span class="n" id="mwAxM">i</span><span class="w" id="mwAxQ"> </span><span class="o" id="mwAxU">+=</span><span class="w" id="mwAxY"> </span><span class="mi" id="mwAxc">2</span><span class="p" id="mwAxg">)</span><span class="w" id="mwAxk"> </span><span class="p" id="mwAxo">{</span> <span class="w" id="mwAxs"> </span><span class="c1" id="mwAxw">// Odd round</span> <span class="w" id="mwAx0"> </span><span class="n" id="mwAx4">QR</span><span class="p" id="mwAx8">(</span><span class="n" id="mwAyA">x</span><span class="p" id="mwAyE">[</span><span class="mi" id="mwAyI">0</span><span class="p" id="mwAyM">],</span><span class="w" id="mwAyQ"> </span><span class="n" id="mwAyU">x</span><span class="p" id="mwAyY">[</span><span class="mi" id="mwAyc">4</span><span class="p" id="mwAyg">],</span><span class="w" id="mwAyk"> </span><span class="n" id="mwAyo">x</span><span class="p" id="mwAys">[</span><span class="w" id="mwAyw"> </span><span class="mi" id="mwAy0">8</span><span class="p" id="mwAy4">],</span><span class="w" id="mwAy8"> </span><span class="n" id="mwAzA">x</span><span class="p" id="mwAzE">[</span><span class="mi" id="mwAzI">12</span><span class="p" id="mwAzM">]);</span><span class="w" id="mwAzQ"> </span><span class="c1" id="mwAzU">// column 1</span> <span class="w" id="mwAzY"> </span><span class="n" id="mwAzc">QR</span><span class="p" id="mwAzg">(</span><span class="n" id="mwAzk">x</span><span class="p" id="mwAzo">[</span><span class="mi" id="mwAzs">1</span><span class="p" id="mwAzw">],</span><span class="w" id="mwAz0"> </span><span class="n" id="mwAz4">x</span><span class="p" id="mwAz8">[</span><span class="mi" id="mwA0A">5</span><span class="p" id="mwA0E">],</span><span class="w" id="mwA0I"> </span><span class="n" id="mwA0M">x</span><span class="p" id="mwA0Q">[</span><span class="w" id="mwA0U"> </span><span class="mi" id="mwA0Y">9</span><span class="p" id="mwA0c">],</span><span class="w" id="mwA0g"> </span><span class="n" id="mwA0k">x</span><span class="p" id="mwA0o">[</span><span class="mi" id="mwA0s">13</span><span class="p" id="mwA0w">]);</span><span class="w" id="mwA00"> </span><span class="c1" id="mwA04">// column 2</span> <span class="w" id="mwA08"> </span><span class="n" id="mwA1A">QR</span><span class="p" id="mwA1E">(</span><span class="n" id="mwA1I">x</span><span class="p" id="mwA1M">[</span><span class="mi" id="mwA1Q">2</span><span class="p" id="mwA1U">],</span><span class="w" id="mwA1Y"> </span><span class="n" id="mwA1c">x</span><span class="p" id="mwA1g">[</span><span class="mi" id="mwA1k">6</span><span class="p" id="mwA1o">],</span><span class="w" id="mwA1s"> </span><span class="n" id="mwA1w">x</span><span class="p" id="mwA10">[</span><span class="mi" id="mwA14">10</span><span class="p" id="mwA18">],</span><span class="w" id="mwA2A"> </span><span class="n" id="mwA2E">x</span><span class="p" id="mwA2I">[</span><span class="mi" id="mwA2M">14</span><span class="p" id="mwA2Q">]);</span><span class="w" id="mwA2U"> </span><span class="c1" id="mwA2Y">// column 3</span> <span class="w" id="mwA2c"> </span><span class="n" id="mwA2g">QR</span><span class="p" id="mwA2k">(</span><span class="n" id="mwA2o">x</span><span class="p" id="mwA2s">[</span><span class="mi" id="mwA2w">3</span><span class="p" id="mwA20">],</span><span class="w" id="mwA24"> </span><span class="n" id="mwA28">x</span><span class="p" id="mwA3A">[</span><span class="mi" id="mwA3E">7</span><span class="p" id="mwA3I">],</span><span class="w" id="mwA3M"> </span><span class="n" id="mwA3Q">x</span><span class="p" id="mwA3U">[</span><span class="mi" id="mwA3Y">11</span><span class="p" id="mwA3c">],</span><span class="w" id="mwA3g"> </span><span class="n" id="mwA3k">x</span><span class="p" id="mwA3o">[</span><span class="mi" id="mwA3s">15</span><span class="p" id="mwA3w">]);</span><span class="w" id="mwA30"> </span><span class="c1" id="mwA34">// column 4</span> <span class="w" id="mwA38"> </span><span class="c1" id="mwA4A">// Even round</span> <span class="w" id="mwA4E"> </span><span class="n" id="mwA4I">QR</span><span class="p" id="mwA4M">(</span><span class="n" id="mwA4Q">x</span><span class="p" id="mwA4U">[</span><span class="mi" id="mwA4Y">0</span><span class="p" id="mwA4c">],</span><span class="w" id="mwA4g"> </span><span class="n" id="mwA4k">x</span><span class="p" id="mwA4o">[</span><span class="mi" id="mwA4s">5</span><span class="p" id="mwA4w">],</span><span class="w" id="mwA40"> </span><span class="n" id="mwA44">x</span><span class="p" id="mwA48">[</span><span class="mi" id="mwA5A">10</span><span class="p" id="mwA5E">],</span><span class="w" id="mwA5I"> </span><span class="n" id="mwA5M">x</span><span class="p" id="mwA5Q">[</span><span class="mi" id="mwA5U">15</span><span class="p" id="mwA5Y">]);</span><span class="w" id="mwA5c"> </span><span class="c1" id="mwA5g">// diagonal 1 (main diagonal)</span> <span class="w" id="mwA5k"> </span><span class="n" id="mwA5o">QR</span><span class="p" id="mwA5s">(</span><span class="n" id="mwA5w">x</span><span class="p" id="mwA50">[</span><span class="mi" id="mwA54">1</span><span class="p" id="mwA58">],</span><span class="w" id="mwA6A"> </span><span class="n" id="mwA6E">x</span><span class="p" id="mwA6I">[</span><span class="mi" id="mwA6M">6</span><span class="p" id="mwA6Q">],</span><span class="w" id="mwA6U"> </span><span class="n" id="mwA6Y">x</span><span class="p" id="mwA6c">[</span><span class="mi" id="mwA6g">11</span><span class="p" id="mwA6k">],</span><span class="w" id="mwA6o"> </span><span class="n" id="mwA6s">x</span><span class="p" id="mwA6w">[</span><span class="mi" id="mwA60">12</span><span class="p" id="mwA64">]);</span><span class="w" id="mwA68"> </span><span class="c1" id="mwA7A">// diagonal 2</span> <span class="w" id="mwA7E"> </span><span class="n" id="mwA7I">QR</span><span class="p" id="mwA7M">(</span><span class="n" id="mwA7Q">x</span><span class="p" id="mwA7U">[</span><span class="mi" id="mwA7Y">2</span><span class="p" id="mwA7c">],</span><span class="w" id="mwA7g"> </span><span class="n" id="mwA7k">x</span><span class="p" id="mwA7o">[</span><span class="mi" id="mwA7s">7</span><span class="p" id="mwA7w">],</span><span class="w" id="mwA70"> </span><span class="n" id="mwA74">x</span><span class="p" id="mwA78">[</span><span class="w" id="mwA8A"> </span><span class="mi" id="mwA8E">8</span><span class="p" id="mwA8I">],</span><span class="w" id="mwA8M"> </span><span class="n" id="mwA8Q">x</span><span class="p" id="mwA8U">[</span><span class="mi" id="mwA8Y">13</span><span class="p" id="mwA8c">]);</span><span class="w" id="mwA8g"> </span><span class="c1" id="mwA8k">// diagonal 3</span> <span class="w" id="mwA8o"> </span><span class="n" id="mwA8s">QR</span><span class="p" id="mwA8w">(</span><span class="n" id="mwA80">x</span><span class="p" id="mwA84">[</span><span class="mi" id="mwA88">3</span><span class="p" id="mwA9A">],</span><span class="w" id="mwA9E"> </span><span class="n" id="mwA9I">x</span><span class="p" id="mwA9M">[</span><span class="mi" id="mwA9Q">4</span><span class="p" id="mwA9U">],</span><span class="w" id="mwA9Y"> </span><span class="n" id="mwA9c">x</span><span class="p" id="mwA9g">[</span><span class="w" id="mwA9k"> </span><span class="mi" id="mwA9o">9</span><span class="p" id="mwA9s">],</span><span class="w" id="mwA9w"> </span><span class="n" id="mwA90">x</span><span class="p" id="mwA94">[</span><span class="mi" id="mwA98">14</span><span class="p" id="mwA-A">]);</span><span class="w" id="mwA-E"> </span><span class="c1" id="mwA-I">// diagonal 4</span> <span class="w" id="mwA-M"> </span><span class="p" id="mwA-Q">}</span> <span class="w" id="mwA-U"> </span><span class="k" id="mwA-Y">for</span><span class="w" id="mwA-c"> </span><span class="p" id="mwA-g">(</span><span class="n" id="mwA-k">i</span><span class="w" id="mwA-o"> </span><span class="o" id="mwA-s">=</span><span class="w" id="mwA-w"> </span><span class="mi" id="mwA-0">0</span><span class="p" id="mwA-4">;</span><span class="w" id="mwA-8"> </span><span class="n" id="mwA_A">i</span><span class="w" id="mwA_E"> </span><span class="o" id="mwA_I"><</span><span class="w" id="mwA_M"> </span><span class="mi" id="mwA_Q">16</span><span class="p" id="mwA_U">;</span><span class="w" id="mwA_Y"> </span><span class="o" id="mwA_c">++</span><span class="n" id="mwA_g">i</span><span class="p" id="mwA_k">)</span> <span class="w" id="mwA_o"> </span><span class="n" id="mwA_s">out</span><span class="p" id="mwA_w">[</span><span class="n" id="mwA_0">i</span><span class="p" id="mwA_4">]</span><span class="w" id="mwA_8"> </span><span class="o" id="mwBAA">=</span><span class="w" id="mwBAE"> </span><span class="n" id="mwBAI">x</span><span class="p" id="mwBAM">[</span><span class="n" id="mwBAQ">i</span><span class="p" id="mwBAU">]</span><span class="w" id="mwBAY"> </span><span class="o" id="mwBAc">+</span><span class="w" id="mwBAg"> </span><span class="n" id="mwBAk">in</span><span class="p" id="mwBAo">[</span><span class="n" id="mwBAs">i</span><span class="p" id="mwBAw">];</span> <span class="p" id="mwBA0">}</span>

ChaCha is the basis of the BLAKE hash function, a finalist in the NIST hash function competition, and its faster successors BLAKE2 and BLAKE3. It also defines a variant using sixteen 64-bit words (1024 bits of state), with correspondingly adjusted rotation constants.

XChaCha

Although not announced by Bernstein, the security proof of XSalsa20 extends straightforwardly to an analogous XChaCha cipher. Use the key and the first 128 bits of the nonce (in input words 12 through 15) to form a ChaCha input block, then perform the block operation (omitting the final addition). Output words 0–3 and 12–15 (those words corresponding to non-key words of the input) then form the key used for ordinary ChaCha (with the last 64 bits of nonce and 64 bits of block counter).

Reduced-round ChaCha

Aumasson argues in 2020 that 8 rounds of ChaCha (ChaCha8) probably provides enough resistance to future cryptanalysis for the same security level, yielding a 2.5× speedup. A compromise ChaCha12 (based on the eSTREAM recommendation of a 12-round Salsa) also sees some use. The eSTREAM benchmarking suite includes ChaCha8 and ChaCha12.

ChaCha20 adoption

Google had selected ChaCha20 along with Bernstein's Poly1305 message authentication code in SPDY, which was intended as a replacement for TLS over TCP. In the process, they proposed a new authenticated encryption construction combining both algorithms, which is called ChaCha20-Poly1305. ChaCha20 and Poly1305 are now used in the QUIC protocol, which replaces SPDY and is used by HTTP/3.

Shortly after Google's adoption for TLS, both the ChaCha20 and Poly1305 algorithms were also used for a new [email protected] cipher in OpenSSH. Subsequently, this made it possible for OpenSSH to avoid any dependency on OpenSSL, via a compile-time option.

ChaCha20 is also used for the arc4random random number generator in FreeBSD, OpenBSD, and NetBSD operating systems, instead of the broken RC4, and in DragonFly BSD for the CSPRNG subroutine of the kernel. Starting from version 4.8, the Linux kernel uses the ChaCha20 algorithm to generate data for the nonblocking /dev/urandom device. ChaCha8 is used for the default PRNG in Golang. Rust's CSPRNG uses ChaCha12.

ChaCha20 usually offers better performance than the more prevalent Advanced Encryption Standard (AES) algorithm on systems where the CPU does not feature AES acceleration (such as the AES instruction set for x86 processors). As a result, ChaCha20 is sometimes preferred over AES in certain use cases involving mobile devices, which mostly use ARM-based CPUs. Specialized hardware accelerators for ChaCha20 are also less complex compared to AES accelerators.

ChaCha20-Poly1305 (IETF version; see below) is the exclusive algorithm used by the WireGuard VPN system, as of protocol version 1.

Adiantum (cipher) uses XChaCha12.

Internet standards

An implementation reference for ChaCha20 has been published in RFC 7539. The IETF's implementation modified Bernstein's published algorithm by changing the 64-bit nonce and 64-bit block counter to a 96-bit nonce and 32-bit block counter. The name was not changed when the algorithm was modified, as it is cryptographically insignificant (both form what a cryptographer would recognize as a 128-bit nonce), but the interface change could be a source of confusion for developers. Because of the reduced block counter, the maximum message length that can be safely encrypted by the IETF's variant is 2³² blocks of 64 bytes (256 GiB). For applications where this is not enough, such as file or disk encryption, RFC 7539 proposes using the original algorithm with 64-bit nonce.

Use of ChaCha20 in IKE and IPsec has been standardized in RFC 7634. Standardization of its use in TLS is published in RFC 7905.

In 2018, RFC 7539 was obsoleted by RFC 8439. RFC 8439 merges in some errata and adds additional security considerations.