18.3 ChaCha20
ChaCha20 is a fast block cipher defined in RFC 8439 ChaCha20 and Poly1305 for IETF Protocols [131]. The number 20 in the cipher’s name refers to a specific ChaCha variant that uses 20 rounds or, equivalently, 80 quarter rounds to compute the ciphertext.
ChaCha20’s state is stored in a 4 by 4 matrix consisting of 32-bit unsigned integers. The state representation using a matrix explains why some ChaCha rounds are referred to as column rounds while others are referred to as diagonal rounds:
0 1 2 3
4 5 6 7
8 9 10 11
12 13 14 1518.3.1 ChaCha20 quarter round
The ChaCha20 algorithm’s basic operation is the so-called quarter round. The quarter round operates on four elements of the ChaCha20 state, hence the name. The four elements are denoted as a, b, c, and d and the quarter round is defined as:
where ≪ n denotes the rotate left by n bits operation, for example:
The ChaCha20 quarter round is illustrated in Figure&...