The design of Chacha20
This is solid but might miss the forest for the trees.<p>If you want to understand Chacha&#x2F;Salsa, the best way to start is that it&#x27;s an <i>ARX-based</i> <i>hash function</i>, <i>keyed</i>, running in <i>counter mode</i>.<p>ARX stands for addition, rotation, and XOR, which are the three operations ARX designs are composed of. Addition is nonlinear in the context of ARX, which eliminates the need for S-boxes (or complex alternatives to S-boxes) and makes it easier to build constant time crypto. You can make any function out of just A, R, and X (technically, any function out of A and R, but less efficiently). A good place to start understanding why you want rotation and nonlinearity is the Wikipedia page for SP Networks:<p><a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Substitution-permutation_network" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Substitution-permutation_netwo...</a><p>Another good bit of background is the old idea of iterated ciphers (round functions run repeatedly, rather than one giant cipher function), and the slightly more modern idea that it&#x27;s better to have a very simple round function you repeat a lot than a complicated round function you run fewer times. When you get this you can start grokking design decisions in terms of how many rounds they shave off your design to achieve the same security (which also might get you back to why you have X in addition to A and R).<p>The Salsa20 core is a very simple hash function designed to be fast and flexible for multiple constructions. Bernstein designed the stream cipher we all know based on it, and also Rumba20, which is a more tradition collision-resistant cryptographic hash. Designing ciphers out of hash functions has been a research interest of Bernstein&#x27;s since the 1990s, when hash functions were approved for export but ciphers not.<p>A keyed hash (also: PRF) is a hash function that takes a secret key input. In a general-purpose hash like SHA3, you provide the key along with the rest of the input by simple concatenation. Fun true fact: in SHA-2 and hashes before that, it was unsafe to do this, which is why we have the HMAC construction, which SHA-3 and Blake2 obsolete. At any rate, Salsa20 takes the key as a special parameter and encodes it into a block.<p>Counter mode is conventionally a method for turning a block cipher into a stream cipher. In 2017 its widely seen as the most important and primary way you should use block ciphers (if you&#x27;re not using an AEAD, most of which are built on counter mode in some way). Counter mode is super simple: you encrypt a counter of some sort and XOR the resulting block with your plaintext. To decrypt, you do the same thing.<p>A really good place to start learning about Salsa20 (and thus Chacha20) is Bernstein&#x27;s design paper, which is extremely readable and easy to skim:<p><a href="https:&#x2F;&#x2F;cr.yp.to&#x2F;snuffle&#x2F;design.pdf" rel="nofollow">https:&#x2F;&#x2F;cr.yp.to&#x2F;snuffle&#x2F;design.pdf</a>