Adiantum: encryption for the low end

Re:Adiantum: encryption for the low end by AnaniasAnanas on Friday January 25, 2019 @03:58PM (#19002426)

> Two rounds of XChaCha12 are followed by an AES-256 encryption, but of just 16 bytes

I am not a cryptographer so I am a bit clueless on topics like this but I am wondering, why are they doing this? Does this provide any significant benefit to just chacha12 or chacha12 + poly1305?

[ Parent | on HN ]

Re:Adiantum: encryption for the low end by coolspot on Friday January 25, 2019 @06:54PM (#19003743)

I was curious too, found answer in comments of original publication:

> Normally there is just one XChaCha12 invocation per encryption or decryption. There's another to derive subkeys, but that's only needed when setting a new key.

[ Parent | on HN ]

Re:Adiantum: encryption for the low end by AnaniasAnanas on Friday January 25, 2019 @08:13PM (#19004061)

I don't understand why they use AES though.

[ Parent | on HN ]