On Tue, Apr 22, 2014 at 11:59:38PM -0400, Thor Lancelot Simon wrote: > I believe ChaCha8 is suitable for our purpose: we were previously considering > ciphers with, at most, 128-bit security, and even 6-round ChaCha has 139-bit > strength against the best currently known attack (at present, there is no > attack better than brute force on ChaCha8, and the best attack on ChaCha7 > is 2^248). ChaCha8 appears to be somewhat faster than the old arc4 > implementation.
Sounds wrong. When I measured Salsa20/8, it was ~3 times faster than RC4. Code can be found at http://www.netbsd.org/~joerg/arc4random_salsa.c. Joerg