[Draft] Implement a fast-key-erasure ChaCha variant - #578
Draft
dhardy wants to merge 3 commits into
Draft
Conversation
This was referenced Aug 20, 2026
tarcieri
reviewed
Aug 22, 2026
| // The counter is incremented like usual (i.e. it is not reset). | ||
| fn generate(&mut self, buffer: &mut [u32; BUFFER_SIZE]) -> usize { | ||
| let _ = self.0.generate(buffer); | ||
| self.0.state[4..12].copy_from_slice(&buffer[0..8]); |
Member
There was a problem hiding this comment.
While this overwrites the original value, doesn't it also leave the newly generated key in the output buffer?
Member
There was a problem hiding this comment.
Aah, is that what this is intended to address? rust-random/rand_core#81
Contributor
Author
There was a problem hiding this comment.
While this overwrites the original value, doesn't it also leave the newly generated key in the output buffer?
Yes. We could erase it immediately but I didn't see the point: the output buffer should be right next to the key in memory and will be overwritten next time output is generated (the next key update).
Yes, it's related to that PR; see also rust-random/rand#1828 for context.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivated by rust-random/rand#1826 (comment), I wanted to see if we could support a fast-key-erasure generator. Yes, I believe we can, and without much code.
Performance penalty: 12-13% for 1kiB blocks, 20-25% for single
u32values.Details
There are two parts to this:
I believe this is all that's required for forward security.
Reseeding?
As noted here, forward security (backtracking resistance) arguably has more value than "backward security" (reseeding) since if an attacker has compromised the system state, there is reason to believe they may be able to do so again. On the other hand, periodic reseeding may be useful for other reasons, e.g. if a process is forked without explicit reseeding (i.e. a bug).
Anyway, there is no reason we can't layer one on top of the other.