<story><title>The design of Chacha20</title><url>http://loup-vaillant.fr/tutorials/chacha20-design</url></story><parent_chain><item><author>riffraff</author><text>&amp;gt; [re magic &amp;quot;expand 32-byte k&amp;quot; string] And it&amp;#x27;s readable ASCII text, so you can be pretty sure there&amp;#x27;s no back door in there.&lt;p&gt;I am not sure this matters?&lt;p&gt;I mean, facebook managed to get a reasonably nice .onion routing id (facebookcorewwwi.onion) by bruteforcing stuff right?&lt;p&gt;I can imagine bruteforcing the &amp;quot;backdoor key space&amp;quot; to find something that looks good, am I insane?</text></item></parent_chain><comment><author>sp332</author><text>They did throw &amp;gt;100,000,000 CPU-hours at it &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=11550922&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=11550922&lt;/a&gt; , but they still got extremely lucky to find such a good address. &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=8538390&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=8538390&lt;/a&gt; It&amp;#x27;s not usually that easy.</text></comment>
<story><title>The design of Chacha20</title><url>http://loup-vaillant.fr/tutorials/chacha20-design</url></story><parent_chain><item><author>riffraff</author><text>&amp;gt; [re magic &amp;quot;expand 32-byte k&amp;quot; string] And it&amp;#x27;s readable ASCII text, so you can be pretty sure there&amp;#x27;s no back door in there.&lt;p&gt;I am not sure this matters?&lt;p&gt;I mean, facebook managed to get a reasonably nice .onion routing id (facebookcorewwwi.onion) by bruteforcing stuff right?&lt;p&gt;I can imagine bruteforcing the &amp;quot;backdoor key space&amp;quot; to find something that looks good, am I insane?</text></item></parent_chain><comment><author>cwmma</author><text>If backdoored constants are easy enough to find that you are able to find them AND they are appropriate English phrases then the cipher itself is likely broken doubly so as the origional version of chacha had 2 key sizes 16-byte and 32-byte and each used the applicable constant, so in this case you would have had to have found 2 matching back doored constants.&lt;p&gt;That being said you aren&amp;#x27;t crazy this is what the nsa was accused of doing with elliptical curves though they had started with inexplicable random seeds.</text></comment>