I think it's an interesting idea, but I admit I'm a bit surprised at the choice of ChaCha20. The related Salsa20 algorithm has received far more public analysis and while ChaCha20 has some interesting (if minor) performance and theoretical security improvements, but they don't seem worth giving up the assurance you get from the extra review of Salsa20.
I agree that ChaCha seems like a better function (designed for faster diffusion, better block layout, etc), and it is comforting that fewer ChaCha rounds can be attacked with the same attacks that apply to Salsa. But ChaCha does still represent a substantial change in the core function from Salsa, and I do wonder if it's possible those changes introduce a problem not found in Salsa. To be honest, I really suspect the answer is no, and that ChaCha is a good choice...just surprising given the relative interest in Salsa compared to ChaCha. But maybe your choice will also spur more people to consider ChaCha for both usage and further cryptanalysis.
Comments
I think it's an interesting idea, but I admit I'm a bit surprised at the choice of ChaCha20. The related Salsa20 algorithm has received far more public analysis and while ChaCha20 has some interesting (if minor) performance and theoretical security improvements, but they don't seem worth giving up the assurance you get from the extra review of Salsa20.
The feeling seems to be that the analysis of Salsa carries to ChaCha and that ChaCha is slightly preferable: http://www.ietf.org/mail-archive/web/tls/current/msg10222.ht...
I started out with Salsa but switched because I also slight prefer ChaCha and people seemed to agree.
I agree that ChaCha seems like a better function (designed for faster diffusion, better block layout, etc), and it is comforting that fewer ChaCha rounds can be attacked with the same attacks that apply to Salsa. But ChaCha does still represent a substantial change in the core function from Salsa, and I do wonder if it's possible those changes introduce a problem not found in Salsa. To be honest, I really suspect the answer is no, and that ChaCha is a good choice...just surprising given the relative interest in Salsa compared to ChaCha. But maybe your choice will also spur more people to consider ChaCha for both usage and further cryptanalysis.
One positive is the indirect attention it has received through BLAKE and BLAKE2, where it has done extremely well.