Response to \Slid Pairs in Salsa20 and Trivium"
Daniel J. Bernstein · 2008
The paper \Slid Pairs in Salsa20 and Trivium by Priemuth-Schmid and Biryukov states various \attacks on Salsa20 and Trivium. The paper claims that \Salsa20 does not have 256-bit security, that its \attacks demonstrate a \certicational weakness in Salsa20, that \it is crucial for the security of Salsa20 that nonces are chosen at random, that the \attacks can be \exploited in certain scenarios, etc. These claims are entirely without merit. The \attacks on Salsa20 are vastly more expensive than the standard brute-force attacks discussed in the original Salsa20 documentation. (I haven’t looked at the \attacks on Trivium.) Specically, the best \attack in the paper receives ciphertexts from 2 191