Book: The Salsa20 family of stream ciphers

Overview
Salsa20 is a family of stream ciphers designed for high speed, simplicity, and security on general-purpose processors. It produces a pseudorandom keystream by repeatedly applying a small set of arithmetic and bitwise operations to a 512-bit internal state, enabling fast software implementation and easy verification. The design emphasizes operations that are cheap on modern CPUs, 32-bit additions, XORs, and fixed rotations, while avoiding table lookups and complex primitives that invite side channels.
The construction yields 64-byte keystream blocks from a 16-word (32-bit word) state formed from a key, a nonce, a block counter, and fixed constants. Random access to arbitrary message positions is supported by treating the block counter as part of the internal state, making Salsa20 suitable for applications that need seekable, parallelizable encryption.

Design and core operations
The cipher is built from an ARX (Addition-Rotation-XOR) design: the quarterround function mixes four 32-bit words with a compact sequence of modular additions, rotations by constant amounts, and XORs. These simple operations provide nonlinearity and diffusion without S-boxes, which both simplifies analysis and helps implementations avoid data-dependent memory accesses that could leak information through timing or cache behavior.
The core routine applies alternating column and row mixing steps to the 4x4 word state; a double-round consists of one column round followed by one row round. After a specified number of rounds the transformed state is added wordwise to the original state to produce the output block. The constants embedded in the state encode the key length and help prevent trivial symmetries.

Rounds and variants
Salsa20 is parameterized by the number of rounds, with Salsa20/20 using 20 rounds as the original, conservative setting. Reduced-round variants such as Salsa20/12 and Salsa20/8 trade some security margin for faster throughput and have been proposed for environments where speed dominates. The round structure ensures rapid diffusion: even a modest number of rounds achieves substantial mixing of input bits across the output block.
The family also supports two common key sizes by different key placement in the initial state, and uses a 64-bit nonce combined with a 64-bit block counter to permit long streams and safe nonce reuse policies when counters are correctly handled. The block-oriented nature and counter handling enable efficient parallel generation of independent keystream blocks.

Security and cryptanalysis
Security evaluations have focused on distinguishing attacks and key-recovery attempts against reduced-round variants. Best-known cryptanalytic results find practical distinguishing or key-recovery weaknesses for very small numbers of rounds, while the full 20-round Salsa20 retains a robust margin against currently known techniques. The ARX structure allows relatively straightforward differential and linear-style analyses, but amplification to full-key recovery on the full-round variant has not been demonstrated.
The design choices, no S-boxes, simple fixed rotations, and limited state size, help limit a wide class of implementation vulnerabilities. Still, correct use requires attention to nonces and counters: reusing a key–nonce pair across different messages leads to keystream reuse and loss of confidentiality, a standard caveat for stream ciphers.

Performance and implementation
Salsa20 targets high throughput in software on 32-bit and 64-bit CPUs. The operations map well to general-purpose instruction sets, enabling compact, branch-free, constant-time implementations that are resistant to timing attacks. Implementations can be vectorized or parallelized across independent blocks, and the counter-based design supports efficient random-access decryption.
Practical implementations show strong performance relative to contemporaneous stream ciphers and many block-cipher-based modes, particularly on CPUs where table-based ciphers suffer from cache effects. The straightforward core makes formal proofs of constant-time behavior and low code complexity easier to achieve.

Impact and applications
Salsa20 influenced later cipher designs and became a practical choice for cryptographic libraries and protocols that value speed and simplicity. It forms part of NaCl-style cryptographic toolkits and inspired variants such as ChaCha, which retain the ARX approach while modifying rotation constants and mixing patterns. Adoption in real-world systems has highlighted Salsa20's balance of performance and security, making it a notable alternative to traditional block-cipher-based stream constructions.