The article does mention that he created the ChaCha20 algorithm, and that he first characterized the timing side channel attack, but his extremely small, simple and fast source libraries are publicly available.
They are fully self contained, no dependencies, and small enough to easily include in small-ish embedded systems:
Elliptic curve vulnerability to quantum computing is discussed here:
DISCLAIMER: I'm not a crypto expert, just an occasional user
DJB has been at the forefront of advancing crypto for decades, and has a very strong emphasis on simplicity and security. Any article on the subject really should reference his original source pages:
I've always been a fan of "the DJB way", which is a very simple method of initializing and managing unix type systems. The voidlinux distro roughly follows these principles today.
Security-wise they are roughly equivalent in practice if they are used properly.
The best I could find was a rough 2.5x speedup of ChaCha8 vs ChaCha20 in the "Too Much Crypto" paper and https://github.com/jedisct1/rust-aegis#benchmarks that benchmarks ChaCha20 and various AES implementations in addition to AEGIS, where it looks like ChaCha8 might be competitive with hardware-accelerated AES on some platforms (AMD) but not others (M1).
Unfortunately, this is comparing apples to oranges because AES-256-GCM is authenticated, so you will need a MAC with ChaCha12 (usually Poly1305) which finally makes ChaCha12 in AEAD mode slower than AES-256-GCM.
But the real question is: What is fast enough?
I believe that between 1 and 2 GB / s per core for an AEAD is fast enough as I/O will be your bottleneck way before that.
This is why I will always favor a ChaCha20/ChaCha12-based AEAD over AES and its many footguns.
rot13 is my limit of understanding :) But I do like reading these articles.
> We use ChaCha20 as the encryption stream cipher because it is faster than AES in software-only implementations, it is not sensitive to timing attacks and has undergone rigorous analysis ([3], [4] and [5]). We chose this over AES as future advances in cryptanalysis might uncover security issues with it, its performance on platforms that lack dedicated hardware is slow, and many AES implementations are vulnerable to cache-collision timing attacks [[6]].
