Salsa20 approval D. J. Bernstein
Hash functions and ciphers
Snuffle 2005: the Salsa20 encryption function

Salsa20 approval

There seems to be quite a lot of enthusiasm for Salsa20 in the cryptographic community. Thanks for all the positive feedback! Thanks also for the occasional negative feedback: it's helpful to learn what people don't like.

Phase 1 of eSTREAM

97 cryptographers in 19 countries submitted dozens of stream ciphers to eSTREAM, the ECRYPT Stream Cipher Project, in April 2005. I submitted Salsa20.

In March 2006, the eSTREAM committee (Babbage, Canteaut, Cid, Courtois, Gilbert, Johansson, Lano, Paar, Parker, Preneel, Rijmen, Robshaw) announced

The committee announced Salsa20 as one of the 23 "Phase 2 hardware" ciphers and one of the 7 "Focus Phase 2 software" ciphers.

Phase 2 of eSTREAM

In April 2007, the eSTREAM committee (Babbage, De Canniere, Canteaut, Cid, Gilbert, Johansson, Paar, Parker, Preneel, Rijmen, Robshaw, Wu) announced The committee announced Salsa20 as one of the 8 "Focus Phase 3 software" ciphers. Regarding hardware, the committee said "While Salsa20 may lend itself to hardware implementation in general, the available results on Salsa20 suggest that it is unlikely to be a realistic candidate for our target environment of very resource-constrained hardware."

The eSTREAM committee also published the results of a poll that had been taken at the previous eSTREAM conference, SASC 2007:

Voting at SASC 2007

Voting forms were distributed at SASC 2007 to attendees. A simple ranking scheme can be applied(1) with larger positive scores reflecting a greater enthusiasm for the algorithm. We were not bound by the vote, though our decisions are roughly in line with attendee preference.

(1) Scores in the first column were multiplied by 2, in the second by 1, in the third by -1, and by -2 in the last. The weighted sum was divided by the total votes cast for that algorithm.

The "software" votes were as follows: 
                Move to Consider  Not Very
    Algorithm    Next   For Next Suitable For Archive Weighted
    (Profile I) Round    Round   Next Round            Score
     Salsa20      35        9         0          0      1.80
   Sosemanuk      20       12         4          3      1.03
   HC 128/256     22        5         6          3      1.08
       LEX        20       11         6          4      0.90
     Rabbit       18       13         7          3      0.88
     Dragon       12       10         11         3      0.47
      Phelix      13       12         9          8      0.31
    CryptMT        7       18         5          8      0.29
       NLS         0       13         10        12     -0.60
   Polar Bear      0        8         12        10     -0.80
      Dicing       0        7         13        12     -0.94
      ABC          0        9         10        25     -1.16
        Py         0        4         15        28     -1.43
The "hardware" votes were as follows: 
      Grain       39        7         1          2      1.63
     Trivium      39        6         3          2      1.54
     Salsa20      20       12         7          2      1.00
   Mickey128      18        7         8          5      0.66
     Rabbit       11       13         11         6      0.29
     F-FCSR        5       16         10         3      0.29
       LEX         9       14         8          8      0.21
      Phelix      11       11         10         8      0.18
     Mickey       11        9         7         10      0.11
     Edon80        2       19         11         6      0.00
   Pomaranch       3       12         12        10     -0.38
      Decim        0       13         11         7     -0.39
   Moustique       1        9         15         9     -0.65
       Vest        7        4         12        18     -0.73
       WG          0        9         11        13     -0.85
    ZK-Crypt       2        6         9         17     -0.97
       NLS         0        8         10        16     -1.00
   Polar Bear      0        6         10        15     -1.10
     Hermes8       0        6         14        18     -1.16
      TSC4         0        6         7         19     -1.22
   Achterbahn      1        2         8         35     -1.61

Phase 3 of eSTREAM

In April 2008, the eSTREAM committee (Babbage, De Canniere, Canteaut, Cid, Gilbert, Johansson, Parker, Preneel, Rijmen, Robshaw) announced a final eSTREAM portfolio containing The committee's comments on Salsa20 were as follows:
Salsa20/12. This cipher offers a simple, clean, and scaleable design. As well as supporting 128-bit and 256-bit keys in a very natural way, the simplicity and scalability of the algorithm has undoubtedly contributed to it receiving much cryptanalytic attention. For our portfolio we propose a version of Salsa20 that has twelve rounds. Eight and twenty round versions were also considered during the eSTREAM process, but we feel that Salsa20/12 offers the best balance, combining a very nice performance profile with what appears to be a comfortable margin for security. In our view Salsa20/12 is a very successful proposal.

The eSTREAM committee also published the results of a poll that had been taken at the previous eSTREAM conference, SASC 2008:

For each algorithm attendees were asked to tick one of the following three choices regarding its suitability for the final portfolio: very suitable, neutral, not very suitable. The first and third votes counted for +5 and -5 points each, with the final score being averaged over the number of votes cast for a given algorithm.
The "software" votes were as follows: 
    2.80 Rabbit
    2.80 Salsa20
    1.20 Sosemanuk
    0.60 HC-128
   -0.60 NLS v2
   -1.20 LEX v2
   -1.40 CryptMT v3
   -1.60 Dragon
The "hardware" votes were as follows: 
    4.35 Trivium
    3.50 Grain v1
    0.52 F-FCSR-H v2
    0.17 MICKEY v2
   -1.38 Decim v2
   -1.72 Edon80
   -2.24 Pomaranch v3
   -2.50 Moustique