How do I use Skein's Stream Cipher?

Question

I understand the NIST hash function competition candidate Skein comes with a built-in block cipher, Threefish, that is turned into a stream cipher by using Unique Block Iteration chaining (is that right?).

The pyskein implementation makes this particulary easy to use:

import os
import skein

data = b'Hello World!'
key = b'thisisasecret'
nonce = os.urandom(32)

c1 = skein.StreamCipher(key, nonce=nonce, hasher=skein.skein1024)
c2 = skein.StreamCipher(key, nonce=nonce, hasher=skein.skein1024)

print(c2.decrypt(c1.encrypt(data)))

But, as the algorithm is comparatively new, I have a whole load of question that culminate in "How do I use it properly?"

• How long should the nonce be?
• Do I still need to use PBKDF2? (i.e. does this thing do any key stretching of its own?)
• Do I still have to authenticate the message?
• What happens if I don't give it a nonce?
• How do I use all of the optional arguments?
• Why should / shouldn't I use it?

I'm not a cryptographer, and there doesn't seem to be any easy to understand documentation on the Threefish part of Skein. Yet the algorithm seems really nice. So I'm hoping you can help me out. :-)

Answer 1

You should not deploy Skein-based software yet.

Internally, Skein is built around a custom block cipher (Threefish) which can be used as a stream cipher or a MAC, but nobody is really looking at the inherent security of Threefish yet, only as how it provides a good hash function, and even for that usage, the verdict has not been reached yet. It takes years of scrutiny to decide that a given algorithm "looks decently secure". A one-size-fits-all primitive has a tremendous appeal, especially for embedded systems with limited space for code, but it will take a few more years before one could officially deem Threefish as secure. Roughly speaking, if Skein is chosen as SHA-3 (by the end of 2012), then it is probable that Threefish will begin to be investigated as an encryption primitive, in which case it could be declared as "seems good" by, say, 2016. You will have to be patient.

Another reason why you should wait a bit is that Skein and/or Threefish may still be subject to modifications. At regular intervals, SHA-3 candidates can be "tweaked" (slight modifications designed in the light of prior analysis). Skein was tweaked for second round of the SHA-3 competition, then tweaked again for third round. Which version is implemented in pyskein ? There's room for interoperability nightmares here.

As for your other questions:

• Skein / Threefish does not incorporate any automatic key stretching.
• Skein as a stream cipher is a stream cipher, not an authenticated stream cipher. It does only encryption. Skein may also be used to compute authentication (as a MAC) but there may be issues to take into account if you want to use the same key for both usages (i.e. don't do it unless you are sure it is safe, and quite frankly I am not sure).
• The "nonce" should be an arbitrary string, not really limited in length. In the general Skein description, the nonce and the message to hash (when hashing) use the same input mechanisms. Skein as a stream cipher is "just" a hash function with a key, no input, but a very long output.

Of course, pyskein may add arbitrary limitations, so I refer you to the pyskein documentation, if it exists at all.

Answer 2

I completely agree with @Thomas. You shouldn't use Skein at this point.

Instead, I suggest that you use AES-CBC or AES-CTR encryption, together with the CMAC message authentication code, in encrypt-then-authenticate mode.