Why exactly are CHACHA20 TLS ciphers not compliant with the NIST guidelines and FIPS/HIPAA standards?

Question

I happen to recall that CHACHA20 ciphers are not compliant with both NIST guidelines and FIPS/HIPAA standards. As used to be stated by htbridge.com SSL tests years ago. I just found similar information a similar note here and comments about this here.

What I couldn't find is why they are not compliant. I see that TLS_CHACHA20_POLY1305_SHA256 in particular used more and more on TLSv1.2 and TLSv1.3. So my question is: Why exactly are CHACHA20 TLS ciphers not compliant with the NIST guidelines and FIPS/HIPAA standards?

And does this apply to all CHACHA20 ciphers on all TLS versions or just on a subset of them?

Answer 1

The Reddit thread that you link to seems to answer the question: there is a specific list of cryptographic algorithms that have been validated and approved by NIST, and ChaCha20 is not on that list.

https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program

Validating cryptographic algorithms takes time (and money), and involves a lot of bureaucratic overheads. So unless there is a strong business case for NIST to invest resources in doing so for a specific algorithm, it will never end up on their approval list, regardless of it's actual security.

And that does not mean that there is necessarily anything wrong with the algorithm, or that it is insecure. And it should also be noted that something being approved by NIST also does not necessarily mean that it is secure (see the infamous case of DUAL_EC_DRBG).

It just means that one specific organisation in the USA has not validated and approved its usage (potentially for their own benefit rather than yours) - so if you are required to only use NIST approved algorithms then it would not be compliant. And if you aren't required to only use NIST approved algorithms, then you shouldn't worry about it.

Answer 2

ChaCha20 is a stream cipher, and there currently isn't any NIST-approved stream cipher at all. The only options are the block ciphers AES, Triple DES and Skipjack (the latter is only approved for decryption).

The topic of standardizing a stream cipher especially for resource-constrainted environments has been discussed within the NIST since at least 2011. In the Lightweight Crypto Standardization Process, there was at least one stream cipher (Grain-128AEAD) which made it to the final round, but ultimately, it lost to a block cipher.

So the NIST doesn't reject stream ciphers, nor have they (as far as I'm aware) ever recommended against ChaCha20 in particular. It's just that the algorithm hasn't gone through any NIST standardization process. I'm not even sure if Bernstein ever tried, so the chances of a FIPS approval anytime soon seem slim – regardless of whether or not ChaCha20 is a good cipher.