Google Adiantum and the ChaCha RNG
The ChaCha cryptographic random number generator is in the news thanks to Google's Adiantum project. I'll discuss what's going on, but first a little background.
The name of the project comes from a genus of fern. More on that below as well.
One-time padsThe one-time pad is a provably unbreakable way to encrypt things. You create a sheet of random bits and give your counterpart an exact copy. Then when it comes time for you to send an encrypted message, you convert your message to a stream of bits, XOR your message with the random bits you exchanged previously, and send the result. The recipient then takes the XOR of the received message with the pad of random bits, and recovers the original message.
This is called a one-time pad because it's a pad of bits that you can only use one time. If you reuse a pad, it's no longer unbreakable.
One-time pads are impractical for a couple reasons. First, it's hard to generate truly random bits, especially in bulk. Second, exchanging the pads is almost as difficult as exchanging messages.
Stream ciphersSo here's a bright idea: we'll get around both of the problems with one-time pads by using pseudorandom bits rather than random bits! The both parties can generate their own random bits.
Many people have had this idea, and it's not necessarily a bad one. It's called a stream cipher. The problem is that most pseudorandom number generators are not up to the task. You need a cryptographically secure RNG, and most RNGs are far from secure. The ChaCha RNG, however, appears to be good enough to use in a stream cipher, given enough rounds of scrambling [1], and Google is using it for full disk encryption in Android devices.
Full disk encryptionIf you forget your password to your computer, you may not be able to access your data, but a thief still could by removing the hard drive and accessing it from another computer. That is, unless the disk is encrypted.
Full disk encryption on a laptop, such as BitLocker on Windows or FileVault on OSX, is usually implemented via AES encryption with hardware acceleration. If you don't have special hardware for encryption, AES can be too slow.
Adiantum: ChaCha encryption on AndroidOn low-end devices, ChaCha encryption can be around 5x faster than AES. So Google is using ChaCha for Android devices, using what it calls Adiantum.
You can read the technical details in [2], and you can read more about the ChaCha random number generator in [3].
So where does the name Adiantum come from? It's a Victorian name for a genus of maidenhair ferns, symbolic of sincerity and discretion.
Related posts[1] Adiantum using ChaCha with 12 rounds. TLS 1.3 uses ChaCha with 20 rounds.
[2] Adiantum: length-preserving encryption for entry-level processors by Google employees Paul Crowley and Eric Biggers.
[3] IRTF RFC 8439: ChaCha20 and Poly1305 for IETF Protocols