salsa20 is invertible, useless in CTR mode? I'm reading the salsa20 spec (sorry for the newbie question, i'm really a newbie here). Every paragraph ends with : "this operation is invertible", I suppose the whole salsa20 algorithm is.


If I use salsa20 in bloc cipher CTR mode, this property does not seems mandatory to me, am I right?
As such, any cryptographically-robust hash function (one-way only) could be used for CTR encryption?
Isn't it easier to design a robust hash than a robust cipher?
Every paragraph ends with : "this operation is invertible", I suppose the whole salsa20 algorithm is.


The Salsa20 quarterround, and thus rowround, columnround and doubleround are invertible. However, the whole Salsa20 core is not because the initial state is added to the state after iterating the rounds (cf. page 6 in the spec).


  
  If I use salsa20 in bloc cipher CTR mode, this property does not seems mandatory to me, am I right?
  


If the whole cipher core was invertible, then a known plaintext attack would reveal the key. So not being invertible is a requirement, somewhere along the line.


  
  As such, any cryptographically-robust hash function (one-way only) could be used for CTR encryption?
  


This is correct. See, for example this question.


  
  Isn't it easier to design a robust hash than a robust cipher?
  


Maybe, but block ciphers are usually much faster than a hash function in CTR mode. Hash functions are optimized to consume data, not output it. Stream ciphers, OTOH, are occasionally even faster, like you can see if you compare Salsa20 and AES in software implementations.