Latin Dances Reloaded: Improved Cryptanalysis Against Salsa and ChaCha, and the Proposal of Forró

Coutinho, Murilo; Passos, Iago; Grados, Juan; Mendonça, Fábio Lúcio Lópes de; Sousa, Rafael Timteo de; Borges, F.

doi:10.1007/978-3-031-22963-3_9

Cited by 11 publications

(23 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For ChaCha6 and ChaCha7 the time complexity is reduced 2 116 and 2 237. 7 , respectively. In 2017, Dey et al [15] improved the time complexity of the 256-bit key version of ChaCha7.…”

Section: Previous Workmentioning

confidence: 97%

Analyzing the Probability of Key Recovery in the Differential Attacks Against ChaCha

Sharma,

Dey

2024

IEEE Access

View full text Add to dashboard Cite

The stream cipher ChaCha has been subjected to differential linear cryptanalysis since 2008. Aumasson et al. [1] laid the groundwork for this attack, employing the concept of probabilistically neutral bits for key recovery. Subsequently, various enhancements have been made to this attack over the last few decades. These improvements are essentially refinements to the probabilistically neutral bit-based attack approach. Despite the proposed modifications in these improvements, which increase attack complexity, the consequential changes in the associated probability of key recovery have not been thoroughly examined. A comprehensive analysis of the probability of key recovery is lacking in all attacks within this domain. No systematic process is available in the existing works for analyzing the probability of key recovery. This paper addresses this gap by proposing a method for estimating the probability of key recovery in these attacks. Employing this method, we calculate an estimated interval for the probability of key recovery for both the original idea presented by Aumasson et al. [1] and the subsequent modifications to this idea. This analysis allows us to understand the variations in probability associated with these modifications.INDEX TERMS Probability of key recovery, ChaCha, Right pair-based attack, Error probability.

show abstract

“…For ChaCha6 and ChaCha7 the time complexity is reduced 2 116 and 2 237. 7 , respectively. In 2017, Dey et al [15] improved the time complexity of the 256-bit key version of ChaCha7.…”

Section: Previous Workmentioning

confidence: 97%

Analyzing the Probability of Key Recovery in the Differential Attacks Against ChaCha

Sharma,

Dey

2024

IEEE Access

View full text Add to dashboard Cite

show abstract

“…In this work, we improve the key recovery attack on 8-round Salsa than ASIACRYPT 2022 paper [7]. For this, we apply a new strategy to find the PNBs set.…”

Section: Our Contributionmentioning

confidence: 99%

“…In section III, we discuss about basic attack framework using the concept of probabilistic neutral bits (PNBs). We review the work of ASIACRYPT 2022 [7] and provide a strategy to find a better set of PNBs that improve the attack complexity over the previous findings in section IV. In the following section V, we review the work of ISPEC 2022 [13], we show some flaws in their work and their key recovery attack for 8 rounds is incorrect.…”

Section: Our Contributionmentioning

confidence: 99%

“…In an odd number of rounds that the original Salsa specification referred to as column-rounds, applying the nonlinear operation QRF to columns (S[0], S [4], S [8], S [12]), (S [5], S [9], S [13], S [1]), (S [10], S [14], S [2], S [6]), (S [15], S [3], S [7], S [11]). In an even number of rounds that are referred to as the row rounds, applying the nonlinear operation QRF to rows (S[0], S [1], S [2], S [3]), (S [5], S [6], S [7], S [4]), (S [10], S [11], S [8], S [9]), (S [15], S [12], S [13], S [14]). S R is the updated state after the R round applied to the initial state S 0 .…”

Section: S[0] S[1] S[2] S[3] S[4] S[5] S[6] S[7] S[8] S[9] S[10] S[11...mentioning

confidence: 99%

“…Choudhari and Maitra [6] significantly improved the attack against Salsa and ChaCha by using multibit differential distinguishers. Subsequently, Coutinho et al in [7], [8], presented the first differential-linear distinguishers that can reach rounds 7 and 8 of the Salsa cipher. Additionally, they enhanced the efficacy of PNB-based key-recovery attacks against 7 and 8 rounds of Salsa.…”

mentioning

confidence: 99%

See 2 more Smart Citations

Enhancing the Key Recovery Attack on Round Reduced Salsa

Dey,

Girme

et al. 2024

IEEE Access

View full text Add to dashboard Cite

Salsa is the most well-known stream cipher and a finalist of the eSTREAM project. The concept of probabilistic neutral bits (PNBs) first presented by Aumasson et al., is the most important step in the cryptanalysis of Salsa. In this paper, we provide a strategy to find a better set of PNBs and we improve the existing attacks. Our attack complexity is 2 210.38 , which is an improvement of the latest work at ASIACRYPT 2022. We also revisit the work of Ghafoori et al. (ISPEC 2022). In their study, they used a PNB-based differential attack to present a key recovery attack on Salsa20/8 with a time complexity of 2 144.75 . They claimed their approach was the most effective single-bit differential attack to date. Our paper challenges this claim, providing experimental results and reasoned arguments to support our case.

show abstract