New Features of Latin Dances: Analysis of Salsa, ChaCha, and Rumba

Abstract

Abstract. The stream cipher Salsa20 was introduced by Bernstein in 2005 as a candidate in the eSTREAM project, accompanied by the reduced versions Salsa20/8 and Salsa20/12. ChaCha is a variant of Salsa20 aiming at bringing better diffusion for similar performance. Variants of Salsa20 with up to 7 rounds (instead of 20) have been broken by differential cryptanalysis, while ChaCha has not been analyzed yet. We introduce a novel method for differential cryptanalysis of Salsa20 and ChaCha, inspired by correlation attacks and related to the notion of neutral bits. This is the first application of neutral bits in stream cipher cryptanalysis. It allows us to break the 256-bit version of Salsa20/8, to bring faster attacks on the 7-round variant, and to break 6-and 7-round ChaCha. In a second part, we analyze the compression function Rumba, built as the XOR of four Salsa20 instances and returning a 512-bit output. We find collision and preimage attacks for two simplified variants, then we discuss differential attacks on the original version, and exploit a highprobability differential to reduce complexity of collision search from 2 256 to 2 79 for 3-round Rumba. To prove the correctness of our approach we provide examples of collisions and near-collisions on simplified versions.

Linearization Framework for Collision Attacks: Application to CubeHash and MD6

“…We introduce the dependency tables to distinguish the influential bits, from those which have no influence or are less influential. In other words, in case the condition function does not mix its input bits well, we profit not only from neutral bits [7] but also from probabilistic neutral bits [2]. This is achieved by devising a backtracking search algorithm, similar to [6,14,24], based on the dependency table.…”

“…We then define the concept of dependency table which shows how much influence every input bit of the condition function has on each output bit. By carefully analyzing the dependency table, we are able to profit not only from neutral bits [7] but also from probabilistic neutral bits [2] in a backtracking search algorithm, similar to [6,14,24]. This contributes to a better understanding of freedom degrees uses.…”

New Directions in Cryptanalysis of Self-Synchronizing Stream Ciphers

“…In this section we review the framework from [7] which was inspired by results from [1,5,11]. Let F : B m ×B n → B be a keyed Boolean function which maps the m-bit public variable C and the n-bit secret variable K into the output bit z = F (C, K).…”

Slid Pairs in Salsa20 and Trivium

“…Later a four round differential was exploited by Fischer et al [6] to break 6 rounds in 2 177 trials and by Tsnunoo et al [11] to break 7 rounds in about 2 190 trials. The currently best attack by Aumasson et al [1] covers 8 round version of Salsa20 with estimated complexity of 2 251 .…”