Rotational analysis of ChaCha permutation

Abstract

<p style='text-indent:20px;'>We show that the underlying permutation of ChaCha20 stream cipher does not behave as a random permutation for up to 17 rounds with respect to rotational cryptanalysis. In particular, we derive a lower and an upper bound for the rotational probability through ChaCha quarter round, we show how to extend the bound to a full round and then to the full permutation. The obtained bounds show that the probability to find what we call a parallel rotational collision is, for example, less than <inline-formula><tex-math id="M1">\begin{document}$ 2^{-505} $\end{document}</tex-math></inline-formula> for 17 rounds of ChaCha permutation, while for a random permutation of the same input size, this probability is <inline-formula><tex-math id="M2">\begin{document}$ 2^{-511} $\end{document}</tex-math></inline-formula>. We remark that our distinguisher is not an attack against the ChaCha20 stream cipher, but rather a theoretical analysis of its internal permutation from the point of view of rotational cryptanalysis. Whenever possible, our claims are supported by experiments.</p>

An efficient multilevel security architecture for blockchain-based IoT networks using principles of cellular automata

“…4. Encryption and uploading phase: The device uses the lightweight cipher ChaCha20 ( Barbero, Bellini & Makarim, 2021 ) for encryption. It was proposed by D. J. Bernstein in 2008.…”

“…Salsa20 proved to be secure and unbreakable. Tests like truncated differential cryptanalysis, non-randomness and differential cryptanalysis were done on Salsa20 and it was successfully verified up to 12 rounds ( Barbero, Bellini & Makarim, 2021 ). It achieved the highest weighted voting score among all Profile 1 algorithms.…”

“…ChaCha20 encryption is approximately five times faster than AES on low end devices. So, ChaCha20 is used by Google as a replacement to conventional RC4 algorithm ( Barbero, Bellini & Makarim, 2021 ). Its major advantage is the design based on ARX (Addition, Rotation and XOR) technique and this helps ChaCha20 cipher to provide better performance with less complex structure and resistance to several attacks.…”

Rotational Differential-Linear Cryptanalysis Revisited

“…Sometimes the boundary between the two can be quite blurred. For example, the development of the invariant attacks [1][2][3], polytopic cryptanalysis [4], division properties [5,6], rotational cryptanalysis [7,8], etc., in recent years belongs to these two approaches.…”

“…The correlation is −2−3.83 with the mask (01000002, 03800002), and 2−3.46 with the mask (01800002,03000002). By Theorem 4, the formula sums up over all intermediate masksPr δ λ E 1 (u, w), which evaluates to 2 −4 • 2 −3.46 + 2 −4 • 2 −3.46 − 2 −4 • 2 −3.83 − 2 −4 • 2 −3.83 = 2 −8 6. .…”