Chosen IV cryptanalysis on reduced round ChaCha and Salsa

详细信息    查看全文

• 作者：Subhamoy Maitra ^{subho@isical.ac.in" class="auth_mail" title="E-mail the corresponding author}
• 关键词：Stream cipher ; ChaCha ; Salsa ; Non-randomness ; Probabilistic Neutral Bit (PNB) ; ARX cipher
• 刊名：Discrete Applied Mathematics
• 出版年：2016
• 出版时间：31 July 2016
• 年：2016
• 卷：208
• 期：Complete
• 页码：88-97
• 全文大小：845 K

文摘

Recently, ChaCha20 (the stream cipher ChaCha with 20 rounds) is in the process of being a standardized and thus it attracts serious interest in cryptanalysis. The most significant effort to analyse Salsa and ChaCha was explained by Aumasson et al. long back (FSE 2008) and further, only minor improvements could be achieved. In this paper, first we revisit the work of Aumasson et al. to provide a clearer insight of the existing attack (2²⁴⁸ complexity for ChaCha7, i.e., 7 rounds) and show certain improvements (complexity around 2²⁴³) by exploiting additional Probabilistic Neutral Bits. More importantly, we describe a novel idea that explores proper choice of IVs corresponding to the keys, for which the complexity can be improved further (2²³⁹). The choice of IVs corresponding to the keys is the prime observation of this work. We systematically show how a single difference propagates after one round and how the differences can be reduced with proper choices of IVs. For Salsa too (Salsa20/8, i.e., 8 rounds), we get improvement in complexity, reducing it to 2^245.5$2^{245.5}$ from 2^247.2$2^{247.2}$ reported by Aumasson et al.