Improved Key Recovery Attacks on Reduced-Round Salsa20 and ChaCha

  • Zhenqing Shi
  • Bin Zhang
  • Dengguo Feng
  • Wenling Wu
Part of the Lecture Notes in Computer Science book series (LNCS, volume 7839)


Salsa20 is a stream cipher designed by Bernstein in 2005 and Salsa20/12 has been selected into the final portfolio of the eSTREAM Project. ChaCha is a variant of Salsa20 with faster diffusion for similar performance. The previous best results on Salsa20 and ChaCha proposed by Aumasson et al. exploits the differential properties combined with the probabilistic neutral bits (PNB). In this paper, we extend their approach by considering a new type of distinguishers, named (column and row) chaining distinguishers. Besides, we exhibit new high probability second-order differential trails not covered by the previous methods, generalize the notion of PNB to probabilistic neutral vectors (PNV) and show that the set of PNV is no smaller than that of PNB. Based on these findings, we present improved key recovery attacks on reduced-round Salsa20 and ChaCha. Both time and data complexities of our attacks are smaller than those of the best former results.


Stream ciphers Salsa20 ChaCha Neutral bits Distinguisher 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Bernstein, D.J.: Salsa20. Technical Report 2005/025, eSTREAM, ECRYPT Stream Cipher Project,
  2. 2.
    The eSTREAM project,
  3. 3.
    Bernstein, D.J.: Salsa20/8 and Salsa20/12. Technical Report 2006/007, eSTREAM, ECRYPT Stream Cipher Project,
  4. 4.
    Bernstein, D.J.: ChaCha, a variant of Salsa20,
  5. 5.
    Crowley, P.: Truncated differential cryptanalysis of five rounds of Salsa20. In: Stream Ciphers Revisited - SASC 2006 (2006)Google Scholar
  6. 6.
    Velichkov, V., Mouha, N., De Cannière, C., Preneel, B.: UNAF: A Special Set of Additive Differences with Application to the Differential Analysis of ARX. In: Canteaut, A. (ed.) FSE 2012. LNCS, vol. 7549, pp. 287–305. Springer, Heidelberg (2012)CrossRefGoogle Scholar
  7. 7.
    Fischer, S., Meier, W., Berbain, C., Biasse, J.-F., Robshaw, M.J.B.: Non-randomness in eSTREAM Candidates Salsa20 and TSC-4. In: Barua, R., Lange, T. (eds.) INDOCRYPT 2006. LNCS, vol. 4329, pp. 2–16. Springer, Heidelberg (2006)CrossRefGoogle Scholar
  8. 8.
    Tsunoo, Y., Saito, T., Kubo, H., Suzaki, T., Nakashima, H.: Differential cryptanalysis of Salsa20/8. In: The State of the Art of Stream Ciphers - SASC 2007 (2007)Google Scholar
  9. 9.
    Aumasson, J.-P., Fischer, S., Khazaei, S., Meier, W., Rechberger, C.: New features of Latin dances: analysis of Salsa, ChaCha, and Rumba. In: Nyberg, K. (ed.) FSE 2008. LNCS, vol. 5086, pp. 470–488. Springer, Heidelberg (2008)CrossRefGoogle Scholar
  10. 10.
    Siegenthaler, T.: Decrypting a class of stream ciphers using ciphertext only. IEEE Transactions on Computers 34(1), 81–85 (1985)CrossRefGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2013

Authors and Affiliations

  • Zhenqing Shi
    • 1
  • Bin Zhang
    • 2
  • Dengguo Feng
    • 1
  • Wenling Wu
    • 1
  1. 1.Institute of SoftwareChinese Academy of SciencesBeijingChina
  2. 2.Institute of Information EngineeringChinese Academy of SciencesBeijingChina

Personalised recommendations