Rotational Cryptanalysis of Salsa Core Function

Abstract

This paper presents rotational cryptanalysis of the Salsa core function, and warns designers of symmetric-key primitives not to incorporate the Salsa core function into other encryption schemes. The core functions of Serpent, ChaCha, and AES are actually incorporated into SOSEMANUK, BLAKE2, and SNOW-V, respectively. We first construct a toy model of the Salsa core function, and observe the rotational characteristics in the toy model by conducting an experiment. Since our experimental observations differ from the theoretical results presented by Khovratovich et al. at FSE 2010 and FSE 2015, we provide their proofs. In addition, we then demonstrate the rotational distinguishers for the Salsa and ChaCha permutations, and compare their results. While the rotational distinguisher for the ChaCha permutation performs properly only up to 8 rounds with a probability of approximately $2^{-489.6}$, the rotational distinguisher for the Salsa permutation performs properly up to 32 rounds with a probability of approximately $2^{-506.752}$. Consequently, our study clarifies how weak the Salsa permutation is to rotational cryptanalysis. Finally, we remark that our results do not affect the security of Salsa.