Analysis of Diagonal Constants in Salsa

  • Bhagwan N. BatheEmail author
  • Bharti HariramaniEmail author
  • A. K. Bhattacharjee
  • S. V. Kulgod
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 10662)


In this paper, we study the effect of diagonal constants in the software oriented stream ciphers Salsa and Chacha. So far, there has not been any clear justification why such constants are chosen. We concentrate on differential cryptanalysis to evaluate how different constants affect the biases after a few rounds in these ciphers. We are using Measure of Uniformity in bias as a measure for differentiating constants as good or bad constants w.r.t. original constant. We have observed that after 4 rounds of Salsa20, for an Input Differential (\(\mathcal {ID}\)) at Most Significant Bit (MSB) of the third word of quarterround function, the specific patterns in constant involved in that quarterround function leads to increase or decrease in Measure of Uniformity in bias. The location of specific patterns in those diagonal constants varies with the change in last two rotation constants. We did not observe any pattern for ChaCha after 3 rounds. We have also observed a slight increase and decrease in time and data complexity for good and bad constants respectively as compared to an original constant. The designer constants are a good constant however it can be even better with a slight change in constant \(c_0\) or \(c_3\).


Constants Stream cipher ChaCha Salsa Bias Measure of Uniformity in bias ARX Cipher Input Differential Output differential Hamming distance 



The authors would like to thank anonymous reviewers for detailed comments. The authors are also thankful to Computer Division of Bhabha Atomic Research Centre for use of super computing facility.


  1. 1.
    Ashur, T., Liu, Y.: Rotational cryptanalysis in the presence of constants. IACR Cryptology ePrint Archive 2016, 826 (2016).
  2. 2.
    Aumasson, J.-P., Fischer, S., Khazaei, S., Meier, W., Rechberger, C.: New features of Latin dances: analysis of Salsa, ChaCha, and Rumba. In: Nyberg, K. (ed.) FSE 2008. LNCS, vol. 5086, pp. 470–488. Springer, Heidelberg (2008). CrossRefGoogle Scholar
  3. 3.
    Bernstein, D.: Salsa20 security (2005).
  4. 4.
    Bernstein, D.J.: Salsa20 specification. eSTREAM Project algorithm description (2005).
  5. 5.
    Bernstein, D.J.: ChaCha, a variant of Salsa20. In: Workshop Record of SASC, vol. 8 (2008)Google Scholar
  6. 6.
    Hernandez-Castro, J.C., Tapiador, J.M.E., Quisquater, J.-J.: On the Salsa20 core function. In: Nyberg, K. (ed.) FSE 2008. LNCS, vol. 5086, pp. 462–469. Springer, Heidelberg (2008). CrossRefGoogle Scholar
  7. 7.
    Choudhuri, A.R., Maitra, S.: Significantly improved multi-bit differentials for reduced round salsa and chacha. IACR Cryptology ePrint Archive 2016, 1034 (2016).
  8. 8.
    Crowley, P.: Truncated differential cryptanalysis of five rounds of Salsa20. IACR Cryptology ePrint Archive 2005, 375 (2005).
  9. 9.
    The ECRYPT stream cipher project. eSTREAM portfolio of stream ciphers.
  10. 10.
    Fischer, S., Meier, W., Berbain, C., Biasse, J.-F., Robshaw, M.J.B.: Non-randomness in eSTREAM candidates Salsa20 and TSC-4. In: Barua, R., Lange, T. (eds.) INDOCRYPT 2006. LNCS, vol. 4329, pp. 2–16. Springer, Heidelberg (2006). CrossRefGoogle Scholar
  11. 11.
    Ishiguro, T., Kiyomoto, S., Miyake, Y.: Latin dances revisited: new analytic results of Salsa20 and ChaCha. In: Qing, S., Susilo, W., Wang, G., Liu, D. (eds.) ICICS 2011. LNCS, vol. 7043, pp. 255–266. Springer, Heidelberg (2011). CrossRefGoogle Scholar
  12. 12.
    Maitra, S.: Chosen IV cryptanalysis on reduced round ChaCha and Salsa. Discret. Appl. Math. 208, 88–97 (2016). MathSciNetCrossRefzbMATHGoogle Scholar
  13. 13.
    Maitra, S., Paul, G., Meier, W.: Salsa20 cryptanalysis: new moves and revisiting old styles. In: WCC 2015, the Ninth International Workshop on Coding and Cryptography, Paris, France, 13–17 April 2015 (2015).,
  14. 14.
    Mouha, N., Preneel, B.: A proof that the ARX Cipher Salsa20 is secure against differential cryptanalysis. IACR Cryptology ePrint Archive 2013, 328 (2013).
  15. 15.
    Shi, Z., Zhang, B., Feng, D., Wu, W.: Improved key recovery attacks on reduced-round Salsa20 and ChaCha. In: Kwon, T., Lee, M.-K., Kwon, D. (eds.) ICISC 2012. LNCS, vol. 7839, pp. 337–351. Springer, Heidelberg (2013). CrossRefGoogle Scholar
  16. 16.
  17. 17.
    Tsunoo, Y., Saito, T., Kubo, H., Suzaki, T., Nakashima, H.: Differential Cryptanalysis of Salsa20/8 (2007).
  18. 18.
    Velichkov, V., Mouha, N., De Cannière, C., Preneel, B.: UNAF: a special set of additive differences with application to the differential analysis of ARX. In: Canteaut, A. (ed.) FSE 2012. LNCS, vol. 7549, pp. 287–305. Springer, Heidelberg (2012). CrossRefGoogle Scholar

Copyright information

© Springer International Publishing AG 2017

Authors and Affiliations

  1. 1.Bhabha Atomic Research CentreMumbaiIndia
  2. 2.Bhabha Atomic Research Centre (CI)Homi Bhabha National InstituteMumbaiIndia

Personalised recommendations