New Features of Latin Dances: Analysis of Salsa, ChaCha, and Rumba
New Features of Latin Dances: Analysis of Salsa, ChaCha, and Rumba
复制标题
DOI：
10.1007/978-3-540-71039-4_30
复制
发表时间：
2008-02
期刊：
影响因子：
--
通讯作者：
Jean-Philippe Aumasson;Simon Fischer;Shahram Khazaei;W. Meier;Christian Rechberger
中科院分区：
文献类型：
--
作者：
Jean-Philippe Aumasson;Simon Fischer;Shahram Khazaei;W. Meier;Christian Rechberger
流密码Salsa 20是由伯恩斯坦在2005年作为eSTREAM项目的候选者引入的，同时还有简化版本Salsa 20/8和Salsa 20/12。ChaCha是Salsa 20的变体，旨在为类似性能带来更好的扩散。Salsa 20的变体有多达7轮（而不是20轮）已被差分密码分析破解，而ChaCha尚未被分析。我们介绍了一种新的方法，Salsa 20和ChaCha的差分密码分析，相关攻击的启发和相关的中性位的概念。这是中性比特在流密码分析中的首次应用。它允许我们打破256位版本的Salsa 20/8，为7轮变体带来更快的攻击，并打破6轮和7轮ChaCha。在第二部分中，我们分析了压缩函数Rumba，它是作为四个Salsa 20实例的XOR构建的，并返回512位输出。我们发现两个简化的变体的碰撞和原像攻击，然后我们讨论了差分攻击的原始版本，并利用高概率差分减少碰撞搜索的复杂性从2256到279 3轮伦巴。为了证明我们的方法的正确性，我们提供了简化版本的碰撞和近碰撞的例子。
The stream cipher Salsa20 was introduced by Bernstein in 2005 as a candidate in the eSTREAM project, accompanied by the reduced versions Salsa20/8 and Salsa20/12. ChaCha is a variant of Salsa20 aiming at bringing better diffusion for similar performance. Variants of Salsa20 with up to 7 rounds (instead of 20) have been broken by differential cryptanalysis, while ChaCha has not been analyzed yet. We introduce a novel method for differential cryptanalysis of Salsa20 and ChaCha, inspired by correlation attacks and related to the notion of neutral bits. This is the first application of neutral bits in stream cipher cryptanalysis. It allows us to break the 256-bit version of Salsa20/8, to bring faster attacks on the 7-round variant, and to break 6- and 7-round ChaCha. In a second part, we analyze the compression function Rumba, built as the XOR of four Salsa20 instances and returning a 512-bit output. We find collision and preimage attacks for two simplified variants, then we discuss differential attacks on the original version, and exploit a high-probability differential to reduce complexity of collision search from 2256to 279for 3-round Rumba. To prove the correctness of our approach we provide examples of collisions and near-collisions on simplified versions.