Differential Cryptanalysis of Salsa20 Based on Comprehensive Analysis of PNBs

Enhancing the Key Recovery Attack on Round Reduced Salsa

“…Using this strategy, we increase the PNBs set and enhance the attack complexity for 8-round Salsa. Also, we show that the forward 5-round differential biases presented in the paper [13] are incorrect. As a result, their proposed attack on 8-round Salsa at ISPEC 2022 [13] becomes invalid.…”

“…Also, we show that the forward 5-round differential biases presented in the paper [13] are incorrect. As a result, their proposed attack on 8-round Salsa at ISPEC 2022 [13] becomes invalid. In the following Table 1, we provide our findings with existing results.…”

“…We review the work of ASIACRYPT 2022 [7] and provide a strategy to find a better set of PNBs that improve the attack complexity over the previous findings in section IV. In the following section V, we review the work of ISPEC 2022 [13], we show some flaws in their work and their key recovery attack for 8 rounds is incorrect. After that, we conclude the paper in the section VI.…”

“…In an odd number of rounds that the original Salsa specification referred to as column-rounds, applying the nonlinear operation QRF to columns (S[0], S [4], S [8], S [12]), (S [5], S [9], S [13], S [1]), (S [10], S [14], S [2], S [6]), (S [15], S [3], S [7], S [11]). In an even number of rounds that are referred to as the row rounds, applying the nonlinear operation QRF to rows (S[0], S [1], S [2], S [3]), (S [5], S [6], S [7], S [4]), (S [10], S [11], S [8], S [9]), (S [15], S [12], S [13], S [14]). S R is the updated state after the R round applied to the initial state S 0 .…”

“…In [12] Ding provided the related-cipher attack with time complexity 2 193.58 using two separate IVs in Salsa20/12 and Salsa20/8 with a secret key. Also, in [13]…”