Differential Cryptanalysis of Salsa20 Based on Comprehensive Analysis of PNBs

Abstract

This paper focuses on the differential cryptanalysis of the Salsa20 stream cipher. The existing differential cryptanalysis approaches first study the differential bias of the Salsa20 stream cipher and then search for probabilistic neutral bits (PNBs). However, the differential bias and the set of PNBs obtained in this method are not always the optimal solution. To figure out a better solution, we apply the differential cryptanalysis based on the comprehensive analysis of PNBs on the reduced-round Salsa20 introduced in [19]. At first, we comprehensively analyze the neutrality measure of all keybits concerning all output differential $\mathcal{O}\mathcal{D}$ bits. Afterward, we select the $\mathcal{O}\mathcal{D}$ bit position with the best neutrality measure and look for the corresponding input differential $\mathcal{I}\mathcal{D}$ with the best differential bias. Taking everything into account, the proposed approach could be used to attack Salsa20/8 with a time complexity of $2^{144.75}$ and a data complexity of $2^{55.74}$.