Boosting Differential-Linear Cryptanalysis of ChaCha7 with MILP

• Published in: IACR Transactions on Symmetric Cryptology Vol. 2023; no. 2; pp. 189 - 223
• Main Authors: Bellini, Emanuele, Gerault, David, Grados, Juan, Makarim, Rusydi H., Peyrin, Thomas
• Format: Journal Article
• Language: English
• Published: Ruhr-Universität Bochum 16.06.2023
• Subjects: ChaCha20; Cryptanalysis; Differential-Linear Attack
• ISSN: 2519-173X; 2519-173X
• DOI: 10.46586/tosc.v2023.i2.189-223

In this paper, we present an improved differential-linear cryptanalysis of the ChaCha stream cipher. Our main contributions are new differential-linear distinguishers that we were able to build thanks to the following improvements: a) we considered a larger search space, including 2-bit differences (besides 1-bit differences) for the difference at the beginning of the differential part of the differential-linear trail; b) a better choice of mask between the differential and linear parts; c) a carefully crafted MILP tool that finds linear trails with higher correlation for the linear part. We eventually obtain a new distinguisher for ChaCha reduced to 7 rounds that requires 2166.89 computations, improving the previous record (ASIACRYPT 2022) by a factor of 247. Also, we obtain a distinguisher for ChaCha reduced to 7.5 rounds that requires 2251.4 computations, being the first time of a distinguisher against ChaCha reduced to 7.5 rounds. Using our MILP tool, we also found a 5-round differential-linear distinguisher. When combined with the probabilistic neutral bits (PNB) framework, we obtain a key-recovery attack on ChaCha reduced to 7 rounds with a computational complexity of 2206.8, improving by a factor 214.2 upon the recent result published at EUROCRYPT 2022.