Salsa20

Salsa20

The Salsa quarter-round function. Four parallel copies make a round.
General
Designers	Daniel J. Bernstein
Related to	Rumba20, ChaCha
Certification	eSTREAM portfolio
Cipher detail
Key sizes	256 bits
State size	512 bits
Rounds	20
Speed	3.91 cpb on an Intel Core 2 Duo
Best public cryptanalysis
2008 cryptanalysis breaks 8 out of 20 rounds to recover the 256-bit secret key in 2251 operations, using 231 keystream pairs.

Salsa20 is a stream cipher submitted to eSTREAM by Daniel J. Bernstein. It is built on a pseudorandom function based on 32-bit addition, bitwise addition (XOR) and rotation operations, which maps a 256-bit key, a 64-bit nonce, and a 64-bit stream position to a 512-bit output (a version with a 128-bit key also exists). This gives Salsa20 the unusual advantage that the user can efficiently seek to any position in the output stream in constant time. It offers speeds of around 4–14 cycles per byte in software on modern x86 processors, and reasonable hardware performance. It is not patented, and Bernstein has written several public domain implementations optimized for common architectures.

Structure

Internally, the cipher uses bitwise addition (exclusive OR), 32-bit addition mod 2³², and constant-distance rotation operations on an internal state of 16 32-bit words. This choice of operations avoids the possibility of timing attacks in software implementations.

The initial state is made up of 8 words of key, 2 words of stream position, 2 words of nonce (essentially additional stream position bits), and 4 fixed words. 20 rounds of mixing produce 16 words of stream cipher output.

Each round consists of four quarter-round operations, performed on either the columns or the rows of the 16-word state, arranged as a 4×4 matrix. Every 2 rounds, the pattern repeats. Pseudocode for two rounds is as follows. ⊞ is addition modulo 2³², <<< is the left-rotate operation, and ^ is exclusive-or. x ^= y is an abbreviation for x = x ^ y.

x[ 4] ^= (x[ 0] ⊞ x[12])<<<7;    x[ 9] ^= (x[ 5] ⊞ x[ 1])<<<7;
x[14] ^= (x[10] ⊞ x[ 6])<<<7;    x[ 3] ^= (x[15] ⊞ x[11])<<<7;
x[ 8] ^= (x[ 4] ⊞ x[ 0])<<<9;    x[13] ^= (x[ 9] ⊞ x[ 5])<<<9;
x[ 2] ^= (x[14] ⊞ x[10])<<<9;    x[ 7] ^= (x[ 3] ⊞ x[15])<<<9;
x[12] ^= (x[ 8] ⊞ x[ 4])<<<13;   x[ 1] ^= (x[13] ⊞ x[ 9])<<<13;
x[ 6] ^= (x[ 2] ⊞ x[14])<<<13;   x[11] ^= (x[ 7] ⊞ x[ 3])<<<13;
x[ 0] ^= (x[12] ⊞ x[ 8])<<<18;   x[ 5] ^= (x[ 1] ⊞ x[13])<<<18;
x[10] ^= (x[ 6] ⊞ x[ 2])<<<18;   x[15] ^= (x[11] ⊞ x[ 7])<<<18;

x[ 1] ^= (x[ 0] ⊞ x[ 3])<<<7;    x[ 6] ^= (x[ 5] ⊞ x[ 4])<<<7;
x[11] ^= (x[10] ⊞ x[ 9])<<<7;    x[12] ^= (x[15] ⊞ x[14])<<<7;
x[ 2] ^= (x[ 1] ⊞ x[ 0])<<<9;    x[ 7] ^= (x[ 6] ⊞ x[ 5])<<<9;
x[ 8] ^= (x[11] ⊞ x[10])<<<9;    x[13] ^= (x[12] ⊞ x[15])<<<9;
x[ 3] ^= (x[ 2] ⊞ x[ 1])<<<13;   x[ 4] ^= (x[ 7] ⊞ x[ 6])<<<13;
x[ 9] ^= (x[ 8] ⊞ x[11])<<<13;   x[14] ^= (x[13] ⊞ x[12])<<<13;
x[ 0] ^= (x[ 3] ⊞ x[ 2])<<<18;   x[ 5] ^= (x[ 4] ⊞ x[ 7])<<<18;
x[10] ^= (x[ 9] ⊞ x[ 8])<<<18;   x[15] ^= (x[14] ⊞ x[13])<<<18;

Salsa20 performs 20 rounds of mixing on its input, then adds the final array to the original array to obtain its 64-byte output block. However, reduced round variants Salsa20/8 and Salsa20/12 using 8 and 12 rounds respectively have also been introduced. These variants were introduced to complement the original Salsa20, not to replace it, and perform even better (TODO rewrite to make it clear that even eithout a reference it is obvious that they are faster, they just reduce the number of rounds!) in the eSTREAM benchmarks than Salsa20, though with a correspondingly lower security margin.

eSTREAM selection

Salsa20 has been selected as a Phase 3 design for Profile 1 (software) by the eSTREAM project, receiving the highest weighted voting score of any Profile 1 algorithm at the end of Phase 2. Salsa20 had previously been selected as Phase 2 Focus design for Profile 1 (software) and as a Phase 2 design for Profile 2 (hardware) by the eSTREAM project, but was not advanced to Phase 3 for Profile 2 because eSTREAM felt that it was probably not a good candidate for extremely resource constrained hardware environments.

Cryptanalysis

As of 2012, there are no published attacks on Salsa20/12 or the full Salsa20/20; the best attack known breaks 8 of the 12 or 20 rounds.

In 2005, Paul Crowley reported an attack on Salsa20/5 with an estimated time complexity of 2¹⁶⁵, and won Bernstein's US$1000 prize for "most interesting Salsa20 cryptanalysis". This attack, and all subsequent attacks are based on truncated differential cryptanalysis. In 2006, Fischer, Meier, Berbain, Biasse, and Robshaw reported an attack on Salsa20/6 with estimated time complexity of 2¹⁷⁷, and a related-key attack on Salsa20/7 with estimated time complexity of 2²¹⁷.

In 2007, Tsunoo et al. announced a cryptanalysis of Salsa20 which breaks 8 out of 20 rounds to recover the 256-bit secret key in 2²⁵⁵ operations, using 2^11.37 keystream pairs. However, this attack does not seem to be comparative with the brute force attack.

In 2008, Aumasson, Fischer, Khazaei, Meier, and Rechberger reported a cryptanalytic attack against Salsa20/7 with a time complexity of 2¹⁵³, and they reported the first attack against Salsa20/8 with an estimated time complexity of 2²⁵¹. This attack makes use of the new concept of probabilistic neutral key bits for probabilistic detection of a truncated differential. The attack can be adapted to break Salsa20/7 with a 128-bit key.

In 2012 the attack by Aumasson et al. was improved by Shi et al. against Salsa20/7 (128-bit key) to a time complexity of 2¹⁰⁹ and Salsa20/8 (256-bit key) to 2²⁵⁰.

In 2013, Mouha and Preneel published a proof that 15 rounds of Salsa20 was 128-bit secure against differential cryptanalysis. (Specifically, it has no differential characteristic with higher probability than 2⁻¹³⁰, so differential cryptanalysis would be more difficult than 128-bit key exhaustion.)

ChaCha variant

In 2008, Bernstein published the closely related "ChaCha" family of ciphers, which aim to increase the diffusion per round while achieving the same or slightly better performance. The Aumasson et al. paper also attacks ChaCha, achieving one round less: ChaCha6 with complexity 2¹⁴⁰ and ChaCha7 with complexity 2²³¹.

ChaCha replaces the basic Salsa20 round primitive R(a,b,c,k)

b ⊕= (a ⊞ c) <<< k;

with the modified computation:

b ⊞= c;
a ⊕= b;
a <<<= k;

The rotation amounts are also updated. A full quarter-round becomes:

a ⊞= b; d ⊕= a; d <<<= 16;
c ⊞= d; b ⊕= c; b <<<= 12;
a ⊞= b; d ⊕= a; d <<<= 8;
c ⊞= d; b ⊕= c; b <<<= 7;

In addition to being more efficient on 2-operand instruction sets (like x86), this updates each word twice per quarter-round.

The fact that two of the rotates are multiple of 8 allows some optimization. Additionally, the input formatting is rearranged to support an efficient SSE implementation optimization discovered for Salsa20. Rather than alternating rounds down columns and across rows, they are performed down columns and along diagonals.

ChaCha is the basis of the BLAKE hash function, a finalist in the NIST hash function competition, and BLAKE2 successor tuned for even higher speed. It also defines a variant using 16 64-bit words (1024 bits of state), with correspondingly adjusted rotation constants.

External links

• Salsa20 home page
• Specification (PDF)
• Salsa20/8 and Salsa20/12 (PDF)
• eStream page on Salsa20
• The ChaCha family of stream ciphers