In an attempt to provide greater conjectured security into Salsa and ChaCha, an unnecessarily high number of rounds are prescribed for the ciphers, sacrificing performance. Taking into account the existing differential attacks on reduced versions of Salsa and ChaCha, we propose a hybrid model, a simple tool to evaluate the security of ARX based constructions. We show, under certain assumptions, only 12 rounds of Salsa and ChaCha can be considered sufficient instead of the 20 proposed in these standards.

In this work, we study how changes in a single bit of the starting cipher state of Salsa and ChaCha propagates biases in other bits of the cipher state. While these biases dissipate in just a few rounds of these ciphers, we show that by carefully choosing a combination of bits from the state, one is able to see strong biases that had previously been missed. These biases are then exploited to show weaknesses in the reduced round version of Salsa and ChaCha, improving the best known key recovery attacks on 8 rounds of Salsa and 7 round of ChaCha, and for the first time providing practical attacks on 6 rounds of Salsa and 5 rounds of ChaCha. Our observations can be viewed through the lens of differential-linear cryptanalysis and we present it as such in the paper.