Miyaji Laboratory

In recent years, information and communication technologies has developed rapidly and has been essential for modern society. In particular, security has become more and more important with the spread of the Internet, as huge amounts of data are transmitted and received on a daily basis. Cryptography plays an essential role in maintaining confidentiality, integrity, and availability of data, and stream ciphers have attracted attention as a means to encrypt data at high speed. Salsa20, one of stream ciphers, is the predecessor of ChaCha, which was selected for TLS1.3, and its security analysis is an important issue. Salsa20 is a cryptosystem using only bit addition, cyclic shift, and exclusive OR, and well-known analysis methods are differential analysis adding differences to the input, and linear analysis using a linear approximation formula. Recently, an analysis method called differential linear analysis combined differential analysis and linear analysis, has been proposed. In differential linear analysis, the theoretical value of linear bias, which is the bias of the linear approximation equation, is used to evaluate the complexity of the analysis. Therefore, in differential linear analysis, it is important to derive theoretical values of linear bias that reflect experimental values in detail. The strongest result for the distinguishing attack on Salsa20 was proposed by Contiho et al. It is shown that 8 rounds of Salsa20 can be attacked with a complexity of 2^215.62. This distinguishing attack consists of 5 rounds of differential analysis and 6-8 rounds of linear analysis. It is proved that the linear bias of the linear approximation formula for the 6-8 rounds is 2⁻³⁴. The 6-8 round linear approximation formula consists of four sub-linear forms, and it is reported that the theoretical values of three of the four sub-linear forms are considerably different from the experimental values, the largest of which is |(theoretical value- experimental value)/theoretical value|=3.028. However, the reason for this difference has not been clarified. In this study, we improve the relevant linear approximation and propose a new theoretical value that reflects the experimental value in more detail. Using our derived theoretical values, |(theoretical value- experimental value)/theoretical value| is reduced from 3.028 to 0.057. It can be seen that the experimental values are more closely approximated.