A multi-step key recovery attack on reduced round Salsa and ChaCha

This paper develops a significantly enhanced attack on the ciphers Salsa and ChaCha. The existing attacks against these ciphers are mainly differential attacks. In this work, we produce an attack on 7.5-round Salsa and 6.5-round ChaCha20. These are the maiden key-recovery attacks on those versions of the two ciphers, in which we recover the key in multiple steps using several distinguishers. In comparison to the previous best-known attack against 7-round Salsa, the new attack method offers an improvement of 27.5 times, while on 7.5-round Salsa20 and 6.5-round ChaCha20 our attack is the only existing one.