💻 computer science

Stringology-Based Cryptanalysis for EChaCha20 Stream Cipher

This paper introduces a Stringology-Based Cryptanalysis framework utilizing optimized Knuth-Morris-Pratt and Boyer-Moore algorithms to evaluate the EChaCha20 stream cipher, confirming its robust pseudorandomness and rapid diffusion while identifying only minor irregularities in the 8-bit domain.

Original authors: Victor Kebande

Published 2026-04-13

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Victor Kebande

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to find a specific, tiny flaw in a massive, high-speed factory that produces millions of unique, random-looking boxes every second. This factory is called EChaCha20, and it's a "stream cipher"—a digital machine used to scramble data so hackers can't read it.

For years, security experts have checked these boxes using standard "statistical tests." Think of these tests like a metal detector walking over a beach. It's good at finding big metal coins (obvious flaws), but it might miss a tiny, specific pattern of sand grains that looks slightly out of place.

This paper introduces a new, smarter way to check the factory: Stringology-Based Cryptanalysis. Instead of just looking for metal, the author uses pattern-matching algorithms (specifically KMP and Boyer-Moore) that act like a super-sleuth detective who knows exactly how the factory is built.

Here is the breakdown of the paper using simple analogies:

1. The Factory Upgrade (EChaCha20)

The original factory (called ChaCha20) was very good. It used a 4x4 grid of gears to mix up data.

The Upgrade: The new EChaCha20 factory expanded its grid to a massive 6x6 (making it bigger and more complex) and added two new types of gears (rotations of 4 bits and 2 bits) to mix things up even faster.
The Question: Does making the factory bigger and adding new gears actually make it safer, or did they accidentally create a hidden pattern that a hacker could exploit?

2. The Detective's Tools (Stringology)

The author didn't use a metal detector; they used Stringology.

The Analogy: Imagine you are looking for a specific phrase in a library of a million books.
- Old Way (Brute Force): You read every single letter of every book, one by one. Slow and boring.
- The New Way (KMP & Boyer-Moore): These are like smart search engines. If you are looking for the word "SECRET," and you see "SECRE..." but the next letter is wrong, a smart search engine knows exactly how many pages to skip ahead without re-reading everything. It jumps over the "junk" to find the "treasure."
The Twist: The author taught these search engines to look for 32-bit chunks (big blocks of data) instead of just single letters, matching the way the factory actually works.

3. The Investigation (The Experiments)

The author ran two main tests on one million generated data streams:

Test A: The "Repetition" Hunt

Goal: Did the factory accidentally print the same pattern twice? (Like a printer jamming and printing the same line over and over).
Result:
- At the 32-bit level (the big picture): Perfectly random. No repeats found. The factory is doing a great job.
- At the 16-bit level (medium size): Also perfect.
- At the 8-bit level (tiny, byte-sized): They found a tiny glitch. One specific pattern appeared slightly less often than it should have, but only when the factory was running with the same settings for a long time. It's like a slight wobble in a car engine that only happens when you drive on the same road for 100 miles. It's not a crash; it's just a minor quirk.

Test B: The "Snowball" Test (Diffusion)

Goal: If you change one tiny bit of the input (like swapping a single snowflake), does the whole output change instantly? This is called the Avalanche Effect.
Result: The factory is incredibly fast at this.
- In the old factory, it took about 3 or 4 rounds of gears to mix everything up.
- In the new EChaCha20, the "snowball" effect happened even faster. By the 3rd round, the entire output was completely scrambled. The new gears (4-bit and 2-bit rotations) made the mixing process more efficient.

4. The Verdict

The paper concludes that EChaCha20 is safe and robust.

The Good News: The new design works exactly as intended. It mixes data faster and more thoroughly than the old version. The "wobble" found at the tiny 8-bit level is harmless and disappears if you change the settings (like changing the key or the nonce), which is what real-world users do.
The Methodological Win: The biggest takeaway isn't just that EChaCha20 is safe, but that using "Stringology" (pattern matching) is a brilliant new way to test security. It found things that the old "metal detector" tests missed. It's like using a high-resolution microscope instead of a magnifying glass.

Summary in One Sentence

The author used a super-smart "search engine" to inspect a new, upgraded data scrambler, found it to be extremely secure and fast, and proved that using pattern-matching tricks is a powerful new tool for keeping our digital secrets safe.

1. Problem Statement

Modern stream ciphers, particularly those based on Add-Rotate-XOR (ARX) structures like ChaCha20, are widely deployed in security-critical protocols (e.g., TLS 1.3, IoT). While standard statistical test suites (e.g., NIST SP 800-22, TestU01) provide a baseline for randomness, they often operate at the bit-level and may fail to detect localized, word-aligned structural weaknesses or subtle rotational biases inherent in complex permutation designs.

EChaCha20 is a proposed variant of ChaCha20 featuring:

An expanded 6×6 state matrix (1,152 bits) compared to the original 4×4 (512 bits).
An enhanced Quarter-Round Function (QR-F) incorporating additional rotation constants (4-bit and 2-bit) alongside the standard 16, 12, 8, and 7-bit rotations.

The Gap: There has been no systematic investigation into whether these structural enhancements introduce subtle keystream patterns, rotational biases, or partial collisions that traditional statistical tests might miss. The paper addresses the need for a cryptanalytic approach that aligns with the cipher's internal 32-bit word granularity rather than just aggregate bit statistics.

2. Methodology

The paper proposes Stringology-Based Cryptanalysis (SBC), adapting classical string matching algorithms to analyze stream cipher keystreams. The methodology consists of three main phases:

A. Algorithmic Adaptation (KMP & Boyer-Moore)

The author adapted the Knuth-Morris-Pratt (KMP) and Boyer-Moore (BM) algorithms for cryptographic analysis:

Granularity: Instead of character-by-character matching, the algorithms operate on 32-bit word units to match the ARX structure.
Hybrid Approach: A hybrid KMP-BM algorithm was developed. It utilizes KMP's failure function for deterministic backtracking after partial matches and BM's bad-character/good-suffix heuristics for efficient "jump-ahead" skipping.
Optimization: The algorithms incorporate XOR-enhanced heuristics and probabilistic filtering ( $\chi^2$ -based) to reduce false positives and handle the specific properties of ARX outputs.
Complexity: The approach achieves an average-case complexity of $O(n/m)$ , allowing for the efficient analysis of millions of keystream blocks, significantly faster than brute-force methods.

B. Experimental Framework

Two primary experiments were conducted on a dataset of 1,000,000 keystream blocks (1.15 Gbits total):

Pseudorandomness at the Bitstring Level:
- Scanning for $m$ -gram repetitions ( $m \in \{8, 16, 32\}$ bits).
- Comparing observed frequencies against theoretical uniform distributions using $z$ -scores and $\chi^2$ tests.
- Testing under both Fixed-Key (deterministic) and Variable-Key (randomized) environments.
QR-F Differential Cryptanalysis:
- Rotational Differential Attacks: Injecting rotational differences ( $\Delta$ ) into the QR-F inputs.
- Pattern Seeding: Using statistically significant patterns detected in Experiment 1 to seed the differential inputs, rather than random differences.
- Diffusion Tracking: Measuring collision probabilities and avalanche effects after 1, 2, 4, and 8 rounds of the QR-F.

3. Key Contributions

Novel Application of Stringology: First known application of KMP and BM algorithms specifically adapted for 32-bit ARX cipher cryptanalysis, moving beyond traditional statistical testing.
Hybrid Algorithm Design: Development of a KMP-BM hybrid optimized for cryptographic keystreams, achieving high precision (0.97) and recall (0.96) with a throughput of 3.6 GB/s.
Structural Evaluation of EChaCha20: A comprehensive empirical assessment of the 6×6 state matrix and enhanced QR-F, specifically looking for rotational biases and diffusion irregularities.
Distinguisher-Oriented Analysis: The work focuses on identifying structural deviations (distinguishers) rather than full key recovery, providing a new metric for security margin assessment.

4. Key Results

A. Pseudorandomness Analysis

32-bit and 16-bit Levels: The cipher demonstrated strong pseudorandomness with perfectly uniform distributions. No statistically significant repetitions or structural correlations were detected at the native 32-bit word level.
8-bit Level: Minor irregularities were observed in the fixed-key scenario, where one 8-bit pattern showed a slightly lower frequency (approx. 2.0 occurrences vs. expected 3.0). However, this anomaly disappeared completely under variable-key conditions, indicating it is a transient initialization artifact rather than a fundamental design flaw.

B. Differential and Rotational Resistance

Diffusion Speed: EChaCha20 achieved full-state diffusion within 3 rounds.
- After 1 round: 28 collisions observed ( $P \approx 2^{-19.2}$ ).
- After 2 rounds: 1 collision observed ( $P \approx 2^{-24}$ ).
- After 3 rounds: 0 collisions observed in $2^{24}$ trials.
Avalanche Effect: The cipher exhibited a near-ideal avalanche effect (bit-flip probability converging to 0.5) after just 2 rounds, outperforming theoretical expectations for standard ChaCha20.
Rotational Constants: The inclusion of non-power-of-two rotations (4-bit and 2-bit) effectively mitigated rotational symmetry, with no statistically significant rotational collisions found within the evaluated bounds.

C. Performance

The hybrid stringology approach provided a 6.2× speedup over brute-force analysis.
It achieved a throughput of 3.6 GB/s, surpassing standard Boyer-Moore (3.2 GB/s) and KMP (1.4 GB/s).

5. Significance and Conclusion

This paper establishes Stringology-Based Cryptanalysis (SBC) as a powerful, complementary tool for evaluating ARX-based stream ciphers.

Validation of EChaCha20: The study confirms that EChaCha20's design enhancements (6×6 matrix and extra rotations) successfully improve diffusion speed and resistance to rotational differential attacks without introducing exploitable structural weaknesses.
Methodological Shift: It demonstrates that aligning cryptanalysis with the cipher's internal word granularity (32-bit) reveals insights that global bit-level statistical tests often miss.
Practical Implications: The findings suggest EChaCha20 is a robust candidate for high-assurance applications (TLS, IoT, VPNs), offering stronger security margins than ChaCha20 while maintaining computational efficiency.
Future Directions: The authors propose extending this framework to multi-dimensional pattern analysis, post-quantum scenarios, and side-channel resistance testing (FPGA implementation).

In summary, the paper argues that while EChaCha20 is secure, the proposed SBC framework is essential for uncovering subtle, localized biases in next-generation ciphers that traditional suites might overlook.