Stringology-Based Cryptanalysis for EChaCha20 Stream Cipher
2026-04-10 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors studied a new version of the ChaCha20 cipher called EChaCha20, which changes its internal structure to be bigger and different. They used special string searching algorithms (KMP and Boyer-Moore) to find patterns in the cipher's output that other tests might miss. Their results showed that EChaCha20 is mostly very random for bigger pieces of data (16 and 32 bits), with only small quirks when looking at very small pieces (8 bits). They also found that small changes spread quickly through the cipher, helping to keep it secure. This work suggests that string-based analysis is a useful way to check security in these types of ciphers.
EChaCha20Stream cipherStringology-Based CryptanalysisKnuth-Morris-Pratt (KMP)Boyer-Moore (BM)Quarter-Round FunctionRotational differential attackDiffusionAvalanche effectPseudorandomness
Authors
Victor Kebande
Abstract
Stringology-Based Cryptanalysis (SBC) offers a suitable and a structurally aligned approach for uncovering structural patterns in stream ciphers that traditional statistical tests may often fail to detect. Despite \texttt{EChaCha20}'s design enhancements, no systematic investigation has been performed to determine whether its expanded 6$\times$6 state matrix and modified Quarter-Round Function (\texttt{QR-F}) introduce subtle keystream patterns, rotational biases, or partial collisions that could serve as statistical distinguishers. As such, addressing this gap is critical to ensure that the cipher's modifications do not unintentionally reduce its security margin. Therefore, this paper leverages Knuth-Morris-Pratt (\texttt{KMP}) and Boyer-Moore (\texttt{BM}) algorithms to analyze \texttt{EChaCha20}, which is a variant of ChaCha20 that features an expanded 6$\times$6 state matrix and an enhanced \texttt{QR-F}. The author has developed and optimized adaptations of the \texttt{KMP} and \texttt{BM} algorithms for 32-bit word level pattern analysis and employed them to investigate $m$-bit pattern frequency distributions to assess the \texttt{EChaCha20}'s resistance of rotational-differential attacks. Our experimental results on large-scale one million keystream datasets have confirmed that \texttt{EChaCha20} is able to maintain strong pseudorandomness at 16-bit and 32-bit levels with minor irregularities observed in the 8-bit domain. In addition to these, the differential tests have indicated a rapid diffusion, exhibiting an avalanche effect after two \texttt{QR-F} rounds and no statistically significant rotational collisions were observed within the evaluated bounds, consistent with expected ARX diffusion behavior beyond 3 rounds. This work puts forward SBC as a complementary tool for ARX cipher evaluation and provide new thoughts on the security properties of \texttt{EChaCha20}.