[Paper Review] Freestyle, a randomized version of ChaCha for resisting offline brute-force and dictionary attacks

P. Arun Babu, Jithin Jose Thomas|arXiv (Cornell University)|Feb 9, 2018

Cryptographic Implementations and Security24 references3 citations

TL;DR

Freestyle is a randomized, variable-round variant of the ChaCha stream cipher that resists offline brute-force and dictionary attacks by introducing a bounded hash-based halting condition and key-guessing penalty (KGP). It enables up to $2^{128}$ distinct ciphertexts per key and nonce, making known-plaintext, chosen-plaintext, and chosen-ciphertext attacks infeasible in practice, at the cost of 1.6–3.2× slower performance and 3.125% larger ciphertexts compared to ChaCha20.

ABSTRACT

This paper introduces Freestyle, a randomized and variable round version of the ChaCha cipher. Freestyle uses the concept of hash based halting condition where a decryption attempt with an incorrect key is likely to take longer time to halt. This makes Freestyle resistant to key-guessing attacks i.e. brute-force and dictionary based attacks. Freestyle demonstrates a novel approach for ciphertext randomization by using random number of rounds for each block, where the exact number of rounds are unknown to the receiver in advance. Freestyle provides the possibility of generating $2^{128}$ different ciphertexts for a given key, nonce, and message; thus resisting key and nonce reuse attacks. Due to its inherent random behavior, Freestyle makes cryptanalysis through known-plaintext, chosen-plaintext, and chosen-ciphertext attacks difficult in practice. On the other hand, Freestyle has costlier cipher initialization process, typically generates 3.125% larger ciphertext, and was found to be 1.6 to 3.2 times slower than ChaCha20. Freestyle is suitable for applications that favor ciphertext randomization and resistance to key-guessing and key reuse attacks over performance and ciphertext size. Freestyle is ideal for applications where ciphertext can be assumed to be in full control of an adversary, and an offline key-guessing attack can be carried out.

Motivation & Objective

• To design a symmetric cipher resistant to offline key-guessing attacks, including brute-force and dictionary-based attacks, in scenarios where ciphertext is exposed to adversaries.
• To address the insecurity of deterministic stream ciphers like ChaCha when keys or nonces are reused, as demonstrated in attacks like KRACK.
• To introduce a mechanism that makes decryption with an incorrect key significantly slower than with the correct key, increasing the computational cost for adversaries.
• To enable ciphertext randomization without altering the key or nonce, thereby preventing cryptanalysis via XOR of reused ciphertexts.
• To formalize and quantify resistance to key-guessing attacks using the key-guessing penalty (KGP), a metric reflecting the relative computational burden on an adversary.

Proposed method

• Freestyle uses a variable number of rounds $R_i$ per message block, selected randomly from $[R_{ ext{min}}, R_{ ext{max}}]$, where $R_{ ext{min}} = 12$ and $R_{ ext{max}} = 36$ by default, to randomize ciphertexts.
• A bounded hash-based halting condition is enforced: a 16-bit hash is computed at regular intervals $H_I$, and decryption halts only when the hash matches a precomputed value, increasing time for incorrect keys.
• The cipher initialization includes a configurable number of iterations (pepper bits) and a hash complexity parameter $H_C \in \{1,2,3\}$, which control the computational cost of the halting condition.
• The hash function uses ARX (Add-XOR-Rotate) instructions to resist side-channel attacks and is designed to be collision-tolerant by incrementing on collisions.
• A non-deterministic CTR mode is introduced, allowing $2^{128}$ different ciphertexts for the same key, nonce, and message due to random round counts and pepper values.
• The cipher enforces a minimum of 12 rounds and maximum of 36 rounds regardless of user input, ensuring sufficient randomness and security even with weak parameters.

Experimental results

Research questions

• RQ1 Can a symmetric cipher be designed such that decryption with an incorrect key takes significantly longer than with the correct key, thereby increasing the cost of offline key-guessing attacks?
• RQ2 How can ciphertext randomization be achieved without changing the key or nonce, to prevent attacks based on XOR of multiple ciphertexts?
• RQ3 What is the impact of variable round counts and hash-based halting on the security and performance of a stream cipher like ChaCha?
• RQ4 Can a key-guessing penalty (KGP) greater than 1 be achieved in practice, and how does it affect the relative performance of legitimate users versus adversaries?
• RQ5 Is it feasible to design a cipher that remains secure against known-plaintext, chosen-plaintext, and chosen-ciphertext attacks even when keys and nonces are reused?

Key findings

• Freestyle achieves a key-guessing penalty (KGP) > 1, meaning an adversary with an incorrect key requires at least KGP times more computational effort than a legitimate user, significantly slowing down offline attacks.
• The cipher can generate up to $2^{128}$ distinct ciphertexts for the same key, nonce, and message due to random round counts and pepper values, making key and nonce reuse secure against XOR-based cryptanalysis.
• Freestyle is 1.6 to 3.2 times slower than ChaCha20 due to variable rounds and hash computation overhead, and produces 3.125% larger ciphertexts.
• The bounded hash-based halting condition increases decryption time for incorrect keys by requiring full hash verification, while legitimate users with the correct key complete decryption faster.
• The use of ARX-based hash functions and configurable parameters ($H_I$, $H_C$, pepper bits) allows tuning of security and performance trade-offs without compromising resistance to side-channel attacks.
• Even with weak user-provided parameters, Freestyle defaults to $R_{ ext{min}} = 12$ and $R_{ ext{max}} = 36$, ensuring sufficient randomness and security, thus preventing configuration-related vulnerabilities.