QRE-ChaCha: Quantum-Enhanced ChaCha Cipher

• QRE-ChaCha is a quantum-enhanced variant of the ChaCha cipher that uses quantum randomness during initialization and rounds to disrupt fixed state structures.
• The design XORs quantum random numbers with standard constants and injects randomness periodically, effectively reducing differential trail probabilities.
• Empirical evaluations reveal that QRE-ChaCha maintains ChaCha's efficiency while enhancing security with robust statistical randomness and improved resistance to cryptanalysis.

Searching arXiv for the cited paper and closely related materials to ground the article. Tool call: arxiv_search{"query":"(Liu et al., 24 Jul 2025) An Improved ChaCha Algorithm Based on Quantum Random Number","max_results":5} Quantum Random Number Enhanced ChaCha (QRE-ChaCha) is an improved variant of the ChaCha cipher that preserves the ARX structure, the standard $4\times4$ state matrix, the same quarter-round primitive, and the same final feed-forward step, while introducing true quantum randomness at initialization and during round evolution in order to increase diffusion and frustrate differential cryptanalysis (Liu et al., 24 Jul 2025). In the formulation reported in “An Improved ChaCha Algorithm Based on Quantum Random Number,” the fixed 128-bit constant block is XORed with a 128-bit quantum random string, and quantum random words are periodically XORed into the first 128 bits of the intermediate state during odd-round processing as described by the authors’ algorithmic schedule. The stated objective is to strengthen resistance to differential attacks while maintaining nearly the same speed as the original ChaCha and preserving keystream statistical randomness for cryptographic application requirements.

1. Architectural position within the ChaCha family

QRE-ChaCha is presented as a security-hardening enhancement rather than a wholesale redesign. Its core computation remains ChaCha’s ARX engine: modular addition, bitwise XOR, and word rotation over a 512-bit state of 16 words. The baseline state layout is

$$X^{(0)} = \begin{pmatrix} c_{0} & c_{1} & c_{2} & c_{3} \ k_{0} & k_{1} & k_{2} & k_{3} \ k_{4} & k_{5} & k_{6} & k_{7} \ t_{0} & \nu_{0} & \nu_{1} & \nu_{2} \end{pmatrix},$$

with a 256-bit key in 8 words, a 96-bit nonce in 3 words, and a 32-bit counter in 1 word. The constants are the standard ChaCha constants:

$$c_1=0x61707865,\quad c_2=0x3320646e,\quad c_3=0x79622d32,\quad c_4=0x6b206574.$$

What distinguishes QRE-ChaCha from standard ChaCha is that the constant row is no longer static, and fresh randomness is not confined to key, nonce, and counter setup. Instead, external quantum random numbers alter both the initial state and subsequent state evolution. This suggests that the design is intended to make the internal trajectory less amenable to attacks that exploit fixed structural regularities.

The paper explicitly frames the motivation in terms of “AI-assisted cryptanalysis and quantum computing technologies,” while retaining ChaCha’s established efficiency and resistance to timing and side-channel attacks. The claimed design goal is therefore additive hardening: preserve the standard quarter-round and feed-forward mechanisms, but make the cipher state less predictable by periodically introducing true quantum randomness.

2. State construction and round evolution

The first modification occurs at initialization. QRE-ChaCha replaces the fixed constant block with a quantum-randomly masked constant block:

$$X^{(0)} = \begin{pmatrix} c_{0} \oplus q_{0}^{(0)} & c_{1} \oplus q_{1}^{(0)} & c_{2} \oplus q_{2}^{(0)} & c_{3} \oplus q_{3}^{(0)} \ k_{0} & k_{1} & k_{2} & k_{3} \ k_{4} & k_{5} & k_{6} & k_{7} \ t_{0} & \nu_{0} & \nu_{1} & \nu_{2} \end{pmatrix}.$$

Thus, the first 128 bits of the state are the standard constants masked by a 128-bit quantum random value $q$, rather than fixed public constants.

The second modification is periodic round-time injection. For the state used at the even-indexed stage in the authors’ notation, the first four words are XORed with quantum random words:

$$X^{(r=\text{even})} = \begin{pmatrix} x_{0}^{(r)} \oplus q_{0}^{(r)} & x_{1}^{(r)} \oplus q_{1}^{(r)} & x_{2}^{(r)} \oplus q_{2}^{(r)} & x_{3}^{(r)} \oplus q_{3}^{(r)} \ x_{4}^{(r)} & x_{5}^{(r)} & x_{6}^{(r)} & x_{7}^{(r)} \ x_{8}^{(r)} & x_{9}^{(r)} & x_{10}^{(r)} & x_{11}^{(r)} \ x_{12}^{(r)} & x_{13}^{(r)} & x_{14}^{(r)} & x_{15}^{(r)} \end{pmatrix}.$$

Only the top row is directly randomized at each injection point, but the paper argues that ChaCha’s quarter-round diffusion propagates this randomness across the entire state in subsequent rounds (Liu et al., 24 Jul 2025). The additional design constraint

$$\Delta q_{i}^{(r)} \ne \Delta x_a^{(r)}, \qquad i=0,1,2,3$$

is stated to ensure that the injected quantum randomness meaningfully propagates rather than aligning trivially with the current word difference.

The quarter-round itself remains unchanged. For words $(x_a,x_b,x_c,x_d)$, the paper gives

$$\begin{cases} \begin{aligned} x_{a'}^{(r)} &= x_a^{(r)} \boxplus x_b^{(r)} \ x_{d'}^{(r)} &= x_d^{(r)} \oplus x_{a'}^{(r)} \ x_{d''}^{(r)} &= x_{d'}^{(r)} \lll 16 \ x_{c'}^{(r)} &= x_c^{(r)} \boxplus x_{d''}^{(r)} \ x_{b'}^{(r)} &= x_b^{(r)} \oplus x_{c'}^{(r)} \ x_{b''}^{(r)} &= x_{b'}^{(r)} \lll 12 \ x_a^{(r+1)} &= x_{a'}^{(r)} \boxplus x_{b''}^{(r)} \ x_{d'''}^{(r)} &= x_{d''}^{(r)} \oplus x_a^{(r+1)} \ x_d^{(r+1)} &= x_{d'''}^{(r)} \lll 8 \ x_c^{(r+1)} &= x_{c'}^{(r)} \boxplus x_d^{(r+1)} \ x_{b'''}^{(r)} &= x_{b''}^{(r)} \oplus x_c^{(r+1)} \ x_b^{(r+1)} &= x_{b'''}^{(r)} \lll 7 . \end{aligned} \end{cases}$$

The round schedule also remains recognizably ChaCha. Odd-numbered rounds apply quarter-rounds to columns, and even-numbered rounds apply quarter-rounds to diagonals. The authors’ pseudo-code inserts quantum random words before the diagonal processing stage:

$q$1

The output equation remains the standard ChaCha feed-forward:

$Z = X^{(0)} + X^{(n)}.$

3. Quantum randomness model and sourcing assumptions

The paper’s security philosophy is that quantum randomness is fundamentally stronger than conventional pseudorandomness because it is rooted in physical uncertainty rather than algorithmic generation. As described, a photonic QRNG can prepare a photon in a superposition such as

$$X^{(0)} = \begin{pmatrix} c_{0} & c_{1} & c_{2} & c_{3} \ k_{0} & k_{1} & k_{2} & k_{3} \ k_{4} & k_{5} & k_{6} & k_{7} \ t_{0} & \nu_{0} & \nu_{1} & \nu_{2} \end{pmatrix},$$0

or, in polarization form,

$$X^{(0)} = \begin{pmatrix} c_{0} & c_{1} & c_{2} & c_{3} \ k_{0} & k_{1} & k_{2} & k_{3} \ k_{4} & k_{5} & k_{6} & k_{7} \ t_{0} & \nu_{0} & \nu_{1} & \nu_{2} \end{pmatrix},$$1

after which a polarization beam splitter separates the states, single-photon detectors detect the outcome, and measurement collapses the quantum state to a random classical bit.

Within QRE-ChaCha, quantum random numbers are treated as external inputs rather than as values generated by the cipher itself. One implementation detail given in the paper is the use of a separate QRNG memory module, so the encryption algorithm accesses pre-generated quantum random bits instead of waiting for on-demand generation. This is operationally significant because the performance measurements exclude QRNG generation time and assume that the necessary random material is already available in memory.

The paper cites a QRNG service from ETH Zürich and assumes that the quantum random numbers are confidential to the adversary (Liu et al., 24 Jul 2025). It does not specify a full distribution protocol, but it recommends using a post-quantum cryptographic signature scheme to authenticate delivery of quantum random numbers, following the approach in cited work on device-independent quantum randomness-enhanced zero-knowledge proof. This suggests that the security model is not limited to local generation quality; it also depends on authenticated delivery and secrecy of the injected random values.

The claimed cryptographic role of the QRNG output is multifold: it is not predictable from prior outputs, has high entropy, resists forward and backward prediction, is less vulnerable to tampering because probing a quantum system disturbs it, improves key or seed unpredictability, adds extra confusion to the round function, and may increase resilience against both classical and quantum adversaries. The paper explicitly contrasts this with PRNGs, which may be statistically uniform but remain deterministic.

4. Differential cryptanalysis and theoretical security claims

The principal security argument is differential. According to the paper, QRE-ChaCha becomes harder to attack because the state evolution is no longer determined only by a fixed key, nonce, and counter tuple. Instead, fresh quantum randomness modifies the internal state at initialization and throughout round processing.

The evaluation focuses on reduced-round QRE-ChaCha, specifically 2-round and 3-round variants. The methodology combines the theoretical model of Kai Fu et al. (2016) for ARX modular addition differential and linear characteristics, a SAT-based automated search, and the open-source CryptoSMT tool. The authors state that they used 10 independently generated pairs of quantum random numbers, computed the differential values for each pair, and fixed those differences as constraints in the search.

The reported average upper bounds for differential trail probabilities are as follows:

Algorithm	Rounds	$$X^{(0)} = \begin{pmatrix} c_{0} & c_{1} & c_{2} & c_{3} \ k_{0} & k_{1} & k_{2} & k_{3} \ k_{4} & k_{5} & k_{6} & k_{7} \ t_{0} & \nu_{0} & \nu_{1} & \nu_{2} \end{pmatrix},$$2
QRE-ChaCha	2	$$X^{(0)} = \begin{pmatrix} c_{0} & c_{1} & c_{2} & c_{3} \ k_{0} & k_{1} & k_{2} & k_{3} \ k_{4} & k_{5} & k_{6} & k_{7} \ t_{0} & \nu_{0} & \nu_{1} & \nu_{2} \end{pmatrix},$$3
QRE-ChaCha	3	$$X^{(0)} = \begin{pmatrix} c_{0} & c_{1} & c_{2} & c_{3} \ k_{0} & k_{1} & k_{2} & k_{3} \ k_{4} & k_{5} & k_{6} & k_{7} \ t_{0} & \nu_{0} & \nu_{1} & \nu_{2} \end{pmatrix},$$4
ChaCha	2	$$X^{(0)} = \begin{pmatrix} c_{0} & c_{1} & c_{2} & c_{3} \ k_{0} & k_{1} & k_{2} & k_{3} \ k_{4} & k_{5} & k_{6} & k_{7} \ t_{0} & \nu_{0} & \nu_{1} & \nu_{2} \end{pmatrix},$$5
ChaCha	3	$$X^{(0)} = \begin{pmatrix} c_{0} & c_{1} & c_{2} & c_{3} \ k_{0} & k_{1} & k_{2} & k_{3} \ k_{4} & k_{5} & k_{6} & k_{7} \ t_{0} & \nu_{0} & \nu_{1} & \nu_{2} \end{pmatrix},$$6

In probability form, the paper gives approximately $$X^{(0)} = \begin{pmatrix} c_{0} & c_{1} & c_{2} & c_{3} \ k_{0} & k_{1} & k_{2} & k_{3} \ k_{4} & k_{5} & k_{6} & k_{7} \ t_{0} & \nu_{0} & \nu_{1} & \nu_{2} \end{pmatrix},$$7 for 2-round QRE-ChaCha, $$X^{(0)} = \begin{pmatrix} c_{0} & c_{1} & c_{2} & c_{3} \ k_{0} & k_{1} & k_{2} & k_{3} \ k_{4} & k_{5} & k_{6} & k_{7} \ t_{0} & \nu_{0} & \nu_{1} & \nu_{2} \end{pmatrix},$$8 for 3-round QRE-ChaCha, $$X^{(0)} = \begin{pmatrix} c_{0} & c_{1} & c_{2} & c_{3} \ k_{0} & k_{1} & k_{2} & k_{3} \ k_{4} & k_{5} & k_{6} & k_{7} \ t_{0} & \nu_{0} & \nu_{1} & \nu_{2} \end{pmatrix},$$9 for 2-round ChaCha, and $$c_1=0x61707865,\quad c_2=0x3320646e,\quad c_3=0x79622d32,\quad c_4=0x6b206574.$$0 for 3-round ChaCha. It further states that the number of effective differential trails $$c_1=0x61707865,\quad c_2=0x3320646e,\quad c_3=0x79622d32,\quad c_4=0x6b206574.$$1 does not exceed

$$c_1=0x61707865,\quad c_2=0x3320646e,\quad c_3=0x79622d32,\quad c_4=0x6b206574.$$2

for QRE-ChaCha, and does not exceed

$$c_1=0x61707865,\quad c_2=0x3320646e,\quad c_3=0x79622d32,\quad c_4=0x6b206574.$$3

for original ChaCha. For full 20-round bounds, the paper reports approximately $$c_1=0x61707865,\quad c_2=0x3320646e,\quad c_3=0x79622d32,\quad c_4=0x6b206574.$$4 for QRE-ChaCha and approximately $$c_1=0x61707865,\quad c_2=0x3320646e,\quad c_3=0x79622d32,\quad c_4=0x6b206574.$$5 for ChaCha (Liu et al., 24 Jul 2025).

These are the paper’s strongest quantitative security claims. Their intended interpretation is that injected quantum randomness disrupts characteristic propagation and raises attack complexity. At the same time, the scope of the claim is explicitly limited: the results are based on reduced-round differential analysis and automated search rather than on a formal full-round proof. A common misconception would be to read the randomness-test results as a substitute for cryptanalytic security; the paper does not make that claim. Its argument is instead a combination of reduced-round differential evidence, statistical testing, and design rationale.

5. Keystream statistical evaluation

The paper evaluates keystreams from QRE-ChaCha8 using both NIST SP 800-22 Rev. 1 and GM/T 0005-2021. The test setup consists of 10,000 keystream sequences, each of length 1,000,000 bits, with significance level $$c_1=0x61707865,\quad c_2=0x3320646e,\quad c_3=0x79622d32,\quad c_4=0x6b206574.$$6 and uniformity significance level $$c_1=0x61707865,\quad c_2=0x3320646e,\quad c_3=0x79622d32,\quad c_4=0x6b206574.$$7. For NIST testing, only 1,000 sequences were used because of file-size constraints in that part of the testing.

Selected NIST results are reported as follows:

NIST Test	Pass Count	P-Value
Frequency	982	0.187581
Block Frequency	988	0.751866
Cumulative Sums	983	0.435430
Runs	994	0.062821
Longest Run of Ones	984	0.747898
Rank	990	0.784927
FFT	986	0.803720
Non-overlapping Template	982	0.940080
Overlapping Template	990	0.117432
Universal Statistical	990	0.012829
Approximate Entropy	990	0.345650
Serial	992	0.899171
Linear Complexity	987	0.115387

The paper states that the omitted Random Excursions and Random Excursions Variant tests were also passed.

Selected GM/T 0005-2021 results are likewise reported:

GM/T 0005-2021 Test	Pass Count	P-Value
Single Bit Frequency	9884	0.862398
Block Frequency $$c_1=0x61707865,\quad c_2=0x3320646e,\quad c_3=0x79622d32,\quad c_4=0x6b206574.$$8	9902	0.969009
Poker $$c_1=0x61707865,\quad c_2=0x3320646e,\quad c_3=0x79622d32,\quad c_4=0x6b206574.$$9	9889	0.469806
Poker $$X^{(0)} = \begin{pmatrix} c_{0} \oplus q_{0}^{(0)} & c_{1} \oplus q_{1}^{(0)} & c_{2} \oplus q_{2}^{(0)} & c_{3} \oplus q_{3}^{(0)} \ k_{0} & k_{1} & k_{2} & k_{3} \ k_{4} & k_{5} & k_{6} & k_{7} \ t_{0} & \nu_{0} & \nu_{1} & \nu_{2} \end{pmatrix}.$$0	9910	0.362434
Overlapping Template $$X^{(0)} = \begin{pmatrix} c_{0} \oplus q_{0}^{(0)} & c_{1} \oplus q_{1}^{(0)} & c_{2} \oplus q_{2}^{(0)} & c_{3} \oplus q_{3}^{(0)} \ k_{0} & k_{1} & k_{2} & k_{3} \ k_{4} & k_{5} & k_{6} & k_{7} \ t_{0} & \nu_{0} & \nu_{1} & \nu_{2} \end{pmatrix}.$$1	9890	0.978538
Overlapping Template $$X^{(0)} = \begin{pmatrix} c_{0} \oplus q_{0}^{(0)} & c_{1} \oplus q_{1}^{(0)} & c_{2} \oplus q_{2}^{(0)} & c_{3} \oplus q_{3}^{(0)} \ k_{0} & k_{1} & k_{2} & k_{3} \ k_{4} & k_{5} & k_{6} & k_{7} \ t_{0} & \nu_{0} & \nu_{1} & \nu_{2} \end{pmatrix}.$$2	9918	0.610070
Total Runs	9915	0.113239
Run Distribution	9900	0.399442
Max Run of 1s	9900	0.386748
Max Run of 0s	9902	0.650860
Binary Derivation $$X^{(0)} = \begin{pmatrix} c_{0} \oplus q_{0}^{(0)} & c_{1} \oplus q_{1}^{(0)} & c_{2} \oplus q_{2}^{(0)} & c_{3} \oplus q_{3}^{(0)} \ k_{0} & k_{1} & k_{2} & k_{3} \ k_{4} & k_{5} & k_{6} & k_{7} \ t_{0} & \nu_{0} & \nu_{1} & \nu_{2} \end{pmatrix}.$$3	9905	0.699313
Binary Derivation $$X^{(0)} = \begin{pmatrix} c_{0} \oplus q_{0}^{(0)} & c_{1} \oplus q_{1}^{(0)} & c_{2} \oplus q_{2}^{(0)} & c_{3} \oplus q_{3}^{(0)} \ k_{0} & k_{1} & k_{2} & k_{3} \ k_{4} & k_{5} & k_{6} & k_{7} \ t_{0} & \nu_{0} & \nu_{1} & \nu_{2} \end{pmatrix}.$$4	9889	0.669151
Autocorrelation $$X^{(0)} = \begin{pmatrix} c_{0} \oplus q_{0}^{(0)} & c_{1} \oplus q_{1}^{(0)} & c_{2} \oplus q_{2}^{(0)} & c_{3} \oplus q_{3}^{(0)} \ k_{0} & k_{1} & k_{2} & k_{3} \ k_{4} & k_{5} & k_{6} & k_{7} \ t_{0} & \nu_{0} & \nu_{1} & \nu_{2} \end{pmatrix}.$$5	9915	0.073281
Autocorrelation $$X^{(0)} = \begin{pmatrix} c_{0} \oplus q_{0}^{(0)} & c_{1} \oplus q_{1}^{(0)} & c_{2} \oplus q_{2}^{(0)} & c_{3} \oplus q_{3}^{(0)} \ k_{0} & k_{1} & k_{2} & k_{3} \ k_{4} & k_{5} & k_{6} & k_{7} \ t_{0} & \nu_{0} & \nu_{1} & \nu_{2} \end{pmatrix}.$$6	9893	0.846168
Matrix Rank	9902	0.008056
Cumulative Sums (Forward)	9885	0.394370
Approximate Entropy $$X^{(0)} = \begin{pmatrix} c_{0} \oplus q_{0}^{(0)} & c_{1} \oplus q_{1}^{(0)} & c_{2} \oplus q_{2}^{(0)} & c_{3} \oplus q_{3}^{(0)} \ k_{0} & k_{1} & k_{2} & k_{3} \ k_{4} & k_{5} & k_{6} & k_{7} \ t_{0} & \nu_{0} & \nu_{1} & \nu_{2} \end{pmatrix}.$$7	9890	0.981469
Linear Complexity $$X^{(0)} = \begin{pmatrix} c_{0} \oplus q_{0}^{(0)} & c_{1} \oplus q_{1}^{(0)} & c_{2} \oplus q_{2}^{(0)} & c_{3} \oplus q_{3}^{(0)} \ k_{0} & k_{1} & k_{2} & k_{3} \ k_{4} & k_{5} & k_{6} & k_{7} \ t_{0} & \nu_{0} & \nu_{1} & \nu_{2} \end{pmatrix}.$$8	9882	0.526907
Maurer Universal $$X^{(0)} = \begin{pmatrix} c_{0} \oplus q_{0}^{(0)} & c_{1} \oplus q_{1}^{(0)} & c_{2} \oplus q_{2}^{(0)} & c_{3} \oplus q_{3}^{(0)} \ k_{0} & k_{1} & k_{2} & k_{3} \ k_{4} & k_{5} & k_{6} & k_{7} \ t_{0} & \nu_{0} & \nu_{1} & \nu_{2} \end{pmatrix}.$$9	9892	0.621922
Discrete Fourier Transform $q$0	9892	0.294959

The authors interpret these outcomes as indicating that the keystream is statistically random and cryptographically acceptable (Liu et al., 24 Jul 2025). In context, these results support the claim that the additional quantum-random injection does not degrade output randomness. They do not, by themselves, establish resistance to cryptanalysis, but they are presented as complementary evidence that the modified design still meets standard statistical expectations for keystream generators.

6. Performance characteristics, practicality, and limitations

The performance evaluation was conducted on an AMD Ryzen 7 5700U with Radeon Graphics at 1.80 GHz, Windows 10 Enterprise 22H2 64-bit, 16 GB RAM, using C implementations of QRE-ChaCha8, ChaCha8, and ChaCha20. File sizes of 10, 20, 30, 40, and 50 MB were tested, each size measured 5 times and averaged.

The reported encryption times are:

File Size	QRE-ChaCha8 (s)	ChaCha8 (s)	ChaCha20 (s)
10 MB	0.1037854	0.1051830	0.2025330
20 MB	0.2096104	0.2115156	0.4061916
30 MB	0.3118018	0.3147998	0.6116970
40 MB	0.4168038	0.4228406	0.8162400
50 MB	0.5273160	0.5308238	1.0211580

The central empirical claim is that QRE-ChaCha8 is almost identical in speed to ChaCha8, whereas ChaCha20 is roughly about twice as slow in these measurements, as expected from more rounds. The authors explicitly exclude QRNG generation time from the timing benchmark, arguing that modern QRNGs exceed 20 Gbps and can be pre-stored in memory, making runtime impact negligible once quantum randomness is available.

The paper is equally explicit about its assumptions and caveats. Quantum random numbers are assumed confidential to the adversary. Their distribution mechanism is not specified in detail. Practical deployment would ideally require post-quantum cryptographic authentication of QRNG delivery. The benchmark does not include QRNG generation latency. The security case rests on reduced-round differential analysis and statistical testing rather than on a formal full-round proof (Liu et al., 24 Jul 2025).

Taken together, these points position QRE-ChaCha as a ChaCha-compatible hardening strategy that preserves the original cipher’s structure and high efficiency while introducing external entropy into both initialization and round processing. The authors further state that it can be viewed as a kind of quantum randomness expansion mechanism. A plausible implication is that its practical value depends not only on the ARX design itself, but also on the trust, confidentiality, and authenticated delivery of the quantum random inputs on which the enhancement relies.