This paper introduces 'Freestyle' a randomized, and variable round version of the ChaCha cipher. It uses the concept of hash based halting condition, where a decryption attempt with an incorrect key is likely to take longer time to halt.
It works on the following principle: a sender encrypts a block of message using a random number of round (R), which is never shared with the receiver. However, the sender along with the ciphertext shares the hash of the cipher state (or partial cipher-state) after executing R rounds. The hash is sent in cleartext; and the receiver can compute R using the correct key, and the received hash. This expected hash acts as a halting condition for the decryption process.
I don't really understand what the hash halting process adds here. The attacker doesn't need to search incorrect keys forever, just for the maximum possible number of rounds. The small benefit of not having a second key is that the ciphertext is 50% or so larger due to all the hashes provided.
The proposed cipher also amends the first constant of the ChaCha block. This seems bizarre given Bernstein's comments on the constants being carefully chosen.
It seems there are more simple ways to implement a variable round ChaCha than the linked paper. We could use added secret bits to create a stream (using SHA3) of 512 bits that could be read as a series of n bits to add to the rounds. Every iteration of SHA3 would be good to seed the added rounds for about 1024-2048 iterations of ChaCha (assuming additional rounds of 16 or 8).
Does varying the rounds (based on something unrelated to the 256bit ChaCha key) add any security? Or is the main benefit of the proposed cipher in the linked paper the hash halting concept or something else I'm missing?
