Collision or second preimage for the ChaCha core?
Can we exhibit collisions, or second-preimages (with implies the former), for the ChaCha core? 


No, likely not.

The Salsa20 and ChaCha cores both consist of a large number of "quarter-rounds" each of which is invertible and bijective. The only reason neither core is a bijection (and thus can have collisions) is the final addition of the input elements into the state.

With Salsa20 flipping the high bits works because it doesn't affect the right side of the quarter-round equations:

b ^= (a+d) &lt;&lt;&lt; 7;
c ^= (b+a) &lt;&lt;&lt; 9;
d ^= (c+b) &lt;&lt;&lt; 13;
a ^= (d+c) &lt;&lt;&lt; 18;


Thus, flipping all the high bits flips them all the way through the rounds and is canceled out by the addition of the input data.

The ChaCha quarter-round doesn't have as simple symmetry:

a += b; d ^= a; d &lt;&lt;&lt;= 16;
c += d; b ^= c; b &lt;&lt;&lt;= 12;
a += b; d ^= a; d &lt;&lt;&lt;= 8;
c += d; b ^= c; b &lt;&lt;&lt;= 7;


Different words get affected a different number of times by a bit flip and by a different kind of operation at first, so there is no simple change that would be left untouched by a quarter-round. Finding collisions is probably hard.

I realize this isn't proof, just a sort of handwaving justification.