  We show that the underlying permutation of ChaCha20 stream cipher does not
behave as a random permutation for up to 17 rounds with respect to rotational
cryptanalysis. In particular, we derive a lower and an upper bound for the
rotational probability through ChaCha quarter round, we show how to extend the
bound to a full round and then to the full permutation. The obtained bounds
show that the probability to find what we call a parallel rotational collision
is, for example, less than $2^{-488}$ for 17 rounds of ChaCha permutation,
while for a random permutation of the same input size, this probability is
$2^{-511}$. We remark that our distinguisher is not an attack to ChaCha20
stream cipher, but rather a theoretical analysis of its internal permutation
from the point of view of rotational cryptanalysis.
