LIZARD – A Lightweight Stream Cipher for Power-constrained Devices

Matthias Hamann,Matthias Krause,Willi Meier

doi:10.46586/tosc.v2017.i1.45-79

Abstract

Time-memory-data (TMD) tradeoff attacks limit the security level of many classical stream ciphers (like E0, A5/1, Trivium, Grain) to 1/2n, where n denotes the inner state length of the underlying keystream generator. In this paper, we present Lizard, a lightweight stream cipher for power-constrained devices like passive RFID tags. Its hardware efficiency results from combining a Grain-like design with the FP(1)-mode, a recently suggested construction principle for the state initialization of stream ciphers, which offers provable 2/3n-security against TMD tradeoff attacks aiming at key recovery. Lizard uses 120-bit keys, 64-bit IVs and has an inner state length of 121 bit. It is supposed to provide 80-bit security against key recovery attacks. Lizard allows to generate up to 218 keystream bits per key/IV pair, which would be sufficient for many existing communication scenarios like Bluetooth, WLAN or HTTPS.

Highlights

Stream ciphers have a long history when it comes to protecting digital communication
In [Kra02], Krause introduced the idea of using binary decision diagrams (BDDs) to attack linear feedback shift register (LFSR)-based stream ciphers like A5/1 of the GSM standard or E0 of Bluetooth
In [Küç06], Küçük first pointed out a sliding property of Grain v1, which was later formally published by De Cannière, Küçük and Preneel in [DCKP08] as: “For a fraction of 2−2·n of pairs (K, IV ), there exists a related pair (K∗, IV ∗) which produces an identical but n-bit shifted key stream.”

Summary

Introduction

Stream ciphers have a long history when it comes to protecting digital communication. Rivest designed RC4 [Sch95], which was later used in SSL/TLS [DR08] and the wireless network security protocols WEP [Ins97] and TKIP (often called WPA) [Ins04]. E0 and A5/1 have been shown to be highly insecure (see, e.g., [LMV05] and [BB06]) and RC4 shows severe vulnerabilities, which led to its removal from the TLS protocol [Pop15] and rendered other protocols like WEP insecure [FMS01]. In 2004, the eSTREAM project [ECR08] was started in order to identify new stream ciphers for different application profiles. In the hardware category, aiming at devices with restricted resources, three ciphers are still part of the eSTREAM portfolio after the latest revision in 2012: Grain v1 [HJM06], MICKEY 2.0 [BD06] and Trivium [CP05]

Methods

Results

Conclusion