Algebraic Normal Form Research Articles

Application and comparison of different classification methods based on symptom analysis with traditional classification technique for breast cancer diagnosis

Novel approach for classification technique such as Artificial Neural Network (ANN), Linear Discriminant Analysis (LDA) and Random Forest (RF) using factor or dichotomic variables has been introduced. This study searches for the highly informative finitely linear combinations (symptoms) of variables in the finite field on the based of the Fisher’s exact test and accurately predict the target class for each case in the data. There are several super symptoms have comparable p-values. In this case, it becomes possible to choose as a nominative representative the factor which is more accessible for interpretation. The super symptom means a linear combination of various multiplications of k dichotomous variables over a field of characteristic 2 without repeating. In algebra, such functions are called Zhegalkin polynomials or algebraic normal forms.

Symptom analysis of multidimensional categorical data with applications

The linear combinations of dichotomous variables over the field F_2, which are called symptoms, form the projective space from which it is possible select the more informative subspaces for reducing the dimensionality of binary data. In this article, the symptom space expands to the super-symptom space. The super-symptom means a linear combination of various multiplications of k dichotomous variables over a field of characteristic 2 without repeating. In algebra, such functions are called Zhegalkin polynomials or algebraic normal forms. It is known that each logical function can be represented in the form of a Zhegalkin polynomial in a unique way, therefore using them to iterate one can find a logical function to best describe a risk group. The search algorithm of a more informative super-symptom for classification is based on the superposition of impulse sequences with different types of operations: first multiplication and then addition over the F_2 field. Also the super-symptom analysis is a convenient method for a study of the correlation between two sets of categorical variables. This method was applied to identify the most severe forms of the disease by combining hormonal, immunological and genetic tests in patients with breast cancer (data from Cancer Oncology Hospital in Medicine City in Baghdad) and to identify genetic risk factors by patients with alcohol dependence syndrome, receiving alcohol dependence therapy (St.Petersburg V.M. Bekhterev Psychoneurological Research Institute).

Quantum algorithms for learning the algebraic normal form of quadratic Boolean functions

Quantum algorithms for the analysis of Boolean functions have received a lot of attention over the last few years. The algebraic normal form (ANF) of a linear Boolean function can be recovered by using the Bernstein–Vazirani (BV) algorithm. No research has been carried out on quantum algorithms for learning the ANF of general Boolean functions. In this paper, quantum algorithms for learning the ANF of quadratic Boolean functions are studied. We draw a conclusion about the influences of variables on quadratic functions, so that the BV algorithm can be run on them. We study the functions obtained by inversion and zero-setting of some variables in the quadratic function and show the construction of their quantum oracle. We introduce the concept of “club” to group variables that appear in quadratic terms and study the properties of clubs. Furthermore, we propose a bunch of algorithms for learning the full ANF of quadratic Boolean functions. The most efficient algorithm, among those we propose, provides an O(n) speedup over the classical one, and the number of queries is independent of the degenerate variables.

Algebraic method to recover superpolies in cube attacks

Cube attacks are an important type of key recovery attacks against nonlinear feedback shift register (NFSR)-based cryptosystems. The key step in cube attacks closely related to key recovery is recovering superpolies. However, in the previous cube attacks including original, division property based and correlation cube attacks, the algebraic normal form of superpolies could hardly be shown to be exact due to an unavoidable failure probability or a requirement of large time complexity. In this study, the authors propose an algebraic method aiming at recovering the exact algebraic normal forms of superpolies practically. The proposed method is developed based on the degree of evaluation method proposed by Liu in Crypto 2017. As an illustration, the authors apply the proposed method to Trivium. As a result, they recover the algebraic normal forms of some superpolies for the 818-, 835-, 837- and 838-round Trivium. Based on these superpolies, the authors could mount key-recovery attacks on 818-, 835-, 837- and 838-round Trivium with the worst complexity slightly lower than a brute-force attack. Besides, for the cube proposed by Liu in Crypto 2017 as a zero-sum distinguisher for the 838-round Trivium, it is proved that its superpoly is not zero-constant. Hopefully, the proposed method would provide some new insights on cube attacks against NFSR-based ciphers.

SYNTHESIS METHOD OF TERNARY BENT-FUNCTIONS OF THREE VARIABLES

Context. Such perfect algebraic constructions of many-valued logic as ternary bent-functions and their truth tables which are called as 3-bent-sequences, are used very often in modern cryptographic algorithms, in particular, in pseudorandom sequence generators. However, today there are no methods for synthesizing the ternary bent-functions class for a number of variables greater than two, which significantly limits the ability to scale the number of protection levels of the of pseudorandom sequence generators based on the ternary bent-functions. This circumstance generates the task of developing methods for the synthesis of ternary bent-functions, which is solved in this paper for the case of ternary bent-functions of three variables. The object of this research is the process of efficiency increasing of the cryptographic algorithms based on the functions of many-valued logic.Objective. The purpose of the paper is to construct a method for the synthesis of the set of ternary bent-functions of three variables.Method. The mathematical apparatus of the Reed-Muller transform (algebraic normal form) was used as the basis of the proposed constructive method for the synthesis of ternary bent-functions of three variables. So, on the basis of the established properties of the algebraic normal form of ternary bent-functions and limited enumeration, the search for ternary bent-functions up to affine terms is performed, after which we apply the procedure of reproduction.Results. As a result of using of the proposed method for the synthesis of ternary bent-functions of three variables, 155844 3-bentsequences were found up to an affine term, while the cardinality of the full set of found 3-bent-sequences is 12623364. The research performed made it possible to determine that in this set there are 3-bent-sequences of six different weight structures, on the basis of which 12 different triple sets can be compiled for use in pseudorandom sequence generators. A scheme for a cryptographically stable pseudorandom sequence generator based on the found set of 3-bent-sequences of length N = 27 is proposed. It is shown that the protection levels number of such a generator of pseudorandom sequences is 41 7.041 10    which is comparable with the protection levels number of modern block symmetric cryptographic algorithms, for example, AES-128.Conclusions. The further development of modern cryptographic algorithms, in particular, cryptographically stable pseudorandom sequence generators, is largely based on the use of perfect algebraic constructions of many-valued logic. For the first time, a constructive method for the synthesis of ternary bent-functions of three variables is proposed. For the found set of ternary bent-functions, the distribution of weight structures is found, and the possible triple sets are established. Based on the constructed set of ternary bentfunctions, a pseudorandom sequence generator scheme is proposed that has a protection levels number that is comparable with modern block symmetric cryptographic algorithms. We note that the constructed class of ternary bent-functions can also be used for the synthesis of cryptographically strong S-boxes, codes of constant amplitude, as well as error correction codes. As an actual area of further research, we can note the development of methods for the synthesis of ternary bent-functions of a larger number of variables.

Affine equivalence for quadratic rotation symmetric Boolean functions

Let $$f_n(x_0, x_1, \ldots , x_{n-1})$$ denote the algebraic normal form (polynomial form) of a rotation symmetric (RS) Boolean function of degree d in $$n \ge d$$ variables and let $$wt(f_n)$$ denote the Hamming weight of this function. Let $$(0, a_1, \ldots , a_{d-1})_n$$ denote the function $$f_n$$ of degree d in n variables generated by the monomial $$x_0x_{a_1} \ldots x_{a_{d-1}}.$$ Such a function $$f_n$$ is called monomial rotation symmetric (MRS). It was proved in a 2012 paper that for any MRS $$f_n$$ with $$d=3,$$ the sequence of weights $$\{w_k = wt(f_k):~k = 3, 4, \ldots \}$$ satisfies a homogeneous linear recursion with integer coefficients. This result was gradually generalized in the following years, culminating around 2016 with the proof that such recursions exist for any rotation symmetric function $$f_n.$$ Recursions for quadratic RS functions were not explicitly considered, since a 2009 paper had already shown that the quadratic weights themselves could be given by an explicit formula. However, this formula is not easy to compute for a typical quadratic function. This paper shows that the weight recursions for the quadratic RS functions have an interesting special form which can be exploited to solve various problems about these functions, for example, deciding exactly which quadratic RS functions are balanced.

Efficient design methods of low-weight correlation-immune functions and revisiting their basic characterization

Correlation immunity (CI) of Boolean functions is an important concept relevant both in the design of nonlinear combiners and for the protection against side-channel cryptanalysis to name a few applications. In this article we give further simplification of the proofs of some known characterizations of these functions, including some new results related to certain properties of the algebraic normal form of these functions. We also provide two efficient constructions of CI functions, thus extending the known construction methods. In particular, a special case of our first construction method is well suited for construction of low-weight CI functions. It is shown that Carlet and Chen conjecture (Carlet and Chen, 2018) on the minimum weight of 3-CI functions (equivalent to the existence of Hadamard matrices of order n=4k) is valid for a great variety of input sizes n, thus apart from the case n=2k which was already proved in Carlet and Chen (2018). This further confirms that the conjecture might be correct for any input size n.

Design and Implementation of a Statistical Testing Framework for a Lightweight Stream Cipher

The Shrinking Generator (SG) is a popular synchronous, lightweight stream cipher that uses minimal computing power. However, its strengths and weaknesses have not been studied in detail. This paper proposes a statistical testing framework to assess attacks on the SG. The framework consists of a d-monomial test that is adapted to SG by applying the algebraic normal form (ANF) representation of Boolean functions, a test that uses the maximal degree monomial test to determine whether the ANF follows the proper mixing of bit values, and a proposed unique window size (UWS) scheme to test the randomness properties of the keystream. The proposed framework shows significant weaknesses in the SG output in terms of dependence between the controlling linear-feedback shift register (LFSR) and non-linearity of the resulting keystream. The maximal degree monomial test provides a better understanding of the optimal points of SG, demonstrating when it is at its best and worst according to the first couple of results. This paper uses UWS to illustrate the effect of the LFSR choice on possibly distinguishing attacks on the SG. The results confirm that the proposed UWS scheme is a viable measure of the cryptographic strength of a stream cipher. Due to the importance of predictability and effective tools, we used neural network models to simulate the input data for the pseudo-random binary sequences. Through the calculation of UWS, we obtained solid results for the predictions.

On the Annihilators of Boolean Polynomials

Boolean functions in general and Boolean polynomials (Zhegalkin polynomials or algebraic normal forms (ANF)) in particular are the subject of theoretical and applied studies in various fields of computer science. This article addresses the linear operators of the space of Boolean polynomials in n variables, which leads to the results on the problem of finding the minimum annihilator degree for a given Boolean polynomial. This problem is topical in various analytical and algorithmic aspects of cryptography. Boolean polynomials and their combinatorial properties are under study in discrete analysis. The theoretical foundations of information security include the study of the properties of Boolean polynomials in connection with cryptography. In this article, we prove a theorem on the minimum annihilator degree. The class of Boolean polynomials is described for which the degree of an annihilator is at most 1. We give a few combinatorial characteristics related to the properties of the space of Boolean polynomials. Some estimates of the minimum degree of an annihilator are given. We also consider the case of symmetric polynomials.

On the Relationship between Boolean Algebra and Quantum Informatics

The fundamental relationship between quantum physics and discrete mathematics is examined. A method for representing Boolean functions in the form of unitary transformations is described. The question of the connection of Zhegalkin polynomials defining the algebraic normal form of a Boolean function with quantum circuits is considered. It is shown that the quantum information language provides a simple algorithm for constructing the Zhegalkin polynomial based on the truth table. The developed methods and algorithms are generalized to the case of an arbitrary Boolean function with a multibit domain of definition and a multibit set of values, as well as to the case of multivalued ($$k$$-value) logic when $$k = p$$ is a prime number. The developed approach is important for the implementation of quantum computer technologies and is the foundation for the transition from classical computer logic to quantum hardware.

On the computation of the Möbius transform

The Möbius transform is a crucial transformation into the Boolean world; it allows to change the Boolean representation between the True Table and Algebraic Normal Form. In this work, we introduce a new algebraic point of view of this transformation based on the polynomial form of Boolean functions. It appears that we can perform a new notion: the Möbius computation variable by variable and new computation properties. As a consequence, we propose new algorithms which can produce a huge speed up of the Möbius computation for sub-families of Boolean function. Furthermore we compute directly the Möbius transformation of some particular Boolean functions. Finally, we show that for some of them the Hamming weight is directly related to the algebraic degree of specific factors.

Efficient On-Chip Randomness Testing Utilizing Machine Learning Techniques

Randomness testing is an important procedure that bit streams, produced by critical cryptographic primitives such as encryption functions and hash functions, have to undergo. In this paper, a new hardware platform for the randomness testing is proposed. The platform exploits the principles of genetic programming, which is a machine learning technique developed for the automated program and circuit design. The platform is capable of evolving efficient randomness distinguishers directly on a chip. Each distinguisher is represented as a Boolean polynomial in the algebraic normal form. The randomness testing is conducted for bit streams that are either stored in an on-chip memory or generated by a circuit placed on the chip. The platform is developed with a Xilinx Zynq-7000 All Programmable System on Chip that integrates a field programmable gate array with on-chip ARM processors. The platform is evaluated in terms of the quality of randomness testing, performance, and resources utilization. With power budget less than 3 W, the platform provides comparable randomness testing capabilities with the standard testing batteries running on a personal computer.

Discrete antiderivatives for functions over mathop {{mathbb {F}}}_p^n

In the design of cryptographic functions, the properties of their discrete derivatives have to be carefully considered, as many cryptographic attacks exploit these properties. One can therefore attempt to first construct derivatives with the desired properties and then recover the function itself. Recently Suder developed an algorithm for reconstructing a function (also called antiderivative) over the finite field mathop {{mathbb {F}}}_{2^n} given its discrete derivatives in up to n linearly independent directions. Pasalic et al. also presented an algorithm for determining a function over mathop {{mathbb {F}}}_{p^n} given one of its derivatives. Both algorithms involve solving a p^n times p^n system of linear equations; the functions are represented as univariate polynomials over mathop {{mathbb {F}}}_{p^n}. We show that this apparently high computational complexity is not intrinsic to the problem, but rather a consequence of the representation used. We describe a simpler algorithm, with quasilinear complexity, provided we work with a different representation of the functions. Namely they are polynomials in n variables over mathop {{mathbb {F}}}_{p} in algebraic normal form (for p>2, additionally, we need to use the falling factorial polynomial basis) and the directions of the derivatives are the canonical basis of mathop {{mathbb {F}}}_{p}^n. Algorithms for other representations (the directions of the derivatives not being the canonical basis vectors or the univariate polynomials over mathop {{mathbb {F}}}_{p^n} mentioned above) can be obtained by combining our algorithm with converting between representations. However, the complexity of these conversions is, in the worst case, exponential. As an application, we develop a method for constructing new quadratic PN (Perfect Nonlinear) functions. We use an approach similar to the one of Suder, who used antiderivatives to give an alternative formulation of the methods of Weng et al. and Yu et al. for searching for new quadratic APN (Almost Perfect Nonlinear) functions.

Generic Constructions of Five-Valued Spectra Boolean Functions

Whereas the design and properties of bent and plateaued functions have been frequently addressed during the past few decades, there are only a few design methods of the so-called five-valued spectra Boolean functions whose Walsh spectra take the values in $\{0, \pm 2^{\lambda _{1}}, \pm 2^{\lambda _{2}}\}$ . Moreover, these design methods mainly regard the specification of these functions in their algebraic normal form (ANF) domain. In this paper, we give a precise characterization of this class of functions in their spectral domain using the concept of a dual of plateaued functions. Both necessary and sufficient conditions on the Walsh support of these functions are given, which then connects their design (in the spectral domain) to a family of the so-called totally (non-overlap) disjoint spectra plateaued functions . We identify some suitable families of plateaued functions having this property, thus providing some generic methods in the spectral domain. Furthermore, we also provide an extensive analysis of their constructions in the ANF domain and provide several generic design methods. The importance of this class of functions is manifolded, where apart from being suitable for some cryptographic applications, we emphasize their property of being constituent functions in the so-called four-bent decomposition.

4‐bit Boolean functions in generation and cryptanalysis of secure 4‐bit crypto S‐boxes

AbstractIn modern ciphers of commercial computer cryptography, 4‐bit crypto substitution boxes or 4‐bit crypto S‐boxes have been of utmost importance since the late 1960s. Since then, the 4‐bit Boolean functions (BFs) have been proved to be the best tool to generate the said 4‐bit crypto S‐boxes. In this article, the crypto‐related properties of the 4‐bit BFs, such as the algebraic normal form (ANF) of the 4‐bit BFs, the balancedness, the linearity, the nonlinearity, the affinity and nonaffinity of the 4‐bit BFs, and the strict avalanche criterion (SAC) of 4‐bit BFs, are studied in detail. An exhaustive study of 4‐bit BFs with some new observations and algorithms on SAC of 4‐bit BFs is also reported in this article. In the end of 1990s, the Galois field polynomials over Galois field GF(28) are in use to generate the 8‐bit crypto S‐box of the Advance Encryption Standard. A detailed study on generation of the 4‐bit crypto S‐boxes with such Galois field polynomials over the binary as well as nonbinary extended Galois fields is also given in this article. The generated 4‐bit crypto S‐boxes are analyzed with four cryptanalysis techniques and the well‐defined SAC algorithms of 4‐bit crypto S‐boxes to search for the best possible 4‐bit crypto S‐boxes. Some existing 4‐bit crypto S‐boxes such as the thirty‐two 4‐bit crypto S‐boxes of the data encryption standard (DES) and the four 4‐bit crypto S‐boxes of the two variants of the Lucifer are analyzed to report the weakness of such S‐boxes. A comparative study of the ancient as well as the modern 4‐bit crypto S‐boxes with the generated 4‐bit crypto S‐boxes proves the said generated 4‐bit crypto S‐boxes to be the best possible one.

Designing Plateaued Boolean Functions in Spectral Domain and Their Classification

The design of plateaued functions over $GF(2)^n$, also known as 3-valued Walsh spectra functions (taking the values from the set $\{0, \pm 2^{\lceil \frac{n+s}{2} \rceil}\}$), has been commonly approached by specifying a suitable algebraic normal form which then induces this particular Walsh spectral characterization. In this article, we consider the reversed design method which specifies these functions in the spectral domain by specifying a suitable allocation of the nonzero spectral values and their signs. We analyze the properties of trivial and nontrivial plateaued functions (as affine inequivalent distinct subclasses), which are distinguished by their Walsh support $S_f$ (the subset of $GF(2)^n$ having the nonzero spectral values) in terms of whether it is an affine subspace or not. The former class exactly corresponds to partially bent functions and admits linear structures, whereas the latter class may contain functions without linear structures. A simple sufficient condition on $S_f$, which ensures the nonexistence of linear structures, is derived and some generic design methods of nontrivial plateaued functions without linear structures are given. The extended affine equivalence of plateaued functions is also addressed using the concept of dual of plateaued functions. Furthermore, we solve the problem of specifying disjoint spectra (non)trivial plateaued functions of maximal cardinality whose concatenation can be used to construct bent functions in a generic manner. This approach may lead to new classes of bent functions due to large variety of possibilities to select underlying duals that define these disjoint spectra plateaued functions. An additional method of specifying affine inequivalent plateaued functions, obtained by applying a nonlinear transform to their input domain, is also given.

О кубической части алгебраической нормальной формы произвольной бент-функции

О кубической части алгебраической нормальной формы произвольной бент-функции

On conversions from CNF to ANF

In this paper we discuss conversion methods from the conjunctive normal form (CNF) to the algebraic normal form (ANF) of a Boolean function. Whereas the reverse conversion has been studied before, the CNF to ANF conversion has been achieved predominantly via a standard method which tends to produce many polynomials of high degree. Based on a block-building mechanism, we design a new blockwise algorithm for the CNF to ANF conversion which is geared towards producing fewer and lower degree polynomials. In particular, we look for as many linear polynomials as possible in the converted system and check that our algorithm finds them. As an application, we suggest a new algebraic extension of the resolution calculus which is tailored to the output of the standard CNF to ANF conversion algorithm. Experiments show that the ANF produced by our algorithm outperforms the standard conversion in “real life” examples originating from cryptographic attacks, and that our algebraic resolution algorithm solves some SAT instances which are notoriously hard for SAT solvers.

Unicyclic strong permutations

In this paper, we study some properties of a certain kind of permutation $\sigma$ over $\mathbb{F}_{2}^{n}$, where $n$ is a positive integer. The desired properties for $\sigma$ are: (1) the algebraic degree of each component function is $n-1$; (2) the permutation is unicyclic; (3) the number of terms of the algebraic normal form of each component is at least $2^{n-1}$. We call permutations that satisfy these three properties simultaneously unicyclic strong permutations. We prove that our permutations $\sigma$ always have high algebraic degree and that the average number of terms of each component function tends to $2^{n-1}$. We also give a condition on the cycle structure of $\sigma$. We observe empirically that for $n$ even, our construction does not provide unicylic permutations. For $n$ odd, $n \leq 11$, we conduct an exhaustive search of all $\sigma$ given our construction for specific examples of unicylic strong permutations. We also present some empirical results on the difference tables and linear approximation tables of $\sigma$.

A New Method for Finding Affine Sub-Families of NFSR Sequences

In this paper, a new and efficient method for solving affine sub-families included in a family of nonlinear feedback shift register (NFSR) sequences is proposed. The linear case is focused on since the affine case is an analogy. Let f(x <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">0</sub> ,x <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sub> ,...,x <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</sub> ) = x <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">0</sub> ⊕f <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sub> (x <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sub> ,...,x <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n-1</sub> )⊕x <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</sub> be a characteristic function of an n-stage NFSR, where n is a positive integer. Let deg(f) = d > 1 and f <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">[d]</sub> be the summation of all terms in the algebraic normal form of f whose degrees attain the maximum d. First, it is proved that every linear sub-family of G(f) is a sub-family of linear feedback shift register sequences generated by a characteristic polynomial of the form Σ <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">i∈S</sub> c <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">i</sub> x <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">i</sup> , where c <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">i</sub> ∈ F <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sub> and S consists of all subscripts of variables appearing in f <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">[d]</sub> . That is to say, every linear sub-family of G( f ) is a factor of some polynomial Σ <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">i∈S</sub> c <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">i</sub> x <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">i</sup> over the finite field F <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sub> . This result is a well generalization of linear recurring sequences theory since it also holds if d = 1. Based on this result, a candidate set of linear sub-families could be obtained by polynomial factorizations over F <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sub> . Second, we propose a new method to verify a linear sub-family whose memory requirement and time complexity are clearer than the previous method. For instance, all affine sub-families of the 160-bit main register used in Grain v1 could be determined within two seconds by a PC using the new method in this paper, which is unobtainable for previous algorithms.