Keystream Bits Research Articles

Linear Cryptanalysis of Simplified Trivium

Stream cipher Trivium is one of the seven finalists of the eSTREAM project.In this paper,we apply linear cryptanalysis to the simplified Trivium with the initialization of 288 rounds.The equation,which involves the key bits,initial vector bits and the first keystream bit in linear approximations for 288-round Trivium of Turan,is corrected.In addition,when special Key bits and IV bits are allowed to be chosen,the algorithm to search the linear approximations with the biggest linear bias is presented.Based on this algorithm,3 linear approximations with the same linear bias 2-25are found,which is better than Turan's 2-31.

Performance Analysis Of Secured Synchronous Stream Ciphers

The new information and communication technologies require adequate security. In the past decades ,we have witnessed an explosive growth of the digital storage and communication of data ,triggered by some important breakthroughs such as the Internet and the expansive growth of wireless communications. In the world of cryptography ,stream ciphers are known as primitives used to ensure privacy over communication channel and these are widely used for fast encryption of sensitive data. Lots of old stream ciphers that have been formerly used no longer be considered secure ,because of their vulnerability to newly developed cryptanalysis techniques. Many designs stream ciphers have been proposed in an effort to find a proper candidate to be chosen as world standard for data encryption. From these designs, the stream ciphers which are Trivium,Edon80 and Mickey are implemented in ‘c’ language with out affecting their security .Actually these algorithms are particularly suited for hardware oriented environments which provides considerable security and efficiency aspects. We will be targeting hardware applications, and good measure for efficiency of a stream cipher in this environment is the number of key stream bits generated per cycle per gate. For good efficiency we are approaching two ways .One approach is minimizing the number of gates.The other approach is to dramatically increase the number of bits for cycle. This allows reducing the clock frequency at the cost of an increased gate count. Apart from the implementation the analysis which includes the security of these algorithms against some attacks related to stream ciphers such as guess and deterministic attacks, correlation attacks, divide and conquer attacks and algebraic attacks are presented.

A Constructive Method of Algebraic Attack with Less Keystream Bits

In algebraic attack on stream ciphers based on LFSRs, the secret key is found by solving an overdefined system of multivariate equations. There are many known algorithms from different point of view to solve the problem, such as linearization, relinearization, XL and Grobner Basis. The simplest method, linearization, treats each monomial of different degrees as a new variable, and consists of $\\sum_{i=1}^{d}{n \\choose i}$ variables (the degree of the system of equations is denoted by d). Thus it needs at least $\\sum_{i=1}^{d}{n \\choose i}$ equations, i.e. keystream bits to recover the secret key by Gaussian reduction or other. In this paper we firstly propose a concept, called equivalence of LFSRs. On the basis of it, we present a constructive method that can solve an overdefined system of multivariate equations with less keystream bits by extending the primitive polynomial.

NOCAS : A Nonlinear Cellular Automata Based Stream Cipher

LFSR and NFSR are the basic building blocks in almost all the state of the art stream ciphers like Trivium and Grain-128. However, a number of attacks are mounted on these type of ciphers. Cellular Automata (CA) has recently been chosen as a suitable structure for crypto-primitives. In this work, a stream cipher is presented based on hybrid CA. The stream cipher takes 128 bit key and 128 bit initialization vector (IV) as input. It is designed to produce $\mathrm{2^{128}}$ random keystream bits and initialization phase is made faster 4 times than that of Grain-128. We also analyze the cryptographic strength of this cipher. Finally, the proposed cipher is shown to be resistant against known existing attacks.

셀룰라 오토마타 기반의 수축-삽입 수열의 분석

The shrinking generator which is one of clock-controlled generator is a very simple generator with good cryptographic properties. A nonlinear sequence generator based on two 90/150 maximum length cellular automata can generate pseudorandom sequences at each cell of cellular automata whose characteristic polynomials are same. The nonlinear sequence generated by cellular automata has a larger period and a higher linear complexity than shrunken sequence generated by LFSRs. In this paper we analyze shrunken-interleaved sequence based on 90/150 maximum length cellular automata. We show that the sequence generated by nonlinear sequence generator based on cellular automata belongs to the class of interleaved sequence. And we give an effective algorithm for reconstructing unknown bits of output sequence based on intercepted keystream bits.

Self-shrinking chaotic stream ciphers

In the last two decades, a growing number of chaos-based cipher systems have been suggested for use in cryptographic applications. Most of these systems were subject to cryptanalytic attacks, and many of them were shown to suffer from a lack of security. In this paper, we export the self-shrinking technique used in classical cryptography into chaotic systems to develop chaotic keystream generators capable of generating keystreams featuring very good statistical properties, and possessing high level of security. This paper proposes a sample self-shrinking chaos-based keystream generator implemented using a 1-D chaotic tent map. Randomness properties and results of statistical testing of keystream bits generated by applying the self-shrinking technique on chaotic maps with suitable parameters are found encouraging. Furthermore, chaotic cipher systems based on such technique are demonstrated to have a better performance in terms of randomness properties and security level than many existing cipher systems.

On Guess and Determine Cryptanalysis of LFSR-Based Stream Ciphers

In this paper, the complexity of applying a guess and determine attack to so-called Linear Feedback Shift register (LFSR)-based stream ciphers is analyzed. This family of stream ciphers uses a single or several LFSR and a filtering function F : GF(2) <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</sup> rarr GF(2) <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">m</sup> to generate the blocks of m ges 1 keystream bits at the time. In difference to a classical guess and determine attack, a method based on guessing certain bits in order to determine the remaining secret key/state bits, our approach efficiently takes advantage of the reduced preimage space for relatively large m and at the same time employing the design structure of the cipher. Several variations of the algorithm are derived to circumvent the sensitivity of attack to the input data, n, m and the key length. In certain cases, our attack outperforms classical algebraic attacks; these being considered as one of the most efficient cryptanalyst tools for this type of ciphers. A superior performance of our attack over algebraic attacks is demonstrated in case the filtering function belongs to the extended Maiorana-McFarland class.

IRREGULARLY DECIMATED CHAOTIC MAP(S) FOR BINARY DIGITS GENERATIONS

This paper proposes a new technique for generating random-looking binary digits based on an irregularly decimated chaotic map. We present a class of irregularly decimated chaos-based keystream generators, related to the shrinking generator, for the generation of binary sequences. Each generator consists of two subsystems: a control subsystem and a generating subsystem, where each subsystem is based on a single chaotic map. This chaotic map is presented as a 1-D piecewise chaotic map related to the chaotic logistic map. We conduct an analysis of the dynamical behavior of the proposed map to integrate it as a component in the proposed generators subsystems. The output bits of these keystream generators are produced by applying a threshold function to convert the floating-point iterates of the irregularly decimated map into a binary form. The generated keystream bits are demonstrated to exhibit high level of security, long period length, high linear complexity measure and random-like properties at given certain parameter values. Standard statistical tests on the proposed generators, as well as other keystream generators, are performed and compared.

A New Attack on the Filter Generator

The filter generator is an important building block in many stream ciphers. The generator consists of a linear feedback shift register of length n that generates an m-sequence of period 2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</sup> -1 filtered through a Boolean function of degree d that combines bits from the shift register and creates an output bit z <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">t</sub> at any time t. The previous best attacks aimed at reconstructing the initial state from an observed keystream, have essentially reduced the problem to solving a nonlinear system of D=Sigma <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">i=1</sub> <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">d</sup> (n/i) equations in n unknowns using techniques based on linear algebra. This attack needs about D bits of keystream and the system can be solved in complexity O(D <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">omega</sup> ), where omega can be taken to be Strassen's reduction exponent omega=log <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sub> (7)ap2.807. This paper describes a new algorithm that recovers the initial state of most filter generators after observing O(D) keystream bits with complexity O((D-n)/2)apO(D), after a pre-computation with complexity O(D(log <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sub> D) <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">3</sup> )

Cryptanalysis of Achterbahn-128/80

A key recovery attack on the stream cipher Achterbahn-128/80, a cipher in the second phase of eSTREAM, is given. The key observation is a high dependency between some input bits to the Boolean combining function generating the keystream. It results in the first known attacks on both the 128-bit and the 80-bit variants of the cipher. The number of keystream bits required in the attacks is less than 264, the maximum frame length.

Two New Attacks on the Self-Shrinking Generator

The self-shrinking generator was introduced in 1994. It is based on the idea behind the shrinking generator and despite its simplicity it has remained remarkably resistant to efficient attacks. Several known plaintext attacks have been proposed on the generator, some operating on a short keystream and others requiring a longer sequence to succeed. In this paper, two new attacks on the self-shrinking generator are proposed. The first attack, using a short known keystream, has the same complexity as the BDD-based attack, which is the best previously known attack. However, while the BDD-based attack requires a huge amount of memory, the proposed algorithm uses almost no memory, leaving it as the preferred alternative. The second attack operates on a longer known keystream, exponential in the length of the LFSR. The attack considers one or several segments of keystream bits and guesses that these bits stem from LFSR segments of some size. It is shown that this attack achieves better complexity than any previously known attack

Using Linear Hybrid Cellular Automata to Attack the Shrinking Generator

The aim of this research is the efficient cryptanalysis of the Shrinking Generator through its characterization by means of Linear Hybrid Cellular Automata. This paper describes a new known-plaintext attack based on the computation of the characteristic polynomials of sub-automata and on the generation of the Galois field associated to one of the Linear Feedback Shift Registers components of the generator. The proposed algorithm allows predicting with absolute certainty, many unseen bits of the keystream sequence, thanks to the knowledge of both registers lengths, the characteristic polynomial of one of the registers, and the interception of a variable number of keystream bits.

Three ways to mount distinguishing attacks on irregularly clocked stream ciphers

Many stream ciphers use irregular clocking to introduce non-linearity to the keystream. We present three distinguishers on irregularly clocked linear feedback shift registers. The general idea used is to find suitable linear combinations of keystream bits, here called samples, that are drawn from a biased distribution. We describe how to place windows around the estimated positions around members of the linear combinations, and very efficiently create many samples with low computational complexity. We also describe ideas based on constructing samples consisting of vectors of bits (words) instead of single binary samples. These vectors based methods can distinguish the cipher using fewer keystream bits but sometimes require a higher computational complexity.

Shorter Bit Sequence Is Enough to Break Stream Cipher LILI-128

LILI-128 is the stream cipher proposed as a candidate cipher for the New European Schemes for Signatures, Integrity, and Encryption (NESSIE) Project. Some methods of breaking it more efficiently than an exhaustive search for its secret key have been found already. The authors propose a new method, which uses shorter bit sequence to break LILI-128 successfully. An attack that can be made with less data can be a more practical threat. With only 2/sup 7/ bits of keystream, this method can break LILI-128 successfully. The efficiency of our attack depends on the memory size. For example, with 2/sup 99.1/ computations, our attack breaks LILI-128, if 2/sup 28.6/-bit memory is available.

Cryptanalysis of three mutually clock-controlled stop/go shift registers

A binary stream cipher consisting of three short linear-feedback shift registers (LFSRs) of total length 64 that are mutually clocked in the stop/go manner is cryptanalyzed in the known keystream sequence scenario. To reconstruct the internal state candidates at a known time from about 64 known keystream bits, two algorithms are developed. One is based on guessing a number of elements of the clock-control sequence and has a computational complexity of about 2/sup 40/ steps, where the average step complexity is comparable to the step complexity of the exhaustive search method. The other exploits a time-memory tradeoff based on the well-known birthday paradox and is successful if approximately T/spl middot/M/spl ges/2/sup 64/, where T is the required computational time in table lookups and M is the memory in 64-bit words. As the state-transition function is not one-to-one, to recover the initial state from the internal state candidates, two algorithms are introduced. One consists in guessing the number of clocks for each of the LFSRs. The other consists in the reversion of the internal states and is based on the theory of critical and subcritical branching processes.

Linear models for a time-variant permutation generator

A keystream generator, known as RC4, consisting of a permutation table that slowly varies in time under the control of itself, is analyzed by the linear model approach. The objective is to find linear relations among the keystream bits that hold with probability different from one half by using the linear sequential circuit approximation method. To estimate the corresponding correlation coefficients, some interesting correlation properties of random Boolean functions are derived. It is thus shown that the second binary derivative of the least significant hit output sequence is correlated to 1 with the correlation coefficient close to 15/spl middot/2/sup -3n/ where n is the variable word size of RC4. The output sequence length required for the linear statistical weakness detection is then around 64/sup n//225. The result can be used to distinguish RC4 from other keystream generators and to determine the unknown parameter n, as well as for the plaintext uncertainty reduction if n is small.

Cryptanalysis of ‘Labyrinth’ streamcipher

Cryptanalysis of the stream cipher ‘Labyrinth’, a cipher recently proposed by Lin and Shepherd, is performed. Given only 230 known bits of keystream, the 119 bit key of Labyrinth is recovered in under a second of computation using a DEC Alpha.