Keystream Bits Research Articles

A practical key recovery attack on the lightweight WG-5 stream cipher

WG-5 is a lightweight stream cipher proposed for usage in the resource-constrained devices, e.g., passive RFID tags, industrial controllers, contactless smart cards and sensors. In this paper, a weakness called slide property of WG-5 which has not been discovered in previous works is for the first time explored and analyzed. The result shows that the probability that two related key-IV pairs of WG-5 generate the shifted keystreams can be up to 2−20, which is significantly high compared with an ideal stream cipher that generates the random keystreams. The correctness and accuracy of this theoretical probability is confirmed experimentally. Based on the slide property of WG-5, some key recovery attacks on WG-5 in the related key setting are proposed. The cryptanalytic result shows that the 80-bit secret key of WG-5 can be recovered with a time complexity of 225.615, requiring 6 related keys and 80 keystream bits for each of 224.585 chosen IVs. The experimental result validates our attack and shows that WG-5 can be broken within about 92.054 seconds on a common PC in the related key setting. These results imply that the design of WG-5 is far from optimal and needs to be strengthened to provide enough security for the lightweight constrained applications.

Cryptographic Grade Chaotic Random Number Generator Based on Tent-Map

In recent years, there has been an increasing interest in employing chaotic-based random number generators for cryptographic purposes. However, many of these generators produce sequences that lack the necessary strength for cryptographic systems, such as Tent-Map. However, these generators still suffer from common issues when generating random numbers, including issues related to speed, randomness, lack of statistical properties, and lack of uniformity. Therefore, this paper introduces an efficient pseudo-random number generator, called State-Based Tent-Map (SBTM), based on a modified Tent-Map, which addresses this and other limitations by providing highly robust sequences suitable for cryptographic applications. The proposed generator is specifically designed to generate sequences with exceptional statistical properties and a high degree of security. It utilizes a modified 1D chaotic Tent-Map with enhanced attributes to produce the chaotic sequences. Rigorous randomness testing using the Dieharder test suite confirmed the promising results of the generated keystream bits. The comprehensive evaluation demonstrated that approximately 97.4% of the tests passed successfully, providing further evidence of the SBTM’s capability to produce sequences with sufficient randomness and statistical properties.

Conditional TMDTO as a MILP Instance

Conditional Time-Memory-Data Trade-off (TMDTO) attack given by Biryukov and Shamir can be reduced to the following problem: “Find the minimum number of state bits that should be fixed in order to recover the maximum number of state bits by utilizing the keystream bits and value of rest of the state bits”. As per our literature survey, existing algorithms search for state bits that should be fixed (as minimum as possible) in order to recover the maximum possible state bits directly through the keystream bits. However, those algorithms are cipher specific and require extensive manual effort in analyzing the keystream bit equations. In this manuscript, we have constructed an automated framework that is easy to implement and solves the above problem (for the case when bits are fixed to 0) for any NLFSR based stream cipher with better complexity, thereby reducing manual efforts. However, we do not claim any global optimum for fixed bits. We tried to reduce the number of fixed bits as much as possible. To show that our algorithm is applicable to a majority of NLFSR based stream ciphers, we implement it on three different stream ciphers: LIZARD, GRAIN-128a and ESPRESSO. It improves all existing TMDTO results on these ciphers. The framework involves modelling keystream bit equations into a set of linear constraints, which is then solved by using a Mixed Integer Linear Programming (MILP) solver, Gurobi. The advantages of our automated framework over other methods are that we can achieve better results with far less effort, and it can be applied to any stream cipher of a similar structure with very ease. To the best of our knowledge, our MILP model is the first work that converts the conditional TMDTO of a stream cipher into a linear optimization problem. As a consequence, for LIZARD cipher, we reduce the number of fixed bits by 20 bits from the previous best result when the number of recovered bits is 18. In the case of GRAIN-128a, the highest reduction in the number of fixed bits is by 34 bits when the number of recovered bits is 35. Lastly, for ESPRESSO cipher, the reduction is by 7 bits when the number of recovered bits is 35.

A New Approach for Side Channel Analysis on Stream Ciphers and Related Constructions

Side Channel Analysis (SCA) is among the newly emerged threats to small scale devices performing a cryptographic operation. While such analysis is well studied against the block ciphers, we observe that the stream cipher counterpart is not that much explored. We propose novel modelling that can work with a number of stream ciphers and related constructions. We show practical state/key recovery attacks on the lightweight ciphers, LIZARD, PLANTLET and GRAIN-128-AEAD. We consider the software platform (where the Hamming weight leakage is available) as well as the hardware platform (where the Hamming distance leakage is available). Through the modelling of Satisfiability Modulo Theory (SMT), we show that the solution can be obtained in a matter of seconds in most cases. In a handful of cases, however, the entire state/key recovery is not feasible in a practical amount of time. For those cases, we show full recovery is possible when a small number of bits are guessed. We also study the effect of increasing/decreasing the number of keystream bits on the solution time. Following a number of literature, we initially assume the traces that are obtained are noiseless. Later, we show how an extension of our model can deal with the noisy traces (which is a more general assumption).

On Grain-Like Small State Stream Ciphers Against Fast Correlation Attacks: Cryptanalysis of Plantlet, Fruit-v2 and Fruit-80

Abstract The fast correlation attack (FCA) is one of the most important cryptanalytic techniques against LFSR-based stream ciphers. In CRYPTO 2018, Todo et al. found a new property for the FCA and proposed a novel algorithm which was successfully applied to the Grain family of stream ciphers. Nevertheless, these techniques cannot be directly applied to Grain-like small state stream ciphers with keyed update, such as Plantlet, Fruit-v2 and Fruit80. In this paper, we study the security of Grain-like small state stream ciphers by the FCA. We first observe that the number of required parity-check equations can be reduced when there are multiple different parity-check equations. With exploiting the Skellam distribution, we introduce a sufficient condition to identify the correct LFSR initial state and derive a new relationship between the number and bias of the required parity-check equations. Then, a modified algorithm is presented based on this new relationship, which can recover the LFSR initial state no matter what the round key bits are. Under the condition that the LFSR initial state is known, an algorithm is given against the degraded system and to recover the NFSR state at some time instant, along with the round key bits. As cases study, we apply our cryptanalytic techniques to Plantlet, Fruit-v2 and Fruit-80. As a result, for Plantlet, our attack takes $ 2^{73.75} $ time complexity and $ 2^{73.06} $ keystream bits to recover the full 80-bit key. Regarding Fruit-v2, $ 2^{55.34} $ time complexity and $ 2^{55.62} $ keystream bits are needed to determine the secret key. As for Fruit-80, $2^{64.47}$ time complexity and $2^{62.82}$ keystream bits are required to recover the secret key. More flexible attacks can be obtained with lower data complexity at the cost of increasing the attack time. Especially, for Fruit-v2, a key recovery attack can be launched with data complexity of $2^{42.38}$ and time complexity of $2^{73.31}$. Moreover, we have implemented our attack methods on a toy version of Fruit-v2. The attack matches the expected complexities predicted by our theoretical analysis quite well, which proves the validity of our cryptanalytic techniques.

Differential Fault Attack on the Stream Cipher LIZARD

In this paper, we try to give a security evaluation of LIZARD stream cipher in regard to fault attacks, which, to the best of our knowledge, is the first fault analysis on LIZARD. We design a differential engine of LIZARD to track the differential trail of the keystreams. It is shown that the distributions of the keystream differences are heavily biased. Utilizing this characteristic, we propose an improved method to identify the fault location for LIZARD whose success probability approaches 1. Then we use the fault-free keystream and faulty keystreams to generate system of equations in internal state variables and solve it by SAT solver. The result shows that with 100 keystream bits, only 6 different faults are needed to recover the internal state. Finally, the comparison between LIZARD and Grain v1 shows that LIZARD is more resistable than Grain v1 in regard to fault attacks.

Speech Scrambler Based on Discrete Cosine Transform and Novel Seven-Dimension Hyper Chaotic System

Because of their inherent features related to cryptography, the hyperchaotic system has strong potential in security systems. In this paper, a new cryptography scheme for speech scrambling has been proposed which gives it more security level. Also, it introduced a novel seven dimensions (7D) nonlinear hyperchaotic system in third-order which has twelve positive parameters. A chaotic behavior for the proposed novel system is analyzed. The hyperchaotic system is demonstrated that beside it appropriates for speech scrambler. PRNG (Pseudo Random Number Generated) is created based on the proposed 7D hyperchaotic result. The proposed scheme depends on this novel hyperchaotic system as PRNG to generate a random keystream bit. The input speech signal in this work is first squeezed by discrete cosine transformation (DCT) to minimize the residual intelligibility (R. I.). Increasing the number of system parameters accomplished a high key space, therefore, improves the security to resist several cryptographic attacks. The scheme is measured using various tests like. Peak Signal-to-Noise Ratio (PSNR), Signal to noise ratio (SNR), percentage of Difference (P. Diff.), Segmental Signal to Noise Ratio Measure (SSNR), Crest factor measure (CF), Correlation coefficient Measure (R_C), root mean square measure (RMS), histogram, key sensitivity, spectrogram, and waveform The results of simulation and comparison prove that the algorithm can achieve better performance in encryption that means the scheme is stronger and highly secure against various types of attacks than many recent similar audio encryption schemes. Simulated and implemented the result using Mathematica and MATLAB programs to simulation results, provided qualitatively, and figures.

Melting SNOW-V: improved lightweight architectures

SNOW-V is a stream cipher proposed by Ekdahl et al. at IACR ToSC 2019(3) with an objective to be deployed as the encryption primitive in 5G systems. The stream cipher offers 256-bit security and is ready for deployment in the post-quantum era, in which as a rule of thumb (due to Grover’s algorithm), quantum security will vary as the square root of the classical security parameters. The authors further report good software performance figures in systems supporting the AES-NI instruction set. However, they only provide a theoretical analysis of the cipher’s hardware efficiency. In this paper, we aim to fill this gap. We look at the three most important metrics of hardware efficiency: area, speed and power/energy, and propose circuits that optimize each of these metrics and validate our results using three different standard cell libraries. The smallest SNOW-V circuit we propose occupies only around 4776 gate equivalents of silicon area. Furthermore, we also report implementations which consume as little as 12.7 pJ per 128 bits of keystream and operate at a throughput rate of more than 1 Tbps.

Reversible data hiding in encrypted images for coding channel based on adaptive steganography

In this study, a novel reversible data hiding (RDH) in encrypted domain scheme for coding channel based on sliding-block segmentation and adaptive steganography is proposed. The proposed scheme enriches the residual information with as little additional encryption information as possible to improve the testing error rate of a steganalyser by sliding-block segmentation with bit stream encryption. The specific encryption process effectively weakens the correlation between the adjacent pixels and minimises the size of key stream bits. The encryption key can be further embedded in the channel code stream before transmitted in the channel. Experimental analysis shows that the image encrypted by the proposed RDH scheme can achieve a peak-signal-to-noise ratio of >50 dB, as the payload is 0.5 bits per pixel (bpp). In terms of security performance, compared with the state-of-the-art methods, their method has a higher testing error rate when the steganalyser is utilised. Even if the payload is 0.5 bpp, the testing error rate is >0.25.

PudgyTurtle: Using Keystream to Encode and Encrypt

Stream cipher encryption works by modulo-2 adding plaintext bits to keystream bits, which are in turn produced by successively updating a finite-state machine initialized to a secret starting state. PudgyTurtle is a way to encode the plaintext in a keystream-dependent manner before encryption. Since it can use keystream from any stream cipher, PudgyTurtle functions somewhat like an encryption mode. The process begins by generating successive 4-bit groups of keystream (‘nibbles’) until one of them matches the current plaintext nibble to within one bit. The number of keystream nibbles required, as well as the nearness of this match, is then encoded into a variable-length codeword. Finally, this codeword is encrypted by modulo-2 addition to an equal amount of keystream. Compared to normal binary-additive stream ciphers, this process is less efficient (i.e., more time is required to generate extra keystream nibbles, and more space is needed for the codewords than for the plaintext). However, with this cost comes a benefit: PudgyTurtle resists time-memory tradeoff attacks better than standard stream encryption.

A differential fault attack on the WG family of stream ciphers

WG-l ($$l=7,8,16,29$$) are the well-known Welch–Gong (WG) stream cipher family with different key length bits. The first version named WG (WG-29) stream cipher was introduced in eSTREAM project as a cipher suitable for hardware implementations. The other variants are proposed for different applications from RFID to fast communications. This paper presents an extensive fault analysis on the WG family. Fault attacks are powerful cryptanalytic tools to analyse cryptosystems, which are not vulnerable to other known cryptographic attacks. The security model used to analyse the WG ciphers applies random faults, which are allowed to be injected by an adversary. The adversary has no control over the fault locations and their values. For each WG-l stream cipher, an adversary needs to observe a specific number of keystream bits before they are able to recover the secret key. To recover the secret key of WG-8, the adversary needs to inject about six random faults and compute the secret key with data and time complexities about $$2^{15.78}$$ bits and $$2^{24}$$, respectively. The adversary can recover the secret key of WG-7, WG-16 and WG-29 ciphers with time complexities $$2^{22}$$, $$2^{42}$$ and $$2^{64}$$, respectively. The attacks have been verified experimentally.

Differential Fault Attack on Kreyvium & FLIP

In this article, we propose key recovery attack on two stream ciphers: Kreyvium and FLIP <inline-formula><tex-math notation="LaTeX">$_{530}(42,128,360)$</tex-math></inline-formula> using Differential Fault Attack (DFA) technique. These two ciphers are being used in Fully Homomorphic Encryption (FHE) due to their low error growth during keystream generation. Kreyvium is an NFSR-based stream cipher and FLIP is a permutation-based stream cipher. We first show that the complete state of the Kreyvium can be recovered by injecting 3 faults and considering 450 many keystream bits. In case of FLIP, we show that if there is a 1-bit fault in the state of the cipher then from 9000 normal and faulty keystream bits the state (i.e., the secret key) of the cipher can be recovered. For single bit fault, one will require to solve a system of equations for each 530 possible fault locations to recover the correct key of FLIP. To the best of our knowledge, this is the first article which analyzes the security of these two FHE supported stream ciphers under DFA and it has been observed that DFA completely reveals the secret keys of these two ciphers with very minimal faults.

A new-one-time-pad stream cipher: new design, hardware implementation and its application in security of UAVs

UAVs are used in military and civilian fields. Security of UAV Data Link is still unsatisfactory especially if a strong adversary model is considered. This paper describes a new design of AENOTP, tested for security in UAVs Data Link. AENOTP algorithm combines NOTP with AE technique to ensure encryption and authentication along with data integrity. AE is a technique that ensures the security of the transported data. The design and analysis of AENOTP gives a fast and enhanced stream cipher AE architecture based on the unpredictability concept. Implementation of AENOTP measures encryption and decryption of any sent and received data. AENOTP shows high speed of generating the key stream bits of the OTP stream cipher and high speed of the proposed algorithm of 75 Mbits/sec. It achieves high level of security for any transmitted data. It can easily resist different attacks such as linear and differential attacks.

A new-one-time-pad stream cipher: new design, hardware implementation and its application in security of UAVs

UAVs are used in military and civilian fields. Security of UAV Data Link is still unsatisfactory especially if a strong adversary model is considered. This paper describes a new design of AENOTP, tested for security in UAVs Data Link. AENOTP algorithm combines NOTP with AE technique to ensure encryption and authentication along with data integrity. AE is a technique that ensures the security of the transported data. The design and analysis of AENOTP gives a fast and enhanced stream cipher AE architecture based on the unpredictability concept. Implementation of AENOTP measures encryption and decryption of any sent and received data. AENOTP shows high speed of generating the key stream bits of the OTP stream cipher and high speed of the proposed algorithm of 75 Mbits/sec. It achieves high level of security for any transmitted data. It can easily resist different attacks such as linear and differential attacks.

Analysis on Boolean Function in a Restricted (Biased) Domain

Boolean functions are usually studied under the assumption that each input bit is considered independent and identically distributed. However, in the case of some stream ciphers, a keystream bit is generated by using a nonlinear Boolean function with inputs from a restricted domain. At Eurocrypt 2016, one such stream cipher (FLIP) has been proposed, where a Boolean function on $n$ variables was exploited with inputs of weight $\frac {n}{2}$ only. Recently, Carlet et al. studied several properties of such functions and obtained certain bounds on linear approximations of direct sum in the restricted domain. In this paper, we observe that for a direct sum like $f=f_{1}+f_{2}$ , the inputs to each sub-function $f_{1}$ , $f_{2}$ do not follow a uniform distribution in the restricted domain. In this regard, we study the properties of the Boolean functions by considering a general probability distribution on the inputs. We further obtain several bounds related to the biases of direct sums. Finally, we obtain a lower bound on the bias of the nonlinear filter function of FLIP. Our results provide a general framework to study security parameters of ciphers over restricted domain.

Guess and determine cryptanalysis with variable sampling and its applications

Non-linear filtering generators, as a well-known family of stream ciphers, employ a filtering function F : GF ( 2 ) n → GF ( 2 ) m to process the secret state bits and thus outputs binary keystream blocks of length m. In this study, the authors extend the framework of a generic cryptanalytic method applicable to non-linear filtering generators called generalised filter state guessing attacks (GFSGA), introduced as a generalisation of the filter state guessing attack method, by applying a variable sampling of the keystream bits in order to retrieve as much information about the secret state bits as possible. Two different modes that use a variable sampling of keystream blocks are presented and it is shown that in many cases these modes may outperform the standard GFSGA mode. They also demonstrate the possibility of employing GFSGA-like attacks to other design strategies such as non-linear feedback shift register-based ciphers (Grain family for instance). It is also indicated that the tap positions of Grain-128 are not chosen optimally with respect to this generic cryptanalytic method and provide a better selection of taps that gives higher resistance to GFSGA-like attacks.

Cryptanalysis of Plantlet

Plantlet is a lightweight stream cipher designed by Mikhalev, Armknecht and Müller in IACR ToSC 2017. It has a Grain-like structure with two state registers of size 40 and 61 bits. In spite of this, the cipher does not seem to lose in security against generic Time-Memory-Data Tradeoff attacks due to the novelty of its design. The cipher uses a 80-bit secret key and a 90-bit IV. In this paper, we first present a key recovery attack on Plantlet that requires around 276.26 Plantlet encryptions. The attack leverages the fact that two internal states of Plantlet that differ in the 43rd LFSR location are guaranteed to produce keystream that are either equal or unequal in 45 locations with probability 1. Thus an attacker can with some probability guess that when 2 segments of keystream blocks possess the 45 bit difference just mentioned, they have been produced by two internal states that differ only in the 43rd LFSR location. Thereafter by solving a system of polynomial equations representing the keystream bits, the attacker can find the secret key if his guess was indeed correct, or reach some kind of contradiction if his guess was incorrect. In the latter event, he would repeat the procedure for other keystream blocks with the given difference. We show that the process when repeated a finite number of times, does indeed yield the value of the secret key.&#x0D; In the second part of the paper, we observe that the previous attack was limited to internal state differences that occurred at time instances that were congruent to 0 mod 80. We further observe that by generalizing the attack to include internal state differences that are congruent to all equivalence classed modulo 80, we lower the total number of keystream bits required to perform the attack and in the process reduce the attack complexity to 269.98 Plantlet encryptions.

Design and Implementation of LCG-Trivium Key Stream Generator into FPGA

&lt;p&gt;This paper presents the Design and implementation into Field ProgrammableGate Array (FPGA) of a combine stream cipher and a simple linear congruential generator circuit to produce key stream. The LCG circuit is used to produce initialization vector (IV) each 2&lt;sup&gt;64&lt;/sup&gt; clock cycle to the cipher trivium in other to strengthen the complexity of the cipher to known attacks on trivium. The LCGTrivium is designed to generate 2&lt;sup&gt;144&lt;/sup&gt; bits of keystream from an 80-bits secret and a variable 80-bits initial value. To implement the LCG-Trivium on FPGA, we use VHDL to build a simple LCG and Trivium and a state machine to synchronize the functioning of the LCG and Trivium. The number of gates, memory and speed requirement on FPGA is giving after analysis. The design is simulated, synthesized and implemented in Quartus II 10.1, ModelSim-Altera 6.5 and Cyclone IV E EP4CE115F29C7N.&lt;/p&gt;

Design and Implementation of LCG-Trivium Key Stream Generator into FPGA

&lt;p&gt;This paper presents the Design and implementation into Field ProgrammableGate Array (FPGA) of a combine stream cipher and a simple linear congruential generator circuit to produce key stream. The LCG circuit is used to produce initialization vector (IV) each 2&lt;sup&gt;64&lt;/sup&gt; clock cycle to the cipher trivium in other to strengthen the complexity of the cipher to known attacks on trivium. The LCGTrivium is designed to generate 2&lt;sup&gt;144&lt;/sup&gt; bits of keystream from an 80-bits secret and a variable 80-bits initial value. To implement the LCG-Trivium on FPGA, we use VHDL to build a simple LCG and Trivium and a state machine to synchronize the functioning of the LCG and Trivium. The number of gates, memory and speed requirement on FPGA is giving after analysis. The design is simulated, synthesized and implemented in Quartus II 10.1, ModelSim-Altera 6.5 and Cyclone IV E EP4CE115F29C7N.&lt;/p&gt;

Some results on Fruit

In FSE 2015, Armknecht et al. proposed a new technique to design stream ciphers, which involves repeated use of keybits in each round of the keystream bit generation. This technique showed the possibility to design stream ciphers where the internal state size is significantly lower than twice the key size. They proposed a new cipher based on this idea, named Sprout. But soon Sprout was proved to be insecure. In Crypto 2015, Lallemand et al. proposed an attack which was $$2^{10}$$ times faster than the exhaustive search. But the new idea used in Sprout showed a new direction in the design of stream cipher, which led to the proposal of several new ciphers with small size of internal state. Fruit is a recently proposed cipher where both the key size and the state size are 80. In this paper, we attack full round Fruit by a divide-and-conquer method. Our attack is equivalent to $$2^{74.95}$$ many Fruit encryptions, which is around 16.95 times faster than the average exhaustive key search. Our idea also works for the second version of Fruit.