The key scheduling phase (KSP) of a stream cipher expands the uniformly chosen key (K) and initialization vector (IV) to a larger uniform looking state. The existence of non-randomness in KSP results in a non-randomness in the final keystream. In this paper, we observe a non-randomness in the KSP of the nonlinear feedback-based stream ciphers Grain-v1, Grain-128AEAD and Fountain-v1 of reduced round R. However, we could not exploit the non-randomness into an attack. It can be claimed that if the KSP generates a pseudorandom state, then the probability of generating a valid state T (i.e., in the range set of KSP function) of a cipher must be $$2^{-\delta }$$ , where $$\delta$$ is the length of padding bits. We show that a new valid state can be constructed by flipping a few bits of a given state of the cipher with a probability higher than $$2^{-\delta }$$ . We show that the non-randomness happens for $$R \le 129$$ , $$R\le 208$$ and $$R \le 193$$ rounds of KSP of Grain-v1, Grain-128AEAD, and Fountain-v1, respectively. Further, in the case of Grain-v1 and Grain-128AEAD, we also found non-randomness in some key, IV bits from the experiment.
Read full abstract