Time-memory-data Tradeoff Research Articles

Generic attacks on small-state stream cipher constructions in the multi-user setting

Small-state stream ciphers (SSCs), which violate the principle that the state size should exceed the key size by a factor of two, still demonstrate robust security properties while maintaining a lightweight design. These ciphers can be classified into several constructions and their basic security requirement is to resist generic attacks, i.e., the time–memory–data tradeoff (TMDTO) attack. In this paper, we investigate the security of small-state constructions in the multi-user setting. Based on it, the TMDTO distinguishing attack and the TMDTO key recovery attack are developed for such a setting. It is shown that SSCs which continuously use the key can not resist the TMDTO distinguishing attack. Moreover, SSCs based on the continuous-IV-key-use construction cannot withstand the TMDTO key recovery attack when the key length is shorter than the IV length, no matter whether the keystream length is limited or not. Finally, we apply these two generic attacks to TinyJAMBU and DRACO in the multi-user setting. The TMDTO distinguishing attack on TinyJAMBU with a 128-bit key can be mounted with time, memory, and data complexities of 2^{64}, 2^{48}, and 2^{32}, respectively. This attack is comparable with a recent work on ToSC 2022, where partial key bits of TinyJAMBU are recovered with more than 2^{50} users (or keys). As DRACO’s IV length is smaller than its key length, it is vulnerable to the TMDTO key recovery attack. The resulting attack has a time and memory complexity of both 2^{112}, which means DRACO does not provide 128-bit security in the multi-user setting.

Conditional TMDTO as a MILP Instance

Conditional Time-Memory-Data Trade-off (TMDTO) attack given by Biryukov and Shamir can be reduced to the following problem: “Find the minimum number of state bits that should be fixed in order to recover the maximum number of state bits by utilizing the keystream bits and value of rest of the state bits”. As per our literature survey, existing algorithms search for state bits that should be fixed (as minimum as possible) in order to recover the maximum possible state bits directly through the keystream bits. However, those algorithms are cipher specific and require extensive manual effort in analyzing the keystream bit equations. In this manuscript, we have constructed an automated framework that is easy to implement and solves the above problem (for the case when bits are fixed to 0) for any NLFSR based stream cipher with better complexity, thereby reducing manual efforts. However, we do not claim any global optimum for fixed bits. We tried to reduce the number of fixed bits as much as possible. To show that our algorithm is applicable to a majority of NLFSR based stream ciphers, we implement it on three different stream ciphers: LIZARD, GRAIN-128a and ESPRESSO. It improves all existing TMDTO results on these ciphers. The framework involves modelling keystream bit equations into a set of linear constraints, which is then solved by using a Mixed Integer Linear Programming (MILP) solver, Gurobi. The advantages of our automated framework over other methods are that we can achieve better results with far less effort, and it can be applied to any stream cipher of a similar structure with very ease. To the best of our knowledge, our MILP model is the first work that converts the conditional TMDTO of a stream cipher into a linear optimization problem. As a consequence, for LIZARD cipher, we reduce the number of fixed bits by 20 bits from the previous best result when the number of recovered bits is 18. In the case of GRAIN-128a, the highest reduction in the number of fixed bits is by 34 bits when the number of recovered bits is 35. Lastly, for ESPRESSO cipher, the reduction is by 7 bits when the number of recovered bits is 35.

Cryptanalysis of Draco

Draco is a lightweight stream cipher designed by Hamann et al. in IACR ToSC 2022. It has a Grain-like structure with two state registers of size 95 and 33 bits. In addition, the cipher uses a 128-bit secret key and a 96-bit IV. The first 32 bits of the key and the IV forms a non-volatile internal state that does not change during the time that the cipher produces keystream bits.The authors claim that the cipher is provably secure against Time-Memory-Data (TMD) Tradeoff attacks. However in this paper, we first present two TMD tradeoff attacks against Draco. Both attacks leverage the fact that for certain judiciously chosen IVs the state update function of the cipher depend on only a small fraction of the non-volatile internal state. This makes the state update function in Draco essentially a one way function over a much smaller domain and range. The first attack requires around 2114.2 Draco iterations and requires that the adversary has access to 232 chosen IVs. The second attack is such that the attack parameters can be tuned as per the requirements of the attacker. If the attacker prioritizes that the number of different chosen IVs is limited to 220 say, then the attack can be done in around time proportional to 2126 Draco rounds. However if the total attack complexity is to be optimized, then the attack can be performed in 2107 time using around 240 chosen IVs.

An Attack on a Proposed Construction of Small-State Stream Ciphers and Proposals for New Constructions

Abstract Small-state stream ciphers (SSCs) idea is based on using key bits not only in the initialization but also continuously in the keystream generation phase. A time-memory-data tradeoff (TMDTO) distinguishing attack was successfully applied against all SSCs in 2017 by Hamann et al. They suggested using not only key bits but also initial value (IV) bits continuously in the keystream generation phase to strengthen SSCs against TMDTO attacks. Then, Hamann and Krause proposed a construction based on using only IV bits continuously in the packet mode. They suggested an instantiation of an SSC and claimed that it is resistant to TMDTO attacks. We point out that accessing IV bits imposes an overhead on cryptosystems that might be unacceptable in some applications. More importantly, we show that the proposed SSC remains vulnerable to TMDTO attacks 1. To resolve this security threat, the current paper proposes constructions based on storing key or IV bits that are the first to provide full security against TMDTO attacks. Five constructions are proposed for different applications by considering efficiency. Designers can obtain each construction’s minimum volatile state length according to the desirable keystream, key and IV lengths.

A new idea in response to fast correlation attacks on small-state stream ciphers

In the conference “Fast Software Encryption 2015”, a new line of research was proposed by introducing the first small-state stream cipher (SSC). The goal was to design lightweight stream ciphers for hardware applications by going beyond the rule that the internal state size must be at least twice the intended security level. Fast correlation attack (FCA) was successfully applied to all proposed SSCs which can be implemented by less than 1000 gate equivalents in hardware. It is possible to increase the security of stream ciphers against FCA by exploiting more complicated functions for the nonlinear feedback shift register and the output function, but we use lightweight functions to design the lightest SSC in the world while providing more security against FCA. Our proposed cipher provides 80-bit security against all types of Time-memory-data trade-off (TMDTO) attacks, while Lizard and Plantlet provide only 60-bit and 58-bit security against TMDTO distinguishing attacks, respectively. Our main contribution is to propose a lightweight round key function with a very long period that increases the security of SSCs against FCA.

(Quantum) Time-Memory-Data Tradeoff Attacks on the SNOW-V Stream Cipher

Symmetric cryptosystems (i.e., stream ciphers and block ciphers) have always played an important part in securing the various generations of 3GPP (3rd Generation Partnership Project) mobile telephony systems. The SNOW-V stream cipher, published in September 2019, is the most recent member of the well-known SNOW family of ciphers. It is designed to provide confidentiality and integrity for 5G communications. There have been no time-memory-data tradeoff (TMDTO) attacks on the cipher published so far. By combining with the BSW sampling technique, we propose TMDTO attacks on SNOW-V. The results show that the attacker can mount a TMDTO attack, where none of the online time complexity, the memory complexity and the offline time complexity are bigger than 2256, if the keystream sequences generated by the secret key, together with different IVs, are provided to the attacker. Furthermore, we analyze the security of SNOW-V against quantum TMDTO attacks, and the results show that a quantum TMDTO attack offers, strictly, better online time complexity than Grover’s algorithm, when the available memory space is bigger than 2170.67. These results are helpful in evaluating the security of SNOW-V against (quantum) TMDTO attacks.

Internal state recovery of Espresso stream cipher using conditional sampling resistance and TMDTO attack

<p style='text-indent:20px;'>Espresso is a stream cipher proposed for the 5G wireless communication system. Since the design of this cipher is based on the Galois configuration of NLFSR, the cipher has a short propagation delay, and it is the fastest among the ciphers below 1500 GE, including Grain-128 and Trivium. The time-memory-data tradeoff (TMDTO) attack on this cipher and finding the conditional BSW sampling resistance are difficult due to its Galois configuration. This paper demonstrates the calculation of conditional BSW-sampling resistance of Espresso stream cipher, which is based on Galois configuration, and also mounts the TMDTO attack on the cipher by employing the calculated sampling resistance. It is also shown that the attack complexities of TMDTO attack are lower than those claimed by the designers of the ciphers.

A Blockchain Consensus Protocol Based on Dedicated Time-Memory-Data Trade-Off

A problem of developing the consensus protocols in public blockchain systems which spend a combination of energy and space resources is addressed. A technique is proposed that provides a flexibility for selection of the energy and space resources which should be employed by a player participating in the consensus procedure. The technique originates from the cryptographic time-memory-data trade-off approaches for cryptanalysis. The proposed technique avoids the limitations of Proof-of-Work (PoW) and Proof-of-Memory (PoM) which require spending of only energy and space, respectively. Also, it provides a flexibility for adjusting the resources spending to the system budget. The proposed consensus technique is based on a puzzle where the problem of inverting one-way function is solved employing a dedicated Time-Memory-Data Trade-Off (TMD-TO) paradigm. The algorithms of the consensus protocol are proposed which employ certain unconstrained and constrained TMD-TO based inversions. Security of the proposed technique is considered based on the probability that the honest pool of nodes generate a longer extension of the blockchain before its update, and a condition on the employed parameters in order to achieve desired security has been derived. Implementation of the proposed technique in Go language and its inclusion as an alternative consensus option in Ethereum platform are shown. Implementation complexity and performance of the proposed consensus protocol are discussed and compared with the ones when PoW and PoM are employed.

On Analysis of Lightweight Stream Ciphers with Keyed Update

As the need for lightweight cryptography has grown even more due to the evolution of the Internet of Things, it has become a greater challenge for cryptographers to design ultra lightweight stream ciphers in compliance with the rule of thumb that the internal state size should be at least twice as the key size to defend against generic Time-Memory-Data Tradeoff (TMDT) attacks. However, Recently in 2015, Armknecht and Mikhalev sparked a new light on designing keystream generators (KSGs), which in turn yields stream ciphers, with small internal states, called KSG with Keyed Update Function (KSG with KUF) , and gave a concrete construction named Sprout. But, currently, security analysis of KSGs with KUF in a general setting is almost non-existent. Our contribution in this paper is two-fold. 1) We give a general mathematical setting for KSGs with KUF, and for the first time, analyze a class of such KSGs, called KSGs with Boolean Keyed Feedback Function (KSG with Boolean KFF), generically. In particular, we develop two generic attack algorithms applicable to any KSG with Boolean KFF having almost arbitrary output and feedback functions where the only requirement is that the secret key incorporation is biased. We introduce an upper bound for the time complexity of the first algorithm. Our extensive experiments validate our algorithms and assumptions made thereof. 2) We study Sprout to show the effectiveness of our algorithms in a practical instance. A straightforward application of our generic algorithm yields one of the most successful attacks on Sprout.

On stream ciphers with provable beyond-the-birthday-bound security against time-memory-data tradeoff attacks

Most stream ciphers are vulnerable against generic time-memory-data tradeoff (TMD-TO) attacks, which reduce their effective key length to the birthday bound $n/2$ , where n denotes the inner state length of the underlying keystream generator. This implies the necessity of a comparatively large inner state length for practical stream ciphers (e.g., $n = 288$ and $n = 160$ for the eSTREAM portfolio members Trivium and Grain v1, respectively). In this paper, we propose and analyze the Lizard-construction, a new way to build stream ciphers. We prove a tight $2n/3$ bound on its security against TMD-TO key recovery attacks, where the security lower bound refers to chosen-IV attacks. The security against TMD-TO distinguishing attacks remains at the birthday-bound level $n/2$ . The lower bound refers to a random oracle model which allows to derive formal security results w.r.t. generic TMD-TO attacks. While similar frameworks have already been widely used for analyzing the security of block cipher, MAC, and hash function constructions, to the best of our knowledge this is the first time that such a model is considered in the context of stream ciphers. The security analysis presented in this paper is also of immediate practical relevance as, with the stream cipher Lizard, a first instantiation of our new design principle (which we hence named Lizard-construction) was introduced at FSE 2017. Lizard has an inner state length of only 121 bits and surpasses Grain v1, the most hardware efficient member of the eSTREAM portfolio, in important metrics for lightweight ciphers such as chip area and power consumption.

Fruit-80: A Secure Ultra-Lightweight Stream Cipher for Constrained Environments.

In Fast Software Encryption (FSE) 2015, while presenting a new idea (i.e., the design of stream ciphers with the small internal state by using a secret key, not only in the initialization but also in the keystream generation), Sprout was proposed. Sprout was insecure and an improved version of Sprout was presented in FSE 2017. We introduced Fruit stream cipher informally in 2016 on the web page of IACR (eprint) and few cryptanalysis were published on it. Fortunately, the main structure of Fruit was resistant. Now, Fruit-80 is presented as a final version which is easier to implement and is secure. The size of LFSR and NFSR in Fruit-80 is only 80 bits (for 80-bit security level), while for resistance to the classical time-memory-data tradeoff (TMDTO) attacks, the internal state size should be at least twice that of the security level. To satisfy this rule and to design a concrete cipher, we used some new design ideas. It seems that the bottleneck of designing an ultra-lightweight stream cipher is TMDTO distinguishing attacks. A countermeasure was suggested, and another countermeasure is proposed here. Fruit-80 is better than other small-state stream ciphers in terms of the initialization speed and area size in hardware. It is possible to redesign many of the stream ciphers and achieve significantly smaller area size by using the new idea.

Design and analysis of small-state grain-like stream ciphers

Time-memory-data (TMD) tradeoff attacks limit the security level of many classical stream ciphers to the birthday bound. Very recently, a new field of research has emerged, which searches for so-called small-state stream ciphers that try to overcome this limitation. In this paper, existing designs and known analysis of small-state stream ciphers are revisited and new insights on distinguishers and key recovery are derived based on TMD tradeoff attacks. A particular result is the transfer of a generic distinguishing attack suggested in 2007 by Englund et al. to this new class of lightweight ciphers. Our analysis shows that the initial hope of achieving full security against TMD tradeoff attacks by continuously using the secret key has failed. In particular, we provide generic distinguishers for Plantlet and Fruit with complexity significantly smaller than that of exhaustive key search. However, by studying the assumptions underlying the applicability of these attacks, we are able to come up with a new design idea for small-state stream ciphers, which might allow to finally achieve full security against TMD tradeoff attacks. Another contribution of this paper is the first key recovery attack against the most recent version of Fruit. We show that there are at least 264 weak keys, each of which does not provide 80-bit security as promised by designers.

LIZARD – A Lightweight Stream Cipher for Power-constrained Devices

Time-memory-data (TMD) tradeoff attacks limit the security level of many classical stream ciphers (like E 0 , A5/1, Trivium, Grain) to 1 / 2 n , where n denotes the inner state length of the underlying keystream generator. In this paper, we present Lizard, a lightweight stream cipher for power-constrained devices like passive RFID tags. Its hardware efficiency results from combining a Grain-like design with the FP (1)-mode, a recently suggested construction principle for the state initialization of stream ciphers, which offers provable 2 / 3 n -security against TMD tradeoff attacks aiming at key recovery. Lizard uses 120-bit keys, 64-bit IVs and has an inner state length of 121 bit. It is supposed to provide 80-bit security against key recovery attacks. Lizard allows to generate up to 2 18 keystream bits per key/IV pair, which would be sufficient for many existing communication scenarios like Bluetooth, WLAN or HTTPS.

LIZARD – A Lightweight Stream Cipher for Power-constrained Devices

Time-memory-data (TMD) tradeoff attacks limit the security level of many classical stream ciphers (like E0, A5/1, Trivium, Grain) to 1/2n, where n denotes the inner state length of the underlying keystream generator. In this paper, we present Lizard, a lightweight stream cipher for power-constrained devices like passive RFID tags. Its hardware efficiency results from combining a Grain-like design with the FP(1)-mode, a recently suggested construction principle for the state initialization of stream ciphers, which offers provable 2/3n-security against TMD tradeoff attacks aiming at key recovery. Lizard uses 120-bit keys, 64-bit IVs and has an inner state length of 121 bit. It is supposed to provide 80-bit security against key recovery attacks. Lizard allows to generate up to 218 keystream bits per key/IV pair, which would be sufficient for many existing communication scenarios like Bluetooth, WLAN or HTTPS.

Warbler: A Lightweight Pseudorandom Number Generator for EPC C1 Gen2 Passive RFID Tags

A pseudorandom number generator is an important component for implementing security functionalities on RFID tags. Most previous proposals focus on true random number generators that are usually inefficient for low-cost tags in terms of power consumption, area, and throughput. In this contribution, we propose a lightweight pseudorandom number generator (PRNG) for EPC Class-1 Generation-2 (EPC C1 Gen2) RFID tags. The proposed PRNG fully exploits nonlinear feedback shift registers and provides 16-bit random numbers that are required in the tag identification protocol of the EPC C1 Gen2 standard. The generated sequences are able to pass the EPC C1 Gen2 standard's statistical tests as well as the NIST randomness test suite. Moreover, a detailed cryptanalysis shows that the proposed PRNG is resistant to the most common attacks such as algebraic attacks, cube attacks, and time-memorydata tradeoff attacks. In particular, the proposed PRNG can be implemented on low-cost Xilinx Spartan-3 FPGA devices with 46 slices.