SCIENCE CHINA Information Sciences March 2020, Vol. 63 131101:1–131101:25 . REVIEW . https://doi.org/10.1007/s11432-018-9929-x Stream cipher designs: a review Lin JIAO1*, Yonglin HAO1 & Dengguo FENG1,2* 1 State Key Laboratory of Cryptology, Beijing 100878, China; 2 State Key Laboratory of Computer Science, Institute of Software, Chinese Academy of Sciences, Beijing 100190, China Received 13 August 2018/Accepted 30 June 2019/Published online 10 February 2020 Abstract Stream cipher is an important branch of symmetric cryptosystems, which takes obvious advan- tages in speed and scale of hardware implementation. It is suitable for using in the cases of massive data transfer or resource constraints, and has always been a hot and central research topic in cryptography. With the rapid development of network and communication technology, cipher algorithms play more and more crucial role in information security. Simultaneously, the application environment of cipher algorithms is in- creasingly complex, which challenges the existing cipher algorithms and calls for novel suitable designs. To accommodate new strict requirements and provide systematic scientific basis for future designs, this paper reviews the development history of stream ciphers, classifies and summarizes the design principles of typical stream ciphers in groups, briefly discusses the advantages and weakness of various stream ciphers in terms of security and implementation. Finally, it tries to foresee the prospective design directions of stream ciphers. Keywords stream cipher, survey, lightweight, authenticated encryption, homomorphic encryption Citation Jiao L, Hao Y L, Feng D G. Stream cipher designs: a review. Sci China Inf Sci, 2020, 63(3): 131101, https://doi.org/10.1007/s11432-018-9929-x 1 Introduction The widely applied e-commerce, e-government, along with the fast developing cloud computing, big data, have triggered high demands in both efficiency and security of information processing. As the core of information security, cryptography is facing new opportunities and challenges. Higher speed and higher security level are both crucial, while lower implementation cost also becomes important in order to cater for the resource constraint scenarios such as wireless networks and radio frequency identification devices (RFID) tags. Among all kinds of cryptographic primitives, stream ciphers stand out play an important role in protecting the confidentiality of information. Nowadays, the stream ciphers are featured with easy hardware and software implementation, fast encryption and decryption, no or only limited error propagation, thus they maintain the predominance in applications of special and confidential organizations, like diplomacy communication, government and military affairs. Many international standards and civil communication systems are also adopting stream cipher algorithms as their main components for protecting confidential information. Such examples are the RC4 [1] stream cipher in IEEE 802.11 wireless network standard, the A5/1 [2] stream cipher for the European GSM system, the SNOW 3G [3] and ZUC [4] stream ciphers for 3GPP standard, E0 stream cipher [5] for bluetooth system. Governments all over the world are also devoting significantly to the development of stream ciphers. In 2000, European government launched the NESSIE plan aiming at new signature, integrity, and encryption scheme. The program lasted until 2003, but unfortunately, of all the submitted stream ciphers, including the relatively famous SNOW 1.0 [6,7], LILI-128 [8], none were finally * Corresponding author (email: jiaolin [email protected], [email protected]) c Science China Press and Springer-Verlag GmbH Germany, part of Springer Nature 2020 info.scichina.com link.springer.com Jiao L, et al. Sci China Inf Sci March 2020 Vol. 63 131101:2 selected due to security flaws [9–11]. In the same year, Japanese government proposed the CRYPTREC project [12], to collect and evaluate cryptographic algorithms for applications in government and industry. Some nicely designed primitives like MUGI [13] have been selected. In 2004, Europe launched the ECRYPT projcect [14], which contains a special plan, eSTREAM [15], dedicated to stream ciphers. It collected 34 algorithms of diverse designs in total and 7 of them are finally selected. In particular, the 7 selected eSTREAM ciphers can be divided into algorithms for constrained hardware environment (portfolio 2), such as Grain-v1 [16], Trivium [17], Mickey-v2 [18], which are generally bit-oriented, and algorithms for high-speed software applications (portfolio 1), such as Salsa20/12 [19], SOSEMANUK [20], Rabbit [21], HC-128 [22], which are mostly word-oriented. The eSTREAM program has significantly affected the development of stream ciphers, especially the design and analysis on the stream ciphers with maximum internal state and high round initialization. Besides the projects dedicated designs, other kinds of cryptographic primitives can also be adapted to stream ciphers. The winner of NIST’s SHA-3 hash function competition, Keccak, has an additional stream cipher mode [23]. Many authenticated encryption schemes submitted to the CAESAR campaign are adopting stream ciphers as their subroutines [24, 25]. As can be seen, the systematic study of stream ciphers is drawing more and more attentions, becoming one of the central topics of cryptography. In fact, the study of stream ciphers dates back to early 20th century. In the 1940’s, Shannon theoretically proved that the one-time pad (OTP) cipher is fully secure in the ciphertext-only scenario [26]. OTP uses a completely random keystream whose digits are combined with the plaintext digits at a time to form the ciphertext. However, the keystream must be generated completely at random with at least the same length as the plaintext and cannot be used more than once, making the whole system quite cumbersome for practical use. Stream cipher borrows the idea of OTP by replacing the completely random keystream to a pseudo-random one generated from a secret key with much smaller length. In comparison with OTP, stream ciphers provide easier key generation, distribution and management which are crucial in practical applications. Meanwhile, well-designed stream ciphers will guarantee high secure margin as well, since it is computationally infeasible to distinguish the pseudo-random keystream from a complete random one, or to recover the secret key from the whole key space. Generally stream ciphers can be divided into synchronous and self-synchronous stream ciphers. In synchronous stream cipher, the generated keystream is independent of the sending, and the internal state only depends on the preceding internal state, that has nothing to do with the plaintext [27]. The advantage of synchronous stream ciphers lies in limited error propagation. Inversely, the keystream generated by self-synchronous stream cipher depends on the previous plaintext or ciphertext information making the security analysis hard to be performed [28]. Therefore, most modern stream ciphers are synchronous stream ciphers in current whose resistance against known attacks can be theoretically evaluated. The execution of modern stream ciphers usually consist of two stages: the initialization stage and the keystream generation stage. In the initialization phase, the stream cipher first loads the secret key and initialization vector (IV) into an internal state and then updates the internal state by iteratively calling an updating function for sufficiently many rounds so that the secret key and IV are thoroughly mixed. In the keystream generation phase, the stream cipher generates the pseudo-random keystream digits from the highly diffused internal state by calling an output function while further updates the internal state with the updating function. The designs of the cipher structures and the updating, output functions are crucial to generate highly qualified pseudo-random keystream in an efficient manner. After decades of development, many well-designed stream ciphers have been proposed. Each of them has its unique feature catering for specific applications. The structures of stream ciphers are now highly diverse. In late 20th century, many stream ciphers are using completely linear updating functions so that the internal states can be regarded as concatenations of linear feedback shift registers (LFSR). Due to the LFSR has no immunity against cryptanalysis as Berlekamp-Massey algorithm [29] for its linear nature, it needs to adopt various nonlinear components to enhance its nonlinearity, where common methods include nonlinear combination, nonlinear filtering, irregular clock control, and combinations with memories. A typical LFSR based stream cipher is E0 [5] but it is soon realized that such LFSR based stream ciphers are vulnerable to various cryptanalysis techniques [30, 31]. Therefore, in eSTREAM, many of the candidate algorithms adopt more new structures such as nonlinear feedback shift register (NFSR). Among the 7 Jiao L, et al. Sci China Inf Sci March 2020 Vol. 63 131101:3 eSTREAM winners, Trivium [17] can be regarded as a typical NFSR-based stream cipher consistingof3 NFSRs. Grain-v1 [16] is also an NFSR-based primitive concatenating an NFSR with an LFSR. In order to cater for resource-constrained applications (such as Internet of things (IoT)), small-state lightweight stream ciphers are proposed aiming at resisting the time-memory-data tradeoff (TMDTO) attacks while maintaining a small internal state. Typical examples are Sprout [32], Fruit [33, 34], and Plantlet [35], but