DOCSLIB.ORG

On the Frame Length of Achterbahn-128/80

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
On the Frame Length of Achterbahn-128/80 On the frame length of Achterbahn-128/80 Rainer G¨ottfert Berndt M. Gammel Infineon Technologies AG Infineon Technologies AG Am Campeon 1–12 Am Campeon 1–12 D-85579 Neubiberg, Germany D-85579 Neubiberg, Germany rainer.goettfert@infineon.com berndt.gammel@infineon.com Abstract— In this paper we examine a correlation attack in the heuristic method that the sequence g(T )ζ reflects the against combination generators introduced by Meier et al. in 2006 probability distribution Pr(Y =0)= 1 (1 + 32). and extended to a more powerful tool by Naya-Plasencia. The 2 method has been used in the cryptanalysis of the stream ciphers II. THE SIMPLIFIED KEYSTREAM GENERATOR MODEL Achterbahn and Achterbahn-128/80. No mathematical proofs for Instead of working with a true combination generator in the method were given. We show that rigorous proofs can be given in an appropriate model, and that the implications derived which the sequences to be combined are, e.g., shift register from that model are in accordance with experimental results sequences, we shall work in a simplified model. In this model obtained from a true combination generator. We generalize the the input sequences to the Boolean combiner are replaced by new correlation attack and, using that generalization, show that periodic sequences of binary-valued random variables which the internal state of Achterbahn-128 can be recovered with 119 48.54 are assumed to be independent and symmetrically distributed. complexity 2 using 2 consecutive keystream bits. In order to investigate a lower bound for the frame length of Achterbahn- We shall use the following notation. If M is a set, then |M| 128 we consider another application of the generalized correlation denotes the cardinality of M. If D is a subset of the set of 2136 attack. This attack has complexity (higher than brute force) integers Z and n is a nonnegative integer, then Dmod n is the 244.99 and requires keystream bits. Similar results hold for corresponding subset of Z/nZ consisting of the elements of Achterbahn-80. Due to these findings our new recommendation reduced modulo . for the frame length of Achterbahn-128 and Achterbahn-80 is D n 244 bits. Theorem 1: Let F be a balanced Boolean function of n ≥ 1 variables having order of correlation immunity c with 0 ≤ c ≤ I. INTRODUCTION n − 1. Let p1,...,pn be n distinct nonnegative integers. For Consider a keystream generator (KSG) that consists of n each k =1,...,n, let devices producing binary periodic sequences and a Boolean X ∞ ∞ k = (Xki)i = (Xk,0,Xk,1,...,Xk,pk −1) (1) combining function which combines these sequences to gen- =0 erate the keystream. If the input sequences have relatively be a periodic sequence of binary-valued balanced random short periods—in comparison to the keystream—then a certain variables of least period pk such that the random variables correlation attack comes into play. This heuristic correlation Xki, 1 ≤ k ≤ n, 0 ≤ i ≤ pk − 1, are statistically independent. Z ∞ attack was introduced by Johansson, Meier, and Muller [4] Let = (Zi)i=0 be the sequence of binary-valued random and later on generalized by Naya-Plasencia [5]. The method variables defined by is in the spirit of linear cryptanalysis. No proof has been given Zi = F (X1,i,X2,i,...,Xn,i) for i =0, 1,... for the method. We shall generalize this correlation attack and present a rigorous proof for the attack in a simplified model. Let We give a brief description of the correlation attack as L = xi1 + xi2 + · · · + xim + a (2) introduced in [4]. Let F (x1,...,xn) be a balanced Boolean be an affine Boolean function of m variables, 1 ≤ m ≤ n. combining function that is correlation immune of order 4, say. Select an integer h with 1 ≤ h ≤ m and decompose the Let L = x1 + x2 + x3 + x4 + x5 be a linear approximation to set M = {i1,i2,...,im} into h mutually disjoint subsets F , so that Pr(F = L)= 1 (1 + ) with a nonzero correlation 2 M1,...,Mh. Compute the least common multiples coefficient . Let σ1,...,σn be the input sequences to F ∞ and let ζ = (zi)i=0 be the keystream. Since F and L are qj = lcm(pi : i ∈ Mj ), 1 ≤ j ≤ h. correlated, the sequences ζ and σ = σ1 +σ2 +σ3 +σ4 +σ5 are Choose nonnegative integers t1,...,th, and set rj = tj qj for correlated. Let pj be the least period of σj , 1 ≤ j ≤ 5, and let ∞ ∞ 1 ≤ j ≤ h. Consider the binary polynomial T : (bi)i=0 → (bi+1)i=0 be the shift operator, defined on the vector space of all binary sequences under termwise operations h rj d 5 pj g(x)= (x − 1) = x . on sequences. The polynomial g(x) = j=1(x − 1) is a j=1 d D characteristic polynomial of σ, so that g(T )σ = 0. Since Y X∈ Q Z ∞ the polynomial g(x) has 32 terms, g(T )[ζ + σ] = g(T )ζ The linear operator g(T ) and the sequence = (Zi)i=0 define Y Z is the termwise sum of 32 sequences. It has been assumed a new sequence = g(T ) with terms Yi = d∈D Zi+d. P h If m ≤ c +1 and |Dmod pj | = 2 for all 1 ≤ j ≤ n with and similar subsets of V : j∈ / M, then V0 ={x ∈ V : G(x)=0} = {x ∈ V : F (x)=1}, 1 h x x x x Pr(Y =0)= 1+ 2 for i =0, 1,..., (3) V1 ={ ∈ V : G( )=1} = { ∈ V : F ( )=0}. i 2 It suffices to show that Pr(G = 0|x = 0) = Pr(G = 0|x = where is the correlation coefficient between F and L, that 1 1 1). Equivalently, that |U | = |V |. Since F is balanced, is, = 2 Pr(F = L) − 1. 0 0 n−1 The special case m = c +1 and tj = 1 for 1 ≤ j ≤ h |U0| + |V1| =2 . corresponds to the method of Naya-Plasencia suggested in [5, n−1 We trivially have |V0| + |V1| = |V | = 2 . Hence, |U0| = page 5]. The special case m = c +1, h = m, and tj = 1 n−1 n−1 n−1 . for 1 ≤ j ≤ m, corresponds to the method of Meier et al. 2 − |V1| =2 − (2 − |V0|)= |V0| described in [4, page 10]. Lemma 3: Let the Boolean function F (x1,...,xn) be bal- Formula (3) need not hold if the stated assumptions in anced and correlation immune of order c. For 1 ≤ k ≤ c +1 Theorem 1 are not fulfilled. and 1 ≤ j1 < · · · < jk ≤ n, consider the Boolean function G(x1,...,xn)= F (x1,...,xn)+ xj1 + · · · + xjk . Then Example 1. The Boolean Function F (x1, x2, x3)= x1x2 + x1x3 + x2x3 is balanced and correlation immune of order Pr(G = e|xj1 = e1,...,xjk = ek) = Pr(G = e) c = 0. The linear function L = x1 + x2 is uncorrelated to k F , that is = 0. We have m = 2, so that the assumption for all e ∈{0, 1} and (ej1 ,...,ejk ) ∈{0, 1} . m ≤ c +1 is not fulfilled. Let g(x) = (xp1 − 1)(xp2 − 1) and Proof: It suffices to proof the assertion for D = {0,p1,p2,p1 + p2}. Assume that |Dmod p3 | = 4. One G(x1,...,xn)= F (x1,...,xn)+ x1 + · · · + xc+1. readily checks that the random variable Y0 satisfies Pr(Y0 = 0)=9/16. This result clearly contradicts formula (3). Since F is balanced and correlation immune of order c, any Example 2. Let F be the Boolean function from Exam- subfunction of F obtained by replacing arbitrary c variables ple 1. We use the linear approximation L = x1. We have of F with arbitrary binary constants is balanced. It follows Pr(F = L)=3/4 so that = 1/2. Assume that the periods (compare the proof of Lemma 2) that p1 p1,p2,p3 are distinct with p3 dividing p1. Let g(x)= x −1. Then D = {0,p1} and Dmod p3 = {0}, so that the second Pr(F =0|x1 = e1,...,xc+1 = ec+1) assumption in Theorem 1 is not fulfilled. In fact, we find for a/b if e1 + · · · + ec+1 =0 Y = F (X ,X ,X )+ F (X ,X ,X ) that Pr(Y = = 0 10 20 30 10 2p1 30 0 (b − a)/b if e + · · · + e =1 0)=3/4. This again contradicts formula (3). ( 1 c+1 For the proof of Theorem 1 we need some auxiliary results. with b = 2n−c−1, for some a ∈ {0, 1,...,b}, and for all The proof of the next lemma is straightforward and can be c+1 (e1,...,ec+1) ∈{0, 1} . It follows that skipped. Lemma 1: Let Rij , 1 ≤ i ≤ k, 1 ≤ j ≤ n, be a Pr(G =0|x1 = e1,...,xc+1 = ec+1)= a/b collection of k × n statistically independent binary-valued for all (e ,...,e ) ∈{0, 1}c+1. random variables, and let F be an arbitrary Boolean function 1 c+1 We are now ready for the proof of Theorem 1. of n variables. Then the k random variables S ,...,S defined 1 k Proof: All random variables of the sequence ∞ by (Yi)i=0 = g(T )(Z )∞ have the same probability distribution. It there- S = F (R , R ,...,R ) for 1 ≤ i ≤ k i i=0 i i1 i2 in fore suffices to examine one of those random variables, say are statistically independent. Y0. Let us denote Y0 by Y . Thus, Y = d∈D Zd. Lemma 2: Let F be a balanced Boolean function of The case m = n is trivial.
Load more

Recommended publications
  • Detection and Exploitation of Small Correlations in Stream Ciphers
    Detection and Exploitation of Small Correlations in Stream Ciphers Masterthesis conducted under the guidance of Prof. Dr. Joachim Rosenthal and Dr. Gérard Maze Institute of Mathematics, University of Zurich 2008 Urs Wagner Outline This thesis gives an overview of stream ciphers based on linear feedback shift registers (LFSR) and their vulnerability to correlation attacks. In the rst chapter, a short introduction to symmetric key ciphers is given. The main focus hereby is on LFSR based stream ciphers. Further, the principles of LFSR are presented. The chapter is then closed by a stream cipher example, the Gee Generator. The second chapter treats the general approach of correlation attacks. Moreover a correlation attack is mounted on the Gee Generator and the practical results are presented. Boolean functions play an important role in stream cipher designs. The Walsh transform, a tool to analyze the cryptographic properties of Boolean functions, is introduced in chapter 3. Additionally, the cryptographic properties themselves are discussed. In the fourth chapter, an improved kind of correlation attack -the fast correlation attack- is presented. It exploits the same weaknesses in the stream cipher designs as the correlation attack, the mode of operation is however dierent. In the last chapter, the insights gained in the previous chapters are used to suggest an attack on a stream cipher by Philips, named Hitag 2. 1 Acknowledgments This thesis was written in the course of my master's studies at the University of Zurich. I am grateful to Prof. Joachim Rosenthal who gave me the opportunity to write my master thesis in cryptography. Special thanks go to Dr.
    [Show full text]
  • On the Design and Analysis of Stream Ciphers Hell, Martin
    On the Design and Analysis of Stream Ciphers Hell, Martin 2007 Link to publication Citation for published version (APA): Hell, M. (2007). On the Design and Analysis of Stream Ciphers. Department of Electrical and Information Technology, Lund University. Total number of authors: 1 General rights Unless other specific re-use rights are stated the following general rights apply: Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain • You may freely distribute the URL identifying the publication in the public portal Read more about Creative commons licenses: https://creativecommons.org/licenses/ Take down policy If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim. LUND UNIVERSITY PO Box 117 221 00 Lund +46 46-222 00 00 On the Design and Analysis of Stream Ciphers Martin Hell Ph.D. Thesis September 13, 2007 Martin Hell Department of Electrical and Information Technology Lund University Box 118 S-221 00 Lund, Sweden e-mail: [email protected] http://www.eit.lth.se/ ISBN: 91-7167-043-2 ISRN: LUTEDX/TEIT-07/1039-SE c Martin Hell, 2007 Abstract his thesis presents new cryptanalysis results for several different stream Tcipher constructions.
    [Show full text]
  • Analysis of Lightweight Stream Ciphers
    ANALYSIS OF LIGHTWEIGHT STREAM CIPHERS THÈSE NO 4040 (2008) PRÉSENTÉE LE 18 AVRIL 2008 À LA FACULTÉ INFORMATIQUE ET COMMUNICATIONS LABORATOIRE DE SÉCURITÉ ET DE CRYPTOGRAPHIE PROGRAMME DOCTORAL EN INFORMATIQUE, COMMUNICATIONS ET INFORMATION ÉCOLE POLYTECHNIQUE FÉDÉRALE DE LAUSANNE POUR L'OBTENTION DU GRADE DE DOCTEUR ÈS SCIENCES PAR Simon FISCHER M.Sc. in physics, Université de Berne de nationalité suisse et originaire de Olten (SO) acceptée sur proposition du jury: Prof. M. A. Shokrollahi, président du jury Prof. S. Vaudenay, Dr W. Meier, directeurs de thèse Prof. C. Carlet, rapporteur Prof. A. Lenstra, rapporteur Dr M. Robshaw, rapporteur Suisse 2008 F¨ur Philomena Abstract Stream ciphers are fast cryptographic primitives to provide confidentiality of electronically transmitted data. They can be very suitable in environments with restricted resources, such as mobile devices or embedded systems. Practical examples are cell phones, RFID transponders, smart cards or devices in sensor networks. Besides efficiency, security is the most important property of a stream cipher. In this thesis, we address cryptanalysis of modern lightweight stream ciphers. We derive and improve cryptanalytic methods for dif- ferent building blocks and present dedicated attacks on specific proposals, including some eSTREAM candidates. As a result, we elaborate on the design criteria for the develop- ment of secure and efficient stream ciphers. The best-known building block is the linear feedback shift register (LFSR), which can be combined with a nonlinear Boolean output function. A powerful type of attacks against LFSR-based stream ciphers are the recent algebraic attacks, these exploit the specific structure by deriving low degree equations for recovering the secret key.
    [Show full text]
  • Cryptanalysis of Achterbahn-128/80
    Cryptanalysis of Achterbahn-128/80 María Naya-Plasencia? INRIA, projet CODES, Domaine de Voluceau 78153 Le Chesnay Cedex, FRANCE [email protected] Abstract. This paper presents two key-recovery attacks against Achter- bahn-128/80, the last version of one of the stream cipher proposals in the eSTREAM project. The attack against the 80-bit variant, Achterbahn- 80, has complexity 261. The attack against Achterbahn-128 requires 280.58 operations and 260 keystream bits. These attacks are based on an im- provement of the attack due to Hell and Johansson against Achterbahn version 2. They mainly rely on an algorithm that makes prot of the independence of the constituent registers. Keywords: stream cipher, eSTREAM, Achterbahn, cryptanalysis, correlation attack, linear approximation, parity check, key-recovery attack. 1 Introduction Achterbahn [4, 6] is a stream cipher proposal submitted to the eSTREAM project. After the cryptanalysis of the rst two versions [10, 9], it has moved on to a new one called Achterbahn-128/80 [5] published in June 2006. Achterbahn-128/80 corresponds to two keystream generators with key sizes of 128 bits and 80 bits, respectively. Their maximal keystream length is limited to 263. We present here two attacks against both generators. The attack against the 80-bit variant, Achterbahn-80, has complexity 261. The attack against Achterbahn- 128 requires 280.58 operations and 261 keystream bits. These attacks are based on an improvement of the attack against Achterbahn version 2 and also on an algorithm that makes prot of the independence of the constituent registers. The paper is organized as follows.
    [Show full text]
  • Revisiting a Recent Resource-Efficient Technique For
    Revisiting a Recent Resource-efficient Technique for Increasing the Throughput of Stream Ciphers Frederik Armknecht and Vasily Mikhalev Universit¨at Mannheim, Mannheim, Germany Keywords: Stream Ciphers, Feedback Shift Registers, Implementation, Throughput, Pipelining, Galois Configuration. Abstract: At CT-RSA 2014, Armknecht and Mikhalev presented a new technique for increasing the throughput of stream ciphers that are based on Feedback Shift Registers (FSRs) which requires practically no additional memory. The authors provided concise sufficient conditions for the applicability of this technique and demonstrated its usefulness on the stream cipher Grain-128. However, as these conditions are quite involved, the authors raised as an open question if and to what extent this technique can be applied to other ciphers as well. In this work, we revisit this technique and examine its applicability to other stream ciphers. On the one hand we show on the example of Grain-128a that the technique can be successfully applied to other ciphers as well. On the other hand we list several stream ciphers where the technique is not applicable for different structural reasons. 1 INTRODUCTION ciphers as well. In this work, we revisit this technique and shed new light on this technique. More precisely, Stream ciphers are designed for efficiently encrypting we provide both positive and negative results. On the data streams of arbitrary length. Ideally a stream ci- positive side, we successfully apply this technique to pher should not only be secure but also have a low Grain-128a. On the negative side we explain for sev- hardware size and high throughput. Consequently eral FSR-based stream ciphers that the technique can- several papers address the question of optimizing not be used for structural reasons.
    [Show full text]
  • Automatické Hledání Závislostí U Proudových Šifer Projektu Estream
    MASARYKOVA UNIVERZITA F}w¡¢£¤¥¦§¨ AKULTA INFORMATIKY !"#$%&'()+,-./012345<yA| Automatické hledání závislostí u proudových šifer projektu eStream DIPLOMOVÁ PRÁCA Matej Prišt’ák Brno, Jaro 2012 Prehlásenie Prehlasujem, že táto diplomová práca je mojím pôvodným autorským dielom, ktoré som vypracoval samostatne. Všetky zdroje, pramene a literatúru, ktoré som pri vypracovaní po- užíval alebo z nich ˇcerpal,v práci riadne citujem s uvedením úplného odkazu na príslušný zdroj. Vedúci práce: Petr Švenda ii Pod’akovanie Rád by som pod’akoval v prvom rade vedúcemu práce RNDr. Petrovi Švendovi, Ph.D. za odborné vedenie, pravidelné zhodnotenie a pripomienky k práci. Pod’akovanie patrí aj ko- legovi Ondrejovi Dubovcovi za spoluprácu pri úpravách použitej aplikácie. Nakoniec by som chcel pod’akovat’ celej mojej rodine a priatel’ke Zuzke za podporu a trpezlivost’ poˇcas písania tejto práce. iii Zhrnutie Ciel’om práce je príprava existujúcich implementácií širšieho okruhu kandidátov na prú- dovú šifru v rámci projektu eSTREAM do jednotného rozhrania tak, aby bolo možné auto- matické hl’adanie nežiadúcich závislostí vo výstupe (ktoré by sa nemali vyskytovat’) všet- kých týchto kandidátnych funkcií naraz. Pre automatické hl’adanie bol využitý existujúci nástroj využívajúci techniky evoluˇcnýchobvodov. K dispozícii bola možnost’ spúšt’at’ vý- poˇctydistribuovane pomocou nástroja BOINC s využitím laboratórnych poˇcítaˇcov. Imple- mentaˇcnáˇcast’ je doplnená analýzou a diskusiou získaných výsledkov a porovnaním úspeš- nosti hl’adania závislostí evoluˇcnýmobvodom verzus závislosti nájdené bežnými batériami pre štatistické testovanie výstupu dát (Diehard a NIST). iv Kl’úˇcovéslová genetický algoritmus, genetic algorithm, prúdová šifra, stream cipher, ECRYPT, eSTREAM, kryptoanalýza, cryptoanalysis, štatistické testovanie, statistical testing v Obsah 1 Úvod .............................................1 2 Definícia pojmov ......................................2 2.1 Genetický algoritmus .................................2 2.1.1 Initializer .
    [Show full text]
  • Cryptanalysis of Achterbahn-128/80 Maria Naya-Plasencia INRIA-Projet
    Cryptanalysis of Achterbahn-128/80 Maria Naya-Plasencia INRIA-Projet CODES FRANCE Outline 1 Achterbahn 2 Tools used in our cryptanalysis 3 Cryptanalysis of Achterbahn-128/80 Achterbahn [Gammel-G¨ottfert-Kniffler05] @ - @ NLFSR 1 @ @ NLFSR 2 - @ @ - f ¡ keystream ... ¡ ¡ - ¡ NLFSR N ¡ ¡ I Achterbahn version 1, version 2, 128-80. I version 1 cryptanalysed by Johansson, Meier, Muller. I version 2 cryptanalysed by Hell, Johansson. 1/23 Achterbahn-128/80 (July 2006) Achterbahn-128: key size = 128 bits I 13 primitive NLFSRs of length Li = 21 + i, 0 ≤ i ≤ 12 I Least significant bit of each NLFSR forced to 1 at the initialization process. I Boolean combining function F : • balanced • correlation immunity order = 8 I Inputs of F ← shifted outputs of NLFSRs. I Keystream length limited to 263. 2/23 Achterbahn-128/80 (July 2006) Achterbahn-80: key size = 80 bits I 11 primitive NLFSRs of length Li = 21 + i, 1 ≤ i ≤ 11 I Least significant bit of each NLFSR forced to 1 at the initialization process. I Boolean function G(x1, . , x11) = F (0, x1, . , x11, 0): • balanced • correlation immunity order = 6 I Inputs of G ← shifted outputs of NLFSRs. I Keystream length limited to 263. 3/23 Tools used in our cryptanalysis I Parity checks I Exhaustive search for the internal states of some registers I Decimation by the period of a register I Linear approximations I Speeding up the exhaustive search 4/23 Parity checks Let (s1(t))t≥0,..., (sn(t))t≥0 be n sequences of periods Pn T1,...,Tn, and ∀t ≥ 0,S(t) = i=1 si(t).
    [Show full text]
  • Lecture Notes in Computer Science
    International Journal of Recent Technology and Engineering (IJRTE) ISSN: 2277-3878, Volume-8 Issue-2, July 2019 Safe Light Weight Cipher using Ethernet and Pentatop Number J. Harikrishna, Ch. Rupa, P. Raveendra Babu Abstract. Current essential factor in this world to send a sen- Cryptography is discipline or techniques employed on the sitive information over the unsecured network like the internet electronic messages by converting them into unreadable is security. Protection of sensitive data is becoming a major format by using secret keys. Depending on the key used, raising problem due to rising technologies. A recent attack on encryption techniques divided into different types. Electronic Mail of CBI shows that attacker’s efficiency rate. In the traditional symmetric Key Cryptography (SKC), use Standard cryptographic algorithms can be exploited by the only single key which is kept secret for both encryption and attackers frequently and unable to apply for standard devices decryption. This can uses in most common algorithms such because of their energy consumption due to high computation with slow processing. Lightweight cryptography based algo- as AES (Advanced Encryption Standard) and DES (Data rithms can reduce these problems. This paper deals with sym- Encryption Standard). It extends to Asymmetric Key Cryp- metric key cryptography technique to encrypt the data where tography (AKC) which uses two keys, one for encryption the sender and receiver share a common key which can also be and another for decryption. E.g.: RSA (Rivest, Shamir, called a secret key cryptography. To encrypt and decrypt the Adleman) algorithm [14]. Any one from these approaches data, randomly generated Pentatope Number has used as a key.
    [Show full text]
  • QUAD: Overview and Recent Developments
    QUAD: Overview and Recent Developments David Arditti1, Cˆome Berbain1, Olivier Billet1, Henri Gilbert1, and Jacques Patarin2 1 France Telecom Research and Development, 38-40 rue du G´en´eralLeclerc, F-92794 Issy-les-Moulineaux, France. [email protected] 2 Universit´ede Versailles, 45 avenue des Etats-Unis, F-78035 Versailles cedex, France. [email protected] Abstract. We give an outline of the specification and provable security features of the QUAD stream cipher proposed at Eurocrypt 2006 [5]. The cipher relies on the iteration of a multivariate system of quadratic equations over a finite field, typically GF(2) or a small extension. In the binary case, the security of the keystream generation can be related, in the concrete security model, to the conjectured intractability of the MQ problem of solving a random system of m equations in n unknowns. We show that this security reduction can be extended to incorporate the key and IV setup and provide a security argument related to the whole stream cipher. We also briefly address software and hardware performance issues and show that if one is willing to pseudorandomly generate the systems of quadratic polynomials underlying the cipher, this leads to suprisingly inexpensive hardware implementations of QUAD. Key words: MQ problem, stream cipher, provable security, Gr¨obnerbasis computation 1 Introduction Symmetric ciphers can be broadly classified into two main families of encryp- tion algorithms: block ciphers and stream ciphers. Unlike block ciphers, stream ciphers do not produce a key-dependent permutation over a large block space, but a key-dependent sequence of numbers over a small alphabet, typically the binary alphabet {0, 1}.
    [Show full text]
  • The Estream Project
    The eSTREAM Project Matt Robshaw Orange Labs 11.06.07 Orange Labs ECRYPT An EU Framework VI Network of Excellence > 5 M€ over 4.5 years More than 30 european institutions (academic and industry) ECRYPT activities are divided into Virtual Labs Which in turn are divided into Working Groups General SPEED eSTREAM Assembly Project Executive Strategic Coordinator Mgt Comm. Committee STVL AZTEC PROVILAB VAMPIRE WAVILA WG1 WG2 WG3 WG4 The eSTREAM Project – Matt Robshaw (2) Orange Labs 1 Cryptography (Overview!) Cryptographic algorithms often divided into two classes Symmetric (secret-key) cryptography • Participants using secret-key cryptography share the same key material Asymmetric (public-key) cryptography • Participants using public-key cryptography use different key material Symmetric encryption can be divided into two classes Block ciphers Stream ciphers The eSTREAM Project – Matt Robshaw (3) Orange Labs Stream Ciphers Stream encryption relies on the generation of a "random looking" keystream Encryption itself uses bitwise exclusive-or 0110100111000111001110000111101010101010101 keystream 1110111011101110111011101110111011100000100 plaintext 1000011100101001110101101001010001001010001 ciphertext Stream encryption offers some interesting properties They offer an attractive link with perfect secrecy (Shannon) No data buffering required Attractive error handling and propagation (for some applications) How do we generate keystream ? The eSTREAM Project – Matt Robshaw (4) Orange Labs 2 Stream Ciphers in a Nutshell Stream ciphers
    [Show full text]
  • Fault Analysis on the Stream Ciphers LILI-128 and Achterbahn
    Fault Analysis on the Stream Ciphers LILI-128 and Achterbahn Dibyendu Roy and Sourav Mukhopadhyay Department of Mathematics, Indian Institute of Technology Kharagpur, Kharagpur-721302, India fdibyendu.roy,[email protected] Abstract:- LILI-128 is a clock controlled stream cipher based on two LFSRs with one clock control function and one non-linear filter function. The clocking of the second LFSR is controlled by the first LFSR. In this paper we propose a fault algebraic attack on LILI-128 stream cipher. We first recover the state bits of the first LFSR by injecting a single bit fault in the first LFSR. After that we recover the second LFSR state bits by following algebraic cryptanalysis technique. We also propose fault attack on Achterbahn stream cipher, which is based on 8 NLFSRs, 8 LFSRs and one non-linear combining function. We first inject a single bit fault into the NLFSR-A then observe the normal and faulty keystream bits to recover almost all the state bits of the NLFSR-A after key initialization phase. One can apply our technique to other NLFSR-B, C, D to recover their state bits also. Keywords:- Stream ciphers, LFSR, NLFSR, LILI-128, Achterbahn, Fault attack. 1 Introduction Fault analysis is a cryptanalysis technique for the stream ciphers. By this cryptanalysis technique attacker injects fault into the stream cipher to recover full set or few bits of the state of the cipher. There are some methods to inject fault in the cipher like as laser shot. Due to this fault, in some clockings the cipher produces faulty keystream bits.
    [Show full text]
  • ストリーム暗号の現状と課題 the State of Stream Ciphers
    解 説 論 文 ストリーム暗号の現状と課題 The State of Stream Ciphers 森井昌克 Masakatu MORII 寺村亮一 Ryoichi TERAMURA アブストラクト ストリーム暗号は高速処理に優れた暗号のクラスであり，近年の情報の大規模化・通信の高速化に伴 い注目を集めている．このストリーム暗号の次世代を選定するプロジェクト eSTREAM（the ECRYPT stream cipher project）が欧州にて3年間にわたり開催され，その結果として先日七つのポートフォリオが選定された．本稿 では，ストリーム暗号を概観し，特にこのeSTREAMでの成果を踏まえて，現状最も使用されているストリーム暗号 であるRC4，これからのストリーム暗号であるeSTREAM暗号，そして現在ISO（International Organization for Standardization）に提案されている三つの暗号の動向について解説する． キーワード 暗号，ストリーム暗号，eSTREAM，RC4，WEP 1．はじめに 2．ストリーム暗号 コンピュータセキュリティ，及びネットワークセキュリ 2．1 共通鍵暗号としてのストリーム暗号 ティの分野は多岐にわたるが，その根幹を担う一つの分野が 暗号，そしてその利用を含む暗号技術である． 共通鍵暗号は暗号化と復号に同一の秘密鍵を用いる方式で 暗号の基本となるものが，暗号プリミティブと呼ばれる ある．共通鍵暗号方式は暗号化と復号に異なる鍵を用いる公 データの機密性，完全性，認証，否認防止等を実現するアル 開鍵暗号方式と異なり，通信等に用いる場合は事前に鍵を共 ゴリズムである．本論文では，この暗号プリミティブを扱い， 有する必要があるものの，暗号化処理速度の面で公開鍵暗号 以下，注記しない限り暗号プリミティブのことを暗号と呼ぶ． 方式より優れている．この共通鍵暗号は更に“ブロック暗号” 暗号には大きく分けて“公開鍵暗号” と“共通鍵暗号” という と“ストリーム暗号” の二つのクラスに大別できる（図 1）．ブ 二つのクラスがある．後者の共通鍵暗号に属するストリーム ロック暗号は平文を 64 ビットや128 ビットのブロックに分割 暗号は高速処理に優れた暗号のクラスであり，近年の情報の し，それぞれに対して暗号化を行う方式である．またストリー 大規模化・通信の高速化に伴い注目を集めている．このスト ム暗号は平文をデータストリームとして扱い，ビットもしく リーム暗号の次世代を選定するプロジェクト eSTREAM（the はバイト単位で逐次暗号化を行う方式である．これらの関係 ECRYPT stream cipher project）（1）が欧州にて3年間にわたり開 は誤り訂正符号におけるブロック符号と畳込み符号の関係に 催され，その結果として先日七つのポートフォリオが選定さ れた（2008年9月17日現在）． 本稿では，ストリーム暗号を概観し，特にこの eSTREAM での成果を踏まえて，現状最も使用されているストリー ム 暗 号 で あ る RC4， こ れ か ら の ス ト リ ー ム 暗 号 で あ る eSTREAM暗号，そして現在ISO（International Organization for Standardization）に提案されている三つの暗号の動向について 解説する． 森井昌克 正員 神戸大学大学院工学研究科 図 1 ブロック暗号とストリーム暗号 ブロック暗号は， E-mail [email protected] 一つ一つのブロックが独立に暗号化復号されることに対し 寺村亮一 学生員
    [Show full text]