Decim v2

The new information and communication technologies require adequate security. In the past decades ,we have witnessed an explosive growth of the digital storage and communication of data ,triggered by some important breakthroughs such as the Internet and the expansive growth of wireless communications. In the world of cryptography ,stream ciphers are known as primitives used to ensure privacy over communication channel and these are widely used for fast encryption of sensitive data. Lots of old stream ciphers that have been formerly used no longer be considered secure ,because of their vulnerability to newly developed cryptanalysis techniques. Many designs stream ciphers have been proposed in an effort to find a proper candidate to be chosen as world standard for data encryption. From these designs, the stream ciphers which are Trivium,Edon80 and Mickey are implemented in ‘c’ language with out affecting their security .Actually these algorithms are particularly suited for hardware oriented environments which provides considerable security and efficiency aspects. We will be targeting hardware applications, and good measure for efficiency of a stream cipher in this environment is the number of key stream bits generated per cycle per gate. For good efficiency we are approaching two ways .One approach is minimizing the number of gates.The other approach is to dramatically increase the number of bits for cycle. This allows reducing the clock frequency at the cost of an increased gate count. Apart from the implementation the analysis which includes the security of these algorithms against some attacks related to stream ciphers such as guess and deterministic attacks, correlation attacks, divide and conquer attacks and algebraic attacks are presented.

RAKAPOSHI is a hardware oriented stream cipher designed by Cid et al. in 2009. It is based on Dynamic Linear Feedback Shift Registers, with a simple and potentially scalable design, and is particularly suitable for hardware applications with restricted resources. The RAKAPOSHI stream cipher offers 128-bit security. In this paper, we point out some mistakes existing in the related key attack on RAKAPOSHI by Isobe et al., and propose a new related key attack on RAKAPOSHI, which recovers the 128-bit secret key with a time complexity of 256, requiring one related key and 255 chosen IVs. Furthermore, an improved key recovery attack on RAKAPOSHI in the multiple related key setting is proposed with a time complexity of 233, requiring 212.58 chosen IVs. As confirmed by the experimental results, our new attack can recover all 128 key bits of RAKAPOSHI in less than 1.5 hours on a PC.

Most proposed stream ciphers are cracked through vulnerability of input and output. This paper is focused on the encryption function and the security tradeoff between pseudorandom number generators and the encryption function. Despite the focus on the security of the key generation, there is still considerable potential for attacks on the secret key as long as the encryption function leaks valuable information about the key to the attacker. Hence, it is important to study the possibility of constructing a new encryption model based on a stream cipher, while considering security and throughput tradeoffs. In this paper a new approach to data encryption based on its integration with a synchronous stream cipher is presented. This new approach is named the “Permuted Synchronous Stream Cipher” (PSSC). The sophisticated design of the PSSC for providing diffusion to stream ciphers allows it to be easily incorporated into most of the existing proposed stream ciphers to provide better security. The PSSC key stream is constructed from two parts, namely the key- bits and a corresponding diffusion maps. The method involves inserting random bits into the ciphertext followed by bit rotation and XORing bitwise. Therefore, any statistical pattern or information about the secret key that may be reflected in or leaked into the cipher’s output can be masked by performing simple bit diffusion on the ciphertext based on a pseudorandom sequence of diffusion maps. We believe that the proposed method can achieve a throughput rate that is fast enough for real-time data protection with better security.

CHAPTER 1 - 802.11 Wireless – Infrastructure Attacks

Encryption and decryption are the two most important complex methods for achieving security in any type of smart devices and systems/machines through transport layer security protocol (TLS). The symmetric key algorithms are the significant method for encrypting and decrypting the data/information using block cipher or stream cipher which is used for TLS protocol. The primary symmetric key block cipher algorithm used in TLS is Advanced Encryption standard (AES) and it provides security based on the key bits used in AES operation. The TLS protocol provides confidentiality(C), integrity (I) and Authenticity (A) in a single pass communication that is Authentication Encryption and Authentication Data (AEAD) between web browser and web server. It uses well known TLS cipher suite AES-GCM (Galois Counter mode) which is commonly used in TLS1.2. Suppose AES-NI hardware acceleration is not available in smart devices like tablets it causes performance issues in smart devices using TLS 1.2 protocol. If the smart device does not possess AES-NI, it can use software for running AES-GCM but it takes a lot of time for encryption/decryption of information, ergo causing the battery performance in smart devices. The newer symmetric Stream cipher CHACHA20-POLY1305 provides AEAD for securing the communication in smart devices thus reducing the battery cycles which is used for TLS 1.3. The paper discusses the pros and cons of AES-GCM authentication encryption used in TLS 1.2.

Boolean functions have found a widespread use in cryptography. In connection with the advent of the 'algebraic' attack on stream ciphers, the Boolean functions, which are used in these ciphers as nonlinear filters, have to possess, among other properties, high algebraic immunity. One more cryptographically significant property of Boolean functions, especially of those utilised in stream ciphers, is nonlinearity. In this connection, the question arises about relations between the nonlinearity of a Boolean function and its algebraic immunity.

The Australian stream cipher NLSv2 [6] is a 32-bit word oriented stream cipher that was quite successful in the stream ciphers competition - the project eSTREAM. The cipher achieved Phase 3 and successfully accomplished one of the main requirements for candidates in Prole 1 (software oriented pro- posals) - to have a better performance than AES in counter mode. However the cipher was not chosen into the nal portfolio [1], because its performance was not so perfect when comparing with other nalist. Also there is a security issue with a high correlation in the used S-Box, which some eective distinguishers exploit. In this paper, a practical demonstration of the distinguishing attack against the smaller version of the cipher is introduced. In our experiments, we have at disposal a machine with four cores (Intel R CoreTM Quad @ 2.66 GHz) and single attack lasts about 6 days. Our results conrmed the assumption and we got 50.0473% zeros in distinguisher.

A practical distinguisher for the Shannon cipher

In this paper, we propose a new hardware friendly authenticated encryption (AE) scheme \({\textsf {TriviA}}\) based on (i) a stream cipher for generating keys for the ciphertext and the tag, and (ii) a pairwise independent hash to compute the tag. We have adopted one of the ISO-standardized stream ciphers for lightweight cryptography, namely Trivium, to obtain our underlying stream cipher. This new stream cipher has a state that is a little larger than the state of Trivium to accommodate a 128-bit secret key and IV. Our pairwise independent hash is also an adaptation of theEHC or “Encode-Hash-Combine” hash, that requires the optimum number of field multiplications and hence requires small hardware footprint. We have implemented the design in synthesizable RTL. Pre-layout synthesis, using 65 nm standard cell technology under typical operating conditions, reveals that \({\textsf {TriviA}}\) is able to achieve a high throughput of 91.2 Gbps for an area of 24.4 KGE. We prove that our construction has at least 128-bit security for privacy and 124-bit security of authenticity under the assumption that the underlying stream cipher produces a pseudorandom bit stream.

Rabbit is a stream cipher proposed by M. Boesgaard et al., and has been selected into the final portfolio after three evaluation phases of the ECRYPT Stream Cipher Project (eSTREAM). So far only a few papers studied its security besides a series of white papers by the designers of Rabbit. Recently we presented a new idea to evaluate the security of a word-oriented stream cipher algorithm from a smaller data granularity instead of its original data granularity and applied it successfully to the stream cipher SOSEMANUK. In this work we apply the same idea to the Rabbit algorithm and analyze its security in resistance against the guess and determine attack from the view point of byte units. As a result, we present two new approaches of solving all xj,t+1' s and gj,t' s from the next-state function and the extraction scheme of Rabbit, whose complexities are 2166 and 2140.68 respectively, which are dramatically lower than those proposed by Lu et al. (2192 and 2174 resp.) at ISC 2008. Finally based on the above new results we propose a byte-based guess and determine attack on Rabbit, which only needs a small segment of known keystream to recover the whole internal state of Rabbit with time complexity 2242. Though the complexity of our attack is far higher than that of a brute force (2128), we believe that some new techniques adopted in this paper are of interest for future work on Rabbit.

Salsa20 is a family of 256-bit stream ciphers designed in 2005 and submitted to eSTREAM, the ECRYPT Stream Cipher Project. Salsa20 has progressed to the third round of eSTREAM without any changes. The 20-round stream cipher Salsa20/20 is consistently faster than AES and is recommended by the designer for typical cryptographic applications. The reduced-round ciphers Salsa20/12 and Salsa20/8 are among the fastest 256-bit stream ciphers available and are recommended for applications where speed is more important than confidence. The fastest known attacks use ≈ 2153simple operations against Salsa20/7, ≈ 2249simple operations against Salsa20/8, and ≈ 2255simple operations against Salsa20/9, Salsa20/10, etc. In this paper, the Salsa20 designer presents Salsa20 and discusses the decisions made in the Salsa20 design.

In this paper the FPGA implementations for four stream ciphers are presented. The two stream ciphers, MUGI and SNOW 2.0 are recently adopted by the International Organization for Standardization ISO/IEC 18033-4:2005 standard. The other two stream ciphers, MICKEY 128 and TRIVIUM have been submitted and are under consideration for the eSTREAM, the ECRYPT (European Network of Excellence for Cryptology) Stream Cipher project. All ciphers were coded using VHDL language. For the hardware implementation, an FPGA device was used. The proposed implementations achieve throughputs range from 166 Mbps for MICKEY 128 to 6080 Mbps for MUGI.

The Australian stream cipher NLSv2 [Hawkes, P.-Paddon, M.-Rose, G. G.-De Vries, M. W.: Primitive specification for NLSv2, Project eSTREAM web page, 2007, 1-25] is a 32-bit word oriented stream cipher that was quite successful in the stream ciphers competition-the project eSTREAM. The cipher achieved Phase 3 and successfully accomplished one of the main requirements for candidates in Profile 1 (software oriented proposals)-to have a better performance than AES in counter mode. However the cipher was not chosen into the final portfolio [Babbage, S.-De Canni`ere, Ch.-Canteaut, A.-Cid, C.-Gilbert, H.-Johansson, T.-Parker, M.-Preneel, B.-Rijmen, V.-Robshaw, M.: The eSTREAM Portfolio, Project eSTREAM web page, 2008], because its performance was not so perfect when comparing with other finalist. Also there is a security issue with a high correlation in the used S-Box, which some effective distinguishers exploit. In this paper, a practical demonstration of the distinguishing attack against the smaller version of the cipher is introduced. In our experiments, we have at disposal a machine with four cores (Intel® CoreTM Quad @ 2.66 GHz) and single attack lasts about 6 days. We performed successful practical experiments and our results demonstrate that the distingushing attack against the smaller version is working.

This paper discusses how to recover RSA secret keys from their noisy version observed by side-channel attacks. At CRYPTO2009, Heninger and Shacham proposed a polynomial time algorithm which recovers an original secret key from some fraction of secret key bits. Then, at CRYPTO2010, Henecka et al. proposed a polynomial time algorithm recovering a correct secret key from the noisy secret key bits with some errors. Then they gave the bound such that the secret key can be recovered in polynomial time. At PKC2013, Kunihiro et al. presented a key-recovery algorithm from the erroneous version of secret key bits with erasures and errors. They also gave a condition for recovering the secret key and its theoretical bound. They pointed out that there is a small gap between their derived condition and the theoretical bound and closing the gap is an open problem. In this paper, we first improve the bound and reduce the computational cost by introducing tighter inequalities than the Hoeffding bound and choosing aggressive parameter settings. Our obtained bound is asymptotically optimal. Further, we show a practical countermeasure against the secret key extraction attack based on our analysis. In the countermeasure, some of the bits in the secret key are intentionally flipped and then the secret key with errors is stored in the memory. With the help of the intentionally added errors, the security is enhanced. For example, it results to be secure against the attacker extracting the secret key with an error rate 0.13 by intentionally adding a 0.15 fraction of errors. Finally, we revisit asymmetric error cases and give a provable bound for crossover probabilities.

Energy efficiency is critical in battery-driven devices, and designing energyoptimal symmetric-key ciphers is one of the goals for the use of ciphers in such environments. In the paper by Banik et al. (IACR ToSC 2018), stream ciphers were identified as ideal candidates for low-energy solutions. One of the main conclusions of this paper was that Trivium, when implemented in an unrolled fashion, was by far the most energy-efficient way of encrypting larger quantity of data. In fact, it was shown that as soon as the number of databits to be encrypted exceeded 320 bits, Trivium consumed the least amount of energy on STM 90 nm ASIC circuits and outperformed the Midori family of block ciphers even in the least energy hungry ECB mode (Midori was designed specifically for energy efficiency).In this work, we devise the first heuristic energy model in the realm of stream ciphers that links the underlying algebraic topology of the state update function to the consumptive behaviour. The model is then used to derive a metric that exhibits a heavy negative correlation with the energy consumption of a broad range of stream cipher architectures, i.e., the families of Trivium-like, Grain-like and Subterranean-like constructions. We demonstrate that this correlation is especially pronounced for Trivium-like ciphers which leads us to establish a link between the energy consumption and the security guarantees that makes it possible to find several alternative energy-optimal versions of Trivium that meet the requirements but consume less energy. We present two such designs Trivium-LE(F) and Trivium-LE(S) that consume around 15% and 25% less energy respectively making them the to date most energy-efficient encryption primitives. They inherit the same security level as Trivium, i.e., 80-bit security. We further present Triad-LE as an energy-efficient variant satisfying a higher security level. The simplicity and wide applicability of our model has direct consequences for the conception of future hardware-targeted stream ciphers as for the first time it is possible to optimize for energy during the design phase. Moreover, we extend the reach of our model beyond plain encryption primitives and propose a novel energy-efficient message authentication code Trivium-LE-MAC.