New Related Key Attacks on the RAKAPOSHI Stream Cipher

WG-8 is a new lightweight variant of the well-known Welch-Gong (WG) stream cipher family, and takes an 80-bit secret key and an 80-bit initial vector (IV) as inputs. So far no attack on the WG-8 stream cipher has been published except the attacks by the designers. This paper shows that there exist Key-IV pairs for WG-8 that can generate keystreams, which are exact shifts of each other throughout the keystream generation. By exploiting this slide property, an effective key recovery attack on WG-8 in the related key setting is proposed, which has a time complexity of 2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">53.32</sup> and requires 2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">52</sup> chosen IVs. The attack is minimal in the sense that it only requires one related key. Furthermore, we present an efficient key recovery attack on WG-8 in the multiple related key setting. As confirmed by the experimental results, our attack recovers all 80 bits of WG-8 in on a PC with 2.5-GHz Intel Pentium 4 processor. This is the first time that a weakness is presented for WG-8, assuming that the attacker can obtain only a few dozen consecutive keystream bits for each IV. Finally, we give a new Key/IV loading proposal for WG-8, which takes an 80-bit secret key and a 64-bit IV as inputs. The new proposal keeps the basic structure of WG-8 and provides enough resistance against our related key attacks.

Generation of pseudorandom binary sequences by means of linear feedback shift registers (LFSRs) with dynamic feedback

HC-256 proposed by Wu Hongjun at FSE 2004 is a software-efficient stream cipher algorithm based on table-driven, which is proposed as a final candidate to the eSTREAM project. In this paper, we modified the original version of HC-256 by removing the constant in the key expansion function, which we denoted HC-256*. Then we make a related-key security analysis on HC-256* and receive a conclusion that HC-256* is provable security under the related-key attack.

This paper presents related-key attacks against lightweight block cipher ANU that requires only 1015 gate equivalents for a 128-bit key, which is less than all existing lightweight ciphers. The design of ANU appears to be a mixture of other decent lightweight ciphers such as Simon, PRESENT, Piccolo, TWINE etc., however, the security arguments especially against related-key attacks are not theoretically supported. In this paper, we observe that the mixture of a Simon-like round function and a PRESENT-like key schedule function causes a very sparse differential trail that avoids non-linear update in the key schedule function. By exploiting it, a distinguishing attack against full-round ANU works only with \(2^{19}\) queries in the related-key setting, in which the attack is verified by our machine experiment. This also leads to a key recovery attack for a 128-bit key with \(2^{112}\) computations.

The Advanced Encryption Standard (AES) is considered to be the most important and widely deployed symmetric primitive. While the cipher was designed to be immune against differential and other classical attacks, this immunity does not hold in the related-key setting, and various related-key attacks have appeared over time. This work presents tools and algorithms to search for related-key distinguishers and attacks of differential nature against the AES. First, we propose two entirely different approaches to find optimal truncated differential characteristics and bounds on the minimum number of active S-boxes for all variants of the AES. In the first approach, we propose a simple MILP model that handles better linear inconsistencies with respect to the AES system of equations and that compares particularly well to previous tool-based approaches to solve this problem. The main advantage of this tool is that it can easily be used as the core algorithm to search for any attack on AES exploiting related-key differentials. Then, we design a fast and low-memory algorithm based on dynamic programming that has a very simple to understand complexity analysis and does not depend on any generic solver. This second algorithm provides us useful insight on the related-key differential search problem for AES and shows that the search space is not as big as one would expect. Finally, we build on the top of our MILP model a fully automated tool to search for the best differential MITM attacks against the AES. We apply our tool on AES-256 and find an attack on 13 rounds with only two related keys. This attack can be seen as the best known cryptanalysis against this variant if only 2 related keys are permitted.

The new information and communication technologies require adequate security. In the past decades ,we have witnessed an explosive growth of the digital storage and communication of data ,triggered by some important breakthroughs such as the Internet and the expansive growth of wireless communications. In the world of cryptography ,stream ciphers are known as primitives used to ensure privacy over communication channel and these are widely used for fast encryption of sensitive data. Lots of old stream ciphers that have been formerly used no longer be considered secure ,because of their vulnerability to newly developed cryptanalysis techniques. Many designs stream ciphers have been proposed in an effort to find a proper candidate to be chosen as world standard for data encryption. From these designs, the stream ciphers which are Trivium,Edon80 and Mickey are implemented in ‘c’ language with out affecting their security .Actually these algorithms are particularly suited for hardware oriented environments which provides considerable security and efficiency aspects. We will be targeting hardware applications, and good measure for efficiency of a stream cipher in this environment is the number of key stream bits generated per cycle per gate. For good efficiency we are approaching two ways .One approach is minimizing the number of gates.The other approach is to dramatically increase the number of bits for cycle. This allows reducing the clock frequency at the cost of an increased gate count. Apart from the implementation the analysis which includes the security of these algorithms against some attacks related to stream ciphers such as guess and deterministic attacks, correlation attacks, divide and conquer attacks and algebraic attacks are presented.

In truncated differential cryptanalysis of symmetric primitives, a generalized framework is to search a distinguisher concerning part of output differences, like truncated differential distribution (TDD) on certain bits (e.g. a nibble) first, and then append several rounds before and after it to recover the secret key. The logarithmic likelihood ratio statistic with respect to the TDD is usually used to distinguish guessed key bits. In this paper, we study how to improve the effect of truncated differential cryptanalysis by considering key schedules of the attacked ciphers. It turns out that for a cipher with a simple key schedule, certain guessed subkey bits may reveal information of the master key, which will help build a stronger TDD distinguisher and reduce the key recovery complexity or attack more rounds. As a result, we explore heuristic techniques to search key-recovery-friendly TDDs and construct automatic search models based on MILP. The refined methods are applied to two recent designs of symmetric primitives, WARP and Orthros, together with peculiarities of their structures as well. For WARP, after making two observations on relations between certain differences with key bits, we propose an algorithm that can find TDDs with low complexities and having potentialities to cover more rounds. Consequently, we launch key recovery attacks on 24 to 27 rounds of WARP. When it comes to Orthros, we present a two-step search algorithm to balance the number of guessed key bits and TDDs, obtaining a key recovery attack on a 7-round variant of it in the weak-key setting. Finally, we perform several verification experiments on round-reduced versions of WARP and Orthros, and the experimental results are consistent with the theoretical distributions and the analysis of generalized key recovery attack framework.

In this paper, we present Decim v2, a stream cipher hardware-oriented selected for the Phase 3 of the ECRYPT stream cipher project eSTREAM. As required by the initial call for hardware-oriented stream cipher contribution, Decim v2 manages 80-bit secret keys and 64-bit public initialization vectors. The design of Decim v2 combines two filtering mechanisms: a nonlinear Boolean filter over a LFSR, followed by an irregular decimation mechanism called the ABSG. Since designers have been invited to demonstrate flexibility of their design by proposing variants that take 128-bit keys, we also present a 128-bit security version of Decim called Decim-128.

In order to provide a general-purpose dynamic shift register, and to demonstrate the LSI capabilities of the bucket-brigade class of MOS circuits, a 1024-bit bucket-brigade dynamic shift register chip has been designed and built. This chip is organized as four 256-bit registers with common clocking. It operates up to 1 MHz with a 10 V p-p clock swing. Digital regeneration has been included at 16-bit intervals to offset the degradation of incomplete charge transfer at high frequencies. The design has been based on the Al <inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</inf> O <inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">3</inf> -SiO <inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</inf> insulated gate FET technology, including the use of BIGFET's to supply the output currents required to interface with TTL circuits. The chip is 0.167 inches beam-tip to beam-tip, and the effective area of each bucket-brigade bit is 10.8 square mils using 10µ design rules and oversized cell size to provide wide operating margins. On a few test slices, the operating frequency has been extended from the normal 1 MHz to at least 1.5 MHz by the inclusion of an ion implant to control dynamic drain conductance.

In recent years, there has been a growing interest in microelectronic fabrication of thin, flexible substrates. The utilization of flexible materials in processing is motivated by the need to have low weight, high strength microelectronic circuitry compatible with roll-to-roll processing. This can lead to a new era in the fabrication of reliable, low cost and highly versatile circuits for a wide variety of applications. This metal foils offer a number of significant advantages over polymers, their main contender in this field. The most important asset of metals for substrate application is their compatibility with high temperature processing (up to 1000°C), which can lead to high mobility, low drift devices. This paper examines the performance of a variety of circuits fabricated on flexible metal foils, such as stainless steel, using laser crystallized polycrystalline silicon films. The basic performance characteristiscs and architecture of fabricated static and dynamic shift registers and ring oscillators are discussed. N-channel thin film transistors with an average mobility of 200cm²/Vs were measured. Ring oscillator measurements indicated an average propagation delay of 1.38ns per inverter stage at a supply voltage of 15V. Both static and dynamic shift registers exhibit a maximum clock frequency beyond 1MHz. These circuits play a pivotal role for the fabrication of integrated display systems and most other large area electronics. This is the first time circuits of this complexity and performance have been successfully fabricated on flexible metal substrates.

Driver circuits for small LCD (Liquid Crystal Display) are formed on the same glass substrate as LCD by means of TFTs (Thin Film Transistors), which is called SoG (System on Glass) technology. If the driver circuit is designed by nMOS transistor only, then production cost is reduced, because the pMOS process can be eliminated. In this paper, we propose a new nMOS 2-phase clock dynamic logic shift register, which is indispensable in active-matrix LCD driver circuits. Moreover, we propose a design method determining gate widths of nMOS transistors in 2-phase clock dynamic logic shift registers, and show performance evaluation results.

The first part of this paper deals with the basic photodiode unit, its principle of operation, and the factors that affect the photodiode and array sensitivity. Experimental results of the planar Si p/sup +/-n photodiode are presented. Design and layout considerations including the integration time are also given. The second part of this paper deals with scanning of photodiode arrays. Detail design considerations are given for a static MOST ring counter. A dynamic shift register with clocked loads for integral scanning is also considered. Design considerations of a realized photosensing matrix with integral scanning are given. Finally, scanning problems of large arrays are briefly considered.

The stream cipher, a type of secret‐key cipher, gives the key to a pseudorandom number generator and generates a pseudorandom sequence called the key sequence, and generates the ciphertext sequence taking the exclusive‐or of this sequence and the plaintext sequence. A nonlinear combiner generator is a type of pseudorandom number generator used by stream ciphers and is configured from multiple linear‐feedback shift registers (LFSRs) and one nonlinear function. A correlation attack is a method for attacking this type of pseudorandom number generator. The correlation between the output sequence of an LFSR and the key sequence is used to estimate the initial state of the LFSR. However, a conventional attack method attacks a single LFSR and is used only to estimate a portion of the multidimensional correlations of the multiple LFSR sequences and the key sequence. Therefore, we propose an algorithm that improves the attack method using the belief propagation (BP) algorithm of Mihaljević and colleagues and simultaneously attacks multiple LFSRs using the multidimensional correlation. By increasing the information used in the estimation, an improvement in the decoding success rate is expected. In addition, the computational load of the estimation increases, but this increase can be suppressed by an approximation based on the parallel BP algorithm. © 2006 Wiley Periodicals, Inc. Electron Comm Jpn Pt 3, 90(4): 9 – 17, 2007; Published online in Wiley InterScience (www.interscience.wiley.com). DOI 10.1002/ecjc.20270

Communication security that depends on chaos can be considered as a new approach which provides protection and security of communications and maintains confidentiality because Chaos theory can be implemented in cryptosystem successfully. A stream cipher, on the other hand, is a type of symmetric cryptosystem in which the plaintext is divided into small entities known as characters. The key in stream cipher is typically generated by a random bit generator. Many key stream generators employ linear feedback shift registers (LFSRs). LFSR systems are made up of a group of LFSR units and a combining function (CF) unit. The plaintext is encrypted one bit at a time. The key is fed into a random bit generator, which produces a long series of binary signals. This "key-stream" k is then combined with plaintext m, typically via a bit-wise XOR (Exclusive-OR modulo 2 addition), to produce the ciphertext stream, which employs the same random bit generator and seed. In this paper we will introduce a new stream cipher keygenerator which using a hybrid between chaotic and combination of Linear Feedback Shift Registers (LFSR's). The proposed generator can be used to protect different types of data files (text, image, audio and video). Many kinds of tests are applied to specifying the goodness of the proposed keygenerator. The results of testing prove the efficiency of the suggested system.

Encryption and decryption are the two most important complex methods for achieving security in any type of smart devices and systems/machines through transport layer security protocol (TLS). The symmetric key algorithms are the significant method for encrypting and decrypting the data/information using block cipher or stream cipher which is used for TLS protocol. The primary symmetric key block cipher algorithm used in TLS is Advanced Encryption standard (AES) and it provides security based on the key bits used in AES operation. The TLS protocol provides confidentiality(C), integrity (I) and Authenticity (A) in a single pass communication that is Authentication Encryption and Authentication Data (AEAD) between web browser and web server. It uses well known TLS cipher suite AES-GCM (Galois Counter mode) which is commonly used in TLS1.2. Suppose AES-NI hardware acceleration is not available in smart devices like tablets it causes performance issues in smart devices using TLS 1.2 protocol. If the smart device does not possess AES-NI, it can use software for running AES-GCM but it takes a lot of time for encryption/decryption of information, ergo causing the battery performance in smart devices. The newer symmetric Stream cipher CHACHA20-POLY1305 provides AEAD for securing the communication in smart devices thus reducing the battery cycles which is used for TLS 1.3. The paper discusses the pros and cons of AES-GCM authentication encryption used in TLS 1.2.