Abstract.A general linear iterative cryptanalysis method for solving binary systems of approximate linear equations which is also applicable to keystream generators producing short keystream sequences is proposed. A linear cryptanalysis method for reconstructing the secret key in a general type of initialization schemes is also developed. A large class of linear correlations in the Bluetooth combiner, unconditioned or conditioned on the output or on both the output and one input, are found and characterized. As a result, an attack on the Bluetooth stream cipher that can reconstruct the 128-bit secret key with complexity about 2 70 from about 45 initializations is proposed. In the precomputation stage, a database of about 2 80 103-bit words has to be sorted out.

The resynchronization attack on stream ciphers with a linear next-state function and a nonlinear output function is further investigated. The number of initialization vectors required for the secret key reconstruction when the output function is known is studied in more detail and a connection with the so-called 0-order linear structures of the output function is established. A more difficult problem when the output function is unknown is also considered. An efficient branching algorithm for reconstructing this function along with the secret key is proposed and analyzed. The number of initialization vectors required is larger in this case than when the output function is known, and the larger the number, the lower the complexity.

No abstract

Given a block cipher of length L Cook's elastic cipher allows to encrypt messages of variable length from L to 2L. Given some conditions on the key schedule, Cook's elastic cipher is secure against any key recovery attack if the underlying block cipher is, and it achieves complete diffusion in at most q + 1 rounds if the underlying block cipher achieves it in q rounds. We extend Cook's construction inductively, obtaining the first elastic cipher for any message length greater than L with the same properties of security as Cook's elastic cipher, and whose complexity of the encryption/decryption grows polynomially with the size of the message.

No abstract