Analysis of Trivium Using Compressed Right Hand Side Equations

Abstract

We study a new representation of non-linear multivariate equations for algebraic cryptanalysis. Using a combination of multiple right hand side equations and binary decision diagrams, our new representation allows a very efficient conjunction of a large number of separate equations. We apply our new technique to the stream cipher Trivium and variants of Trivium reduced in size. By merging all equations into one single constraint, manageable in size and processing time, we get a representation of the Trivium cipher as one single equation.

Advanced Algebraic Attack on Trivium

“…This way, we just generate the variables and monomials that are needed. Note that this is contrary to earlier algebraic modellings of Trivium such as [32,31]. To evaluate our representation of Trivium, we made several experiments with the fast Gröbner basis PolyBoRi [9].…”

“…Previous algebraic attacks ( [34,38,32,31]) use output bits generated by one unknown IV and one key. They are all based on the model described in [31] and fail even for round-reduced variants of Trivium because they attack the internal state of the cipher rather than the key.…”

“…Previous algebraic attacks such as [34,38,32] are based on the algebraic representation of Trivium given in Section 2.1. Therefore, we would expect similar results.…”

Solving Compressed Right Hand Side Equation Systems with Linear Absorption

“…Later implementations and refinement led to a broader interest in BDDs and they were successfully applied in the cryptanalysis of LFSRs [6] and the cipher Grain [7]. For our purposes, we think of a BDD in the following way, more thoroughly described in [1].…”

“…Solving equation systems representing cryptographic primitives is known as algebraic cryptanalysis, and is an active research field. This paper explores one approach for efficiently solving big equation systems, and is based on the work in [1], where the concept of Compressed Right Hand Side (CRHS) equations was introduced. A CRHS equation is a Binary Decision Diagram (BDD) together with a matrix with linear combinations of the variables in the system as rows.…”