Attacks Against Filter Generators Exploiting Monomial Mappings

Abstract

Filter generators are vulnerable to several attacks which have led to well-known design criteria on the Boolean filtering function. However, Rønjom and Cid have observed that a change of the primitive root defining the LFSR leads to several equivalent generators. They usually offer different security levels since they involve filtering functions of the form F (x k) where k is coprime to (2 n − 1) and n denotes the LFSR length. It is proved here that this monomial equivalence does not affect the resistance of the generator against algebraic attacks, while it usually impacts the resistance to correlation attacks. Most importantly, a more efficient attack can often be mounted by considering non-bijective monomial mappings. In this setting, a divide-and-conquer strategy applies based on a search within a multiplicative subgroup of F * 2 n. Moreover, if the LFSR length n is not a prime, a fast correlation involving a shorter LFSR can be performed.

Generalized NLFSR Transformation Algorithms and Cryptanalysis of the Class of Espresso-like Stream Ciphers

“…They redefine the nonlinearity of the LFSR filter function as the minimal distance between equivalent filter functions and affine functions, which implies that a correlation attack may be more successful on a weak equivalent generator. This observation has been proved by Canteaut and Rotella at FSE 2016 [24]. In their paper, they describe how to mount a fast correlation attack on equivalent LFSR filters.…”