BDD-Based Cryptanalysis of Keystream Generators

Abstract

Abstract. Many of the keystream generators which are used in practice are LFSR-based in the sense that they produce the keystream according to a rule y = C(L(x)), where L(x) denotes an internal linear bitstream, produced by a small number of parallel linear feedback shift registers (LFSRs), and C denotes some nonlinear compression function. We present an n O(1) 2 (1−α)/(1+α)n time bounded attack, the FBDD-attack, against LFSR-based generators, which computes the secret initial state x ∈ {0, 1} n from cn consecutive keystream bits, where α denotes the rate of information, which C reveals about the internal bitstream, and c denotes some small constant. The algorithm uses Free Binary Decision Diagrams (FBDDs), a data structure for minimizing and manipulating Boolean functions. The FBDD-attack yields better bounds on the effective key length for several keystream generators of practical use, so a 0.656n bound for the self-shrinking generator, a 0.6403n bound for the A5/1 generator, used in the GSM standard, a 0.6n bound for the E0 encryption standard in the one level mode, and a 0.8823n bound for the two-level E0 generator used in the Bluetooth wireless LAN system.

Reducing the Space Complexity of BDD-Based Attacks on Keystream Generators

“…Therefore, we have α = γ = 1 4 , and [10] showed that |Q m | ≤ 32m. Hence, we obtain from Theorem 1:…”

“…It consists of only one LFSR and no memory. [10] showed that for the self-shrinking Generator, we have α ≈ 0.2075 and γ = 0.5 as well as |Q m | ≤ m 2 for m ≥ 1.…”

“…As shown in [10], Assumption 1 yields α = − 1 m log 2 p C (m). From a straightforward calculation (c.f.…”

“…The original BDD-based attack in [10], which we are going to describe in this section, assumes a known-plaintext scenario, i.e., the attacker manages to obtain a few plaintext-ciphertext pairs (p 1 , c 1 ), . .…”

“…In Sect. 2, we introduce some notations, give an overview of Binary Decision Diagrams and their algorithmic properties, and review the original BDD-based attack presented in [10]. The impact of the BDD-attack on the keystream generators E 0 , A5/1 and the self-shrinking generator are described together with their basic definitions in Sect.…”