Computation of low-weight parity checks for correlation attacks on stream ciphers

Penzhorn, W.T.; Kuhn, G.J.

doi:10.1007/3-540-60693-9_10

Cited by 19 publications

(8 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It follows that the received sequence (s n ) n<N can be decoded with Gallager algorithm when the feedback polynomial P has a low weight and when the error probability p is not too high. Several minor improvements of this original attack were proposed in [21,12,1,13,15] but these papers did not introduce any important modification of the basic underlying concepts. Johansson and Jönsson recently proposed two new techniques for fast correlation attacks: the main idea is to derive from (s n ) n<N a sequence which can be seen as a corrupted version of a word of a convolutional code [6] or of a turbo code [7].…”

Section: Fig 2 Correlation Attack Involving K Constituent Lfsrsmentioning

confidence: 99%

Improved Fast Correlation Attacks Using Parity-Check Equations of Weight 4 and 5

Canteaut

Trabbia

2000

Advances in Cryptology — EUROCRYPT 2000

168

160

View full text Add to dashboard Cite

Abstract. This paper describes new techniques for fast correlation attacks, based on Gallager iterative decoding algorithm using parity-check equations of weight greater than 3. These attacks can be applied to any key-stream generator based on LFSRs and it does not require that the involved feedback polynomial have a low weight. We give a theoretical analysis of all fast correlation attacks, which shows that our algorithm with parity-check equations of weight 4 or 5 is usually much more efficient than correlation attacks based on convolutional codes or on turbo codes. Simulation results confirm the validity of this comparison. In this context, we also point out the major role played by the nonlinearity of the Boolean function used in a combination generator.

show abstract

Section: Fig 2 Correlation Attack Involving K Constituent Lfsrsmentioning

confidence: 99%

Improved Fast Correlation Attacks Using Parity-Check Equations of Weight 4 and 5

Canteaut

Trabbia

2000

Advances in Cryptology — EUROCRYPT 2000

168

160

View full text Add to dashboard Cite

show abstract

“…Interestingly, Penzhorn and Kühn also gave a totally different cubic-time algorithm [26], using discrete logarithms in GF (2 n ). Their method finds a parity check with weight 4 and degree 2 n/3 in O((1 + α) · 2 n/3 ) time, where α represents the time to compute a discrete log in GF (2 n ).…”

mentioning

confidence: 98%

A Generalized Birthday Problem

Wagner

2002

Lecture Notes in Computer Science

380

348

View full text Add to dashboard Cite

Abstract. We study a k-dimensional generalization of the birthday problem: given k lists of n-bit values, find some way to choose one element from each list so that the resulting k values xor to zero. For k = 2, this is just the extremely well-known birthday problem, which has a square-root time algorithm with many applications in cryptography. In this paper, we show new algorithms for the case k > 2: we show a cube-root time algorithm for the case of k = 4 lists, and we give an algorithm with subexponential running time when k is unrestricted. We also give several applications to cryptanalysis, describing new subexponential algorithms for constructing one-more forgeries for certain blind signature schemes, for breaking certain incremental hash functions, and for finding low-weight parity check equations for fast correlation attacks on stream ciphers. In these applications, our algorithm runs in O(2 2 √ n ) time for an n-bit modulus, demonstrating that moduli may need to be at least 1600 bits long for security against these new attacks. As an example, we describe the first-known attack with subexponential complexity on Schnorr and Okamoto-Schnorr blind signatures over elliptic curve groups.

show abstract

“…Let us now study the generating function for the LFSR f (·) closer. From [24] a ω-weight multiple will have the degree roughly…”

Section: Distinguishing Attack On Grainmentioning

confidence: 99%

Cryptanalysis of the "Grain" family of stream ciphers

Maximov

2006

Proceedings of the 2006 ACM Symposium on Information, Computer and Communications Security

View full text Add to dashboard Cite

Let us have an NLFSR with the feedback function g(x) and an LFSR with the generating polynomial f (x). The function g(x) is a Boolean function on the state of the NLFSR and the LFSR, at any time instance t. Whenever the LFSR has good statistical properties, it is used for controlling the randomness of the NLFSR's state machine. In this paper we define and study the general class of "Grain" family of stream ciphers, where the keystream bits are generated by another Boolean function h(y) on the states of the NLFSR and the LFSR. We show that the cryptographic strength of this family is related to the general decoding problem, when a key-recovering attack is considered. A proper choice of the functions f (·), g(·) and h(·) could, potentially, give us a strong instance of a stream cipher. One of such stream ciphers Grain was recently proposed as a candidate for the European project ECRYPT in May, 2005. Grain uses the secret key of length 80 bits and its internal state is of size 160 bits. It was suggested as a fast and small primitive for efficient hardware implementation. In our work we propose the analysis of such structures in general, and, in particular, we give a linear distinguishing attack on Grain with time complexity O(2 54 ), when O(2 51 ) bits of the keystream is available. This is the first paper presenting an attack on Grain, and it reveals a leakage in the choice of the functions in this particular design instance.

show abstract

Computation of low-weight parity checks for correlation attacks on stream ciphers

Cited by 19 publications

References 12 publications

Improved Fast Correlation Attacks Using Parity-Check Equations of Weight 4 and 5

Improved Fast Correlation Attacks Using Parity-Check Equations of Weight 4 and 5

A Generalized Birthday Problem

Cryptanalysis of the "Grain" family of stream ciphers

Contact Info

Product

Resources

About