Grain-128a: a new version of Grain-128 with optional authentication

Ågren, Martin; Hell, Martin; Johansson, Thomas; Meier, Willi

doi:10.1504/ijwmc.2011.044106

Cited by 168 publications

(125 citation statements)

References 30 publications

Supporting

Mentioning

124

Contrasting

Unclassified

Order By: Relevance

“…If two internal states S and S ∆ be such that they differ in the LFSR location 13 (and in no other tap locations that contribute to the keystream bit generation), then the difference of the keystream bit produced by them will be equal to the value in LFSR location 20. Similar analysis can be done corresponding to (2), (3), (4). Assume that the attacker has injected a fault at location 127 of the LFSR at the beginning of the PRGA.…”

Section: S T = [X Tmentioning

confidence: 89%

“…The physical structure of the Grain family is simple as well as elegant and has been designed so as to require low hardware complexity. In response to cryptanalysis against the initial design of the cipher, the modified versions Grain v1 [13], Grain-128 [14] and Grain-128a [2] were proposed in due course. Analysis of this cipher is an area of recent interest as evident from number of cryptanalytic results [3-12, 16-19, 22, 23].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A Differential Fault Attack on Grain-128a Using MACs

Banik

Maitra

Sarkar

2012

Security, Privacy, and Applied Cryptography Engineering

View full text Add to dashboard Cite

Abstract. The 32-bit MAC of Grain-128a is a linear combination of the first 64 and then the alternative keystream bits. In this paper we describe a successful differential fault attack on Grain-128a, in which we recover the secret key by observing the correct and faulty MACs of certain chosen messages. The attack works due to certain properties of the Boolean functions and corresponding choices of the taps from the LFSR. We present methods to identify the fault locations and then construct set of linear equations to obtain the contents of the LFSR and the NFSR. Our attack requires less than 2 11 fault injections and invocations of less than 2 12 MAC generation routines.

show abstract

Section: S T = [X Tmentioning

confidence: 89%

Section: Introductionmentioning

confidence: 99%

A Differential Fault Attack on Grain-128a Using MACs

Banik

Maitra

Sarkar

2012

Security, Privacy, and Applied Cryptography Engineering

View full text Add to dashboard Cite

show abstract

“…In dynamic cube attack [4], attacker tries to both find and set to zero these state bits via utilizing the dedicated public bits named dynamic variables. The best previous attack [5] applied to reduced variant of Grain-128 [6], where a number of initial rounds are reduced from 256 to 213, can just recover 2 key bits. Whereas, dynamic cube attack is applied to two reduced variants of Grain-128 [4] in which it obtains the full 128-bit key faster than exhaustive search.…”

Section: Introductionmentioning

confidence: 99%

Dynamic cube attack on Grain‐v1

Rahimi

Barmshory

Mansouri

et al. 2016

IET Information Security

View full text Add to dashboard Cite

This article aims to present dynamic cube attack on Grain-v1. Dynamic cube attack finds the secret key by using distinguishers gained from structural weakness. The main idea of dynamic cube attack lies in simplifying the output function. After making it simpler, dynamic cube attack will be able to exploit distinguishing attack for recovering the secret key. In this paper, we investigate Grain-v1 to which key recovery attack has never been applied because its feedback function is so sophisticated. we apply dynamic cube attack on it by utilizing both intelligent choices of Initial Value variables and appropriate simplifications. Our attack is done in feasible time complexity, and it recovers all bits of the key while the number of initialization rounds in Grain-v1 is decreased to 100. This attack is faster than exhaustive search by a factor 2 32 .

show abstract

“…Grain-128a [2] is the latest modified version of Grain family. This cipher is based on an 128 bits LFSR , an 128 bits NFSR and a non-linear filter function and two different modes of operations: with or without authentication.…”

Section: Introductionmentioning

confidence: 99%

A Probabilistic Algebraic Attack on the Grain Family of Stream Ciphers

Datta

Roy

Mukhopadhyay

2014

Network and System Security

View full text Add to dashboard Cite

Abstract:-In 2005, Hell, Johansson and Meier submitted a stream cipher proposal named Grain v1 to the estream call for stream cipher proposals and it also became one estream finalists in the hardware category. The output function of Grain v1 connects its 160 bits internal state divided equally between an LFSR and an NFSR, using a non-linear filter function in a complex way. Over the last years many cryptanalyst identified several weaknesses in Grain v1. As a result in 2011 the inventors modified Grain v1 and published a new version of Grain named Grain-128a which has a similar structure as Grain v1 but with a 256 bits internal state with an optional authentication is the latest version of Grain family resisting all known attacks on Grain v1. However both these ciphers are quite resistant against the classical algebraic attack due to the rapid growth of the degree of the key-stream equations in subsequent clockings caused by the NFSR. This paper presents a probabilistic algebraic attack on both these Grain versions. The basic idea of our attack is to develop separate probabilistic equations for the LFSR and the NFSR bits from each key-stream equations. Surprisingly it turns out that in case of Grain-128a our proposed equations hold with all most sure probability, which makes the sure retrieval of the LFSR bits. We also outline a technique to reduce the growth of degree of the equations involving the NFSR bits for Grain v1. Further we high light that the concept of probabilistic algebraic attack as proposed in this paper can be considered as a generic attack strategy against any stream cipher having similar structure of the output function as in case of the Grain family.

show abstract

Grain-128a: a new version of Grain-128 with optional authentication

Cited by 168 publications

References 30 publications

A Differential Fault Attack on Grain-128a Using MACs

A Differential Fault Attack on Grain-128a Using MACs

Dynamic cube attack on Grain‐v1

A Probabilistic Algebraic Attack on the Grain Family of Stream Ciphers

Contact Info

Product

Resources

About