Improving Fast Algebraic Attacks

Abstract

Abstract. An algebraic attack is a method for cryptanalysis which is based on finding and solving a system of nonlinear equations. Recently, algebraic attacks where found helpful in cryptanalysing LFSR-based stream ciphers. The efficiency of these attacks greatly depends on the degree of the nonlinear equations. At Crypto 2003, Courtois [8] proposed Fast Algebraic Attacks. His main idea is to decrease the degree of the equations using a precomputation algorithm. Unfortunately, the correctness of the precomputation step was neither proven, nor was it obvious. The three main results of this paper are the following: First, we prove that Courtois' precomputation step is applicable for cryptographically reasonable LFSR-based stream ciphers. Second, we present an improved precomputation algorithm. Our new precomputation algorithm is parallelisable, in contrast to Courtois' algorithm, and it is more efficient even when running sequentially. Third, we demonstrate the improved efficiency of our new algorithm by applying it to the key stream generator E0 from the Bluetooth standard. In this case, we get a theoretical speedup by a factor of about 8, even without any parallelism. This improves the fastest attack known. Practical tests confirm the advantage of our new precomputation algorithm for the test cases considered.

Open Problems Related to Algebraic Attacks on Stream Ciphers

“…Then, an additional precomputation step consists in determining the linear combinations of the previous relations which cancel out the highest degree monomials. Some algorithms for this step have been proposed in [7,2]. This technique helps to decrease the degree of the relations used in the attack for different practical examples.…”

New Guess-and-Determine Attack on the Self-Shrinking Generator

“…how about the linear dependency of these linear equations? Fortunately, from the initial state (a 0 , a 2 …”

“…) T corresponding to the bits selected in (a 1 , a 3 , · · · , a 2l−1 ) according to the pattern of (a 0 , a 2 , · · · , a 2(l−1) ) can be regarded as random vectors over GF (2) L . Thus, this holds also for the truncated versions of g i over GF (2) L−l which form the coefficient matrix on the remaining L − l unknown bits.…”

“…Although many LFSR based stream ciphers are found vulnerable to (fast) correlation attacks [4,5,[14][15][16][23][24][25] and algebraic attacks [1,2,8,9], the selfshrinking generator has shown remarkable resistance against such cryptanalysis. For a length L LFSR, the previously known best concrete attack is the BDD attack in [18], which has time complexity O(2 0.656L ) at the expense of O(2 0.656L ) memory from 2.41 · L bits keystream.…”

Security analysis of linearly filtered NLFSRs

“…The collection can be used by the designers to create new stream ciphers whose security can be tested using the developed cryptographic attacks. The most effective tests for stream cipher include the correlation and fast correlation attacks [22,13,25,7] and the algebraic and fast algebraic attacks [6,8,1,16].…”