Linear Cryptanalysis of the TSC Family of Stream Ciphers

Abstract

Abstract. In this paper, we introduce a new cryptanalysis method for stream ciphers based on T-functions and apply it to the TSC family which was proposed by Hong et al.. Our attack are based on linear approximations of the algorithms (in particular of the T-function). Hence, it is related to correlation attack, a popular technique to break stream ciphers with a linear update, like those using LFSR's.We show a key-recovery attack for the two algorithms proposed at FSE 2005 : TSC-1 in 2 25.4 computation steps, and TSC-2 in 2 48.1 steps. The first attack has been implemented and takes about 4 minutes to recover the whole key on an average PC. Another algorithm in the family, called TSC-3, was proposed at the ECRYPT call for stream ciphers. Despite some differences with its predecessors, it can be broken by similar techniques. Our attack has complexity of 2 42 known keystream bits to distinguish it from random, and about 2 66 steps of computation to recover the full secret key.An extended version of this paper can be found on the ECRYPT website [23].

Differential Cryptanalysis of T-Function Based Stream Cipher TSC-4

“…Because Pr(K ∈ A , IV ∈ B) = 2 −14 , by the conditional probability formula with (10) and (11), we get…”

“…In 2005 and 2006, Muller and Peyrin [10,11] introduced a linear cryptanalysis attack on the TSC family TSC-1, TSC-2, TSC-3 together with Klimov and Shamir's ciphers. This linear correlation attack can recover the full secret keys of these stream ciphers.…”

Modifying LFSR of ZUC to Reduce Time for Key-Stream Generation

“…The new structure has become little complex but it can produce key-streams faster than original ZUC. Attacks related to LFSR are reported in [6][7][8] which implies that it can lead to breakdown of algorithm. Reports and theoretical work discuss the strength of LFSR and suggest that LFSR is susceptible to attacks due to its linearity.…”

Non-randomness in eSTREAM Candidates Salsa20 and TSC-4

“…In [10,11], predecessors of TSC-4 have been attacked by exploiting a bit-flip bias for multiple applications of the state update function f. This bias still exists for regular updates of TSC-4, but the strong filter function g prevents from an attack. In this section, we disregard the details of the filter function and investigate the statistical properties of multiple warm-up updates of TSC-4: While the regular updates have some guaranteed properties, the warm-up updates use additional ad hoc operations that are designed to accelerate diffusion.…”