feedback shift register based stream...
TRANSCRIPT
![Page 1: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/1.jpg)
5/15/2007 1
Feedback shift register based stream ciphers
Thomas Johansson,Lund University,
Lund, Sweden
![Page 2: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/2.jpg)
5/15/2007 2
CONTENTS
Efficient encryption and possible solutionsStream ciphersBasic security analysis of stream ciphers
LFSR sequencesDesign of LFSR based stream ciphersNLFSR sequences
![Page 3: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/3.jpg)
5/15/2007 3
OUR PROBLEM –EFFICIENT ENCRYPTION
Public key solutions too slow, used only for key setupWe need symmetric encryptionStream ciphers, Block ciphers
![Page 4: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/4.jpg)
5/15/2007 4
BLOCK CIPHERS
Ideally, random permutations
One problem: We cannot encrypt as follows:(because if pi=pj then ci=cj)
BC BC . . .
p1 p2
c1 c2
BC
pk
ck
k
![Page 5: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/5.jpg)
5/15/2007 5
BLOCK CIPHERS
The block cipher must be used in a mode of operationFor example, counter mode
But this is also a stream cipher …
![Page 6: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/6.jpg)
5/15/2007 6
STREAM CIPHERS
(Additive synchronous)
The PRKG stretches the k bit key to some arbitrarily long sequence
Z = z1, z2, z3, …(keystream, running key)
![Page 7: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/7.jpg)
5/15/2007 7
DEFINITION OF A GENERATOR
Version 1
Version 2 (with IV):
key keystream00…00 0110100110110100…
00…01 1010111001000010…
IV key00…00 00…00 0110100110110100…” 00…01 1010111001000010…
00…01 00…00 1100101101010101…” 00…01 0101001100110100…
![Page 8: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/8.jpg)
5/15/2007 8
OPERATION OF A STREAM CIPHER
1. Key initializationSet all the internal variables according to the selected
keyIV initialization
Set all the internal variables according to the IV2. Run the generator and produce the keystream
Z = z1, z2, z3, …3. Add the keystream to the plaintext
ci = pi + zi
![Page 9: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/9.jpg)
5/15/2007 9
MOTIVATION FOR STUDYING STREAM CIPHERS
We need to bring forward new modern stream ciphers and study them carefullyA modern stream cipher should be superior to a block cipher in performance (software and hardware)A modern stream cipher should provide security similar to a block cipher, for example, the ``best’’ attack is an exhaustive key search attack
![Page 10: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/10.jpg)
5/15/2007 10
BLOCK CIPHERS VS STREAM CIPHERS
Idea: Since we are already using stream ciphers through block cipher + some mode of operation we might gain something through a direct construction
Typical gain: Higher speed in software, smaller complexity in hardware, lower power consumption, …In some applications this is very important
Security ?There are many well known and well studied block ciphers DES, IDEA, RC5, … more recent AES + candidates, Camelia,…There are not many equally well known stream ciphers A5, RC4, and definitely not many of them with good security!
![Page 11: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/11.jpg)
5/15/2007 11
Security of a stream cipher
The standard assumption KNOWN PLAINTEXT ATTACK
This implies knowledge of the keystreamZ = z1, z2, … , zN
When IV is used the opponent knowsZ1 = z1,1, z1,2, … , z1,N, for IV = 1Z2 = z2,1, z2,2, … , z2,N for IV = 2…
generated by the same key k. Could be a chosen IV attack.
![Page 12: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/12.jpg)
5/15/2007 12
DIFFERENT TYPES OF ATTACKS
KEY RECOVERY ATTACKRecover the secret key k.DISTINGUISHING ATTACKS
Build a distinguisher that can distinguishZ = z1, z2, … , zN from random
(or Z1; Z2; … in the IV case)OTHER ATTACKSRELATED: Prediction of the next symbol, …UNRELATED: Side-channel attacks (power analysis, timing attacks, etc.), …
![Page 13: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/13.jpg)
5/15/2007 13
DISTINGUISHING ATTACKS
Assume that D is given a truly random X with probability ½.If P(D guesses correct) > ½ we have a distinguisher (with some advantage)
Note: We are usually not interested in cases whenP(D guesses correct) = ½ + 2-n for too small 2-n .
![Page 14: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/14.jpg)
5/15/2007 14
APPLICATION OF A DISTINGUISHING ATTACK
THE ATTACKERGuesses that PLAINTEXT = PICTURE 1 (P1)Calculates Z’ = P1 + CGive Z’ to the distinguisher If Z’ is recognized as ``CIPHER’’ the plaintext was PIC. 1If Z’ is recognized as ``RANDOM’’ the plaintext was PIC. 2
(A wrong guess would give Z’= P1+C= P1+ P2+Z)
![Page 15: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/15.jpg)
5/15/2007 15
DIFFERENT TYPES OF STREAM CIPHERS
BIT-ORIENTED: ``ONE BIT ON EACH CLOCK’’SHRINKING
SELFSHRINKING
ALTERNATING STEP
![Page 16: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/16.jpg)
5/15/2007 16
A5/1
Bluetooth, E0Nonlinear combination generators and Filter generators
Very simple to implement in hardwareBUT
in general slow in softwareIn addition, some have security problems
![Page 17: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/17.jpg)
5/15/2007 17
WORD-ORIENTED STREAM CIPHERS
``Produce a word on each clock/step’’Word size: 8, 16, 32, 64When we are operating on words, things are a bit different…Moving closer to block ciphers, using their machinery, e.g.,
S-boxes, SP-networks, etc.
![Page 18: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/18.jpg)
5/15/2007 18
ATTACK TECHNIQUES
``UNIVERSAL DISTINGUISHERS’’NIST statistical test suite, DIEHARD, …GUESS AND DETERMINEGuess unknown things on demand``CORRELATION ATTACKS’’
Dependence between output and internal unknown variablesLINEAR ATTACKSApply linear approximations``ALGEBRAIC ATTACKS’’View your problem as the solution to a system of nonlinear equations``TIME-MEMORY TRADEOFF ATTACKS’’
![Page 19: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/19.jpg)
5/15/2007 19
GUESS AND DETERMINE
Example: ``GUESS AND DETERMINE’’
s1+t1+u1 =z1
sd1=x, td2
=x, ud3=x+1
s2+t2+u1 =z2,…
![Page 20: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/20.jpg)
5/15/2007 20
CORRELATION ATTACKS
All possible LFSR sequences are codeword in a linear code CReconstructing the initial state is the problem of decoding the code C on BSC (1/2 + ε).
![Page 21: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/21.jpg)
5/15/2007 21
LINEAR ATTACKS
Replace nonlinear parts by a linear approximation
Find an expression where all unknown variables are eliminated, Σ cizn+i = 0Binary case, let Bn =Σ cizn+i . Then
P(Bn = 0)= ½+ ε.Collect as many samples as we need to distinguish the sequence B1, B2, … from random.
![Page 22: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/22.jpg)
5/15/2007 22
ALGEBRAIC ATTACKS
Find a low degree algebraic expression relating Z and S,
F(zn,zn+1,…, sn,sn+1,…)=0Valid for all n!Generate a system of nonlinear equationsSimplest case: If the number of equations we can generate is very large we may solve the system by relinearization.
![Page 23: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/23.jpg)
5/15/2007 23
RECENTLY PROPOSED STREAM CIPHERS
Some proposed stream ciphers 2000-2003
SNOW 2.0 Lund Univ.SOBER –t16, t32, 128 QualcommTURING “SCREAM IBMMUGI Hitachi RABBIT Cryptico
Word-oriented, fast in software
Use of LFSR or buffersOne linear part/update and one nonlinear
eSTREAM project (2004-2008)
• 34 stream ciphers submitted (2005)
• Software: CryptMT, Dragon, HC, LEX, NLS, Rabbit, Salsa20, Sosemanuk
• Hardware: DECIM, Edon80, F-FCSR, Grain, Mickey, Moustique, Pomaranche, Trivium
• A lot of new ideas and techniques being evaluated…
![Page 24: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/24.jpg)
5/15/2007 24
DISCUSSION ISSUE
Where should the level of required security be?
Note: An n-bit block cipher in use is usually distinguished from random using 2n/2 output blocks and the same complexity.
Ex. AES is distinguished from random using ~ 264
blocks of outputDES is distinguished from random using ~ 232
blocks of output
![Page 25: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/25.jpg)
5/15/2007 25
LFSR BASED APPROACH TO STREAM CIPHER DESIGN
LFSR sequences have nice statistical properties.The idea is to combine or modify LFSR sequences to completely destroy the linear property of them.This is the old classic way of constructing stream ciphers.
![Page 26: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/26.jpg)
5/15/2007 26
LFSR sequences
LFSR sj∈GF(q)
Connection polynomial C(D)= 1 +c1D+c2D2+…+cLDL
![Page 27: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/27.jpg)
5/15/2007 27
Alternative representations
Linear recurrence relation sj=-c1 sj-1 -c2 sj-2-…-cL sj-L,
Characteristic polynomial of the recurrence,f(x)= xL +c1 xL-1 +c2xL-2 …+cL-1x+cL
![Page 28: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/28.jpg)
5/15/2007 28
If the polynomial is irreducible we can also write
sj=Tr(ßαj),where α,ß∈GF(qL), and Tr(x)=x+xq+xq2+…+ xqL-1 is the trace map
from GF(qL) to GF(q).
![Page 29: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/29.jpg)
5/15/2007 29
Multiplication in GF(qL)
The LFSR basically implements multiplication with α in GF(qL)A state-transition graph gives a number of different cycles.C(D) irreducible 1[1]+ (qL-1)/T [T]C(D) primitive 1[1]+ 1 [qL-1]C(D) reducible cycles of different lengths
![Page 30: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/30.jpg)
5/15/2007 30
Primitive connection polynomials, q=2
m-sequences (period 2L-1)Statistical properties
P(sj=0)≈1/2, P((sj,sj+1)=(a,b)) ≈1/4, …P(sj1
+sj2+…+sjn
=0)≈1/2 unless sj1
+sj2+…+sjn
obeys the recurrence relation.Adding two m-sequences results in a new m-sequence
![Page 31: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/31.jpg)
5/15/2007 31
Summary of statistical properties
m-sequences have almost ideal statistical properties, except for
the linear parity checks described by the connection polynomial
C(D)= 1 +c1D+c2D2+…+cLDL
and all its multiples P(D)=Q(D) C(D).
We need to do something about that…
![Page 32: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/32.jpg)
5/15/2007 32
The nonlinear combination generator
Combine severalm-sequences usinga Boolean function.
![Page 33: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/33.jpg)
5/15/2007 33
The filter generator
An m-sequence is filtered by a nonlinear function F(x)
![Page 34: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/34.jpg)
5/15/2007 34
THE SNOW STREAM CIPHERS
Designed at Lund University, Sweden (Johansson, Ekdahl)SNOW 2.0
ISO standard ISO/IEC 18033-4:2005 DPCP (DisplayPort Content Protection)Reference stream cipher in eSTREAM
SNOW 3GUMTS
![Page 35: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/35.jpg)
5/15/2007 35
SNOW 2.0
α−1α
Keystream
R1 R2S
Finite State Machine
![Page 36: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/36.jpg)
5/15/2007 36
is built from .
α−1α
322F 82
Fα
st+15 st+14 … st+11 … st+5 … st+2 st+1 st
Feedback polynomial [ ]3216 14 1 5
2( ) 1x x x x xπ α α−= + + + ∈F
More byte oriented structure:
is a root of primitive polynomial over .82F
THE LFSR
![Page 37: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/37.jpg)
5/15/2007 37
Based on the round function of AES.Let be the output of the S-Box.
Input w
Apply SR[ ] on each byte
Linear transformation
Output r
[ ][ ][ ][ ]
0 0
1 1
2 2
3 3
1 1 11 1 11 1 1
1 1 1
R
R
R
R
r S wx xr S wx xr S wx xr S wx x
⎛ ⎞+⎛ ⎞ ⎛ ⎞⎜ ⎟⎜ ⎟ ⎜ ⎟+ ⎜ ⎟⎜ ⎟ ⎜ ⎟= ⎜ ⎟⎜ ⎟ ⎜ ⎟+⎜ ⎟⎜ ⎟ ⎜ ⎟⎜ ⎟⎜ ⎟ ⎜ ⎟+⎝ ⎠⎝ ⎠ ⎝ ⎠
each byte is considered an element in, defined by82
F [ ]8 4 321x x x x x+ + + + ∈F
Where SR[ ] is the S-Box in AES, and
( )r S w=
THE S-BOX
![Page 38: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/38.jpg)
5/15/2007 38
Two input variables:
Secret key of 128 or 256 bits, (k3,…,k0) or (k7,…,k0)
Publicly known IV of 128 bits, (IV3,…,IV0)
128 bit key: Load the register (s15,…,s0) with a mix of key bits and IV bits.
Denote the register (s15,…,s0)
KEY INITILIZATION
![Page 39: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/39.jpg)
5/15/2007 39
KEY INITILIZATION
α−1 α
Finite State Machine
Premix with 32 clocks using:
Switch to normal operation,clock once, and read out the first keystream symbol.
![Page 40: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/40.jpg)
5/15/2007 40
The feedback polynomial has two constants.Better spreading of the bits in the feedback loop.No known method to derive a linear recurrence that hold for each bit,and has reasonably low weight.
The FSM takes two words as input.Harder to invert the FSM, takes more guessing.Suggests that correlations in the FSM is small.
The S-Box has good spreading of the bits.Each output bit depends on each input bit.
SECURITY ASPECTS
![Page 41: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/41.jpg)
5/15/2007 41
Simple instructions: XOR
Integer addition
Byte shift of a word
Table lookupByte oriented feedback polynomial.Multiplication with a and a-1 implemented asa byte shift and an XOR with a pattern.
[ ][ ]1
8
23 245 48 239
16 39 6 64
2
( , , , )
( , , , )
for all
mul c c c c c
mul c c c c c
c
α
α
β β β β
β β β β−
=
=
∈F
// multiplication w·alpharesult=(w<<8) xor mul_a[w>>24];
LFSR:
IMPLEMENTATION ASPECTS
![Page 42: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/42.jpg)
5/15/2007 42
The S-Box: Same method used in AES.
0 1
2 3
[ ] ( 1) [ ][ ] [ ]
[ ] , [ ][ ] [ ]
( 1) [ ] [ ]
[ ] [ ]( 1) [ ] [ ]
[ ] , [ ][ ] ( 1) [ ][ ] [ ]
R R
R R
R R
R R
R R
R R
R R
R R
xS a x S aS a xS a
T a T aS a S a
x S a S a
S a S ax S a S a
T a T axS a x S aS a xS a
+⎛ ⎞ ⎛ ⎞⎜ ⎟ ⎜ ⎟⎜ ⎟ ⎜ ⎟= =⎜ ⎟ ⎜ ⎟⎜ ⎟ ⎜ ⎟⎜ ⎟ ⎜ ⎟+⎝ ⎠ ⎝ ⎠⎛ ⎞ ⎛ ⎞⎜ ⎟ ⎜ ⎟+⎜ ⎟ ⎜ ⎟= =⎜ ⎟ ⎜ ⎟+⎜ ⎟ ⎜ ⎟⎜ ⎟ ⎜ ⎟⎝ ⎠ ⎝ ⎠
//Calculate r=S-Box(w)r=T0[byte0(w)] xor T1[byte1(w)] xor T2[byte2(w)] xor T3[byte3(w)];
![Page 43: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/43.jpg)
5/15/2007 43
PERFORMANCE OF SOME STREAM CIPHERS
![Page 44: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/44.jpg)
5/15/2007 44
Nonlinear shift register sequences
De Bruijn sequences (period 2L)The Achterbahn stream ciphers
NLFSR is implemented as an LFSR but with nonlinear feedback.Now we do not necessarily have P(sj1
+sj2+…+sjn
=0)≈1/2.
![Page 45: Feedback shift register based stream ciphersecrypt-ss07.rhul.ac.uk/Slides/Tuesday/johansson-samos07... · 2007. 5. 15. · something through a direct construction ... their machinery,](https://reader035.vdocuments.net/reader035/viewer/2022071105/5fdf55e74074d76f776a399f/html5/thumbnails/45.jpg)
5/15/2007 45
Overview of stream ciphers.
Using LFSR sequences in stream ciphers.
Research issues:
Security analysis of LFSR based stream ciphers.
Efficient implementation of sequence generation.
Stream ciphers in constrained environments.
SUMMARY