A new SNOW stream cipher called SNOW-V

Abstract

In this paper we are proposing a new member in the SNOW family of stream ciphers, called SNOW-V. The motivation is to meet an industry demand of very high speed encryption in a virtualized environment, something that can be expected to be relevant in a future 5G mobile communication system. We are revising the SNOW 3G architecture to be competitive in such a pure software environment, making use of both existing acceleration instructions for the AES encryption round function as well as the ability of modern CPUs to handle large vectors of integers (e.g. SIMD instructions). We have kept the general design from SNOW 3G, in terms of linear feedback shift register (LFSR) and Finite State Machine (FSM), but both entities are updated to better align with vectorized implementations. The LFSR part is new and operates 8 times the speed of the FSM. We have furthermore increased the total state size by using 128-bit registers in the FSM, we use the full AES encryption round function in the FSM update, and, finally, the initialization phase includes a masking with key bits at its end. The result is an algorithm generally much faster than AES-256 and with expected security not worse than AES-256.

Resistance of SNOW-V against Fast Correlation Attacks

“…• For SNOW-V σ0 , we find a number of bitwise linear approximations which have significantly larger SEI values than that of the best byte-wise linear approximation found in [8], and present a fast correlation attack by using these new-found bitwise linear approximations. This attack costs a time complexity of 2 251.93 and a memory complexity of 2 244 , less than the exhaustive key search, and requires a keystream of length around 2 103.83 , which improves greatly the result in [8] which is 2 203 .…”

“…For SNOW-V, there is no prior cryptanalysis of SNOW-V beyond its design document [8], except for a result published in December 2020 [12] where a byte-based guess and determine attack was proposed with complexity 2 406 . In [8], the designers presented their best results of the linear approximation attacks on several close variants of SNOW-V, including the original version of SNOW-V denoted by SNOW-V σ0 , where the permutation is assumed to be just the identity σ 0 , and also SNOW-V 8 , 8 , where both of the two 32-bit adders " 32 " in the updating function of the FSM are replaced by the 8-bit ones " 8 " while everything else remains identical. In all these analyses, they utilized "large-unit" linear approximations.…”

“…The novelty is the construction of specific matrices which can be efficiently pre-computed. Using the slice-like techniques, the computations of bitwise linear approximations cost only linear-time complexities by doing some matrix multiplications, while the convolution algorithms on large distribution in [8] need much more computations. Based on these algorithms, we are able to search for the bitwise linear masks in a much larger range than the designers do for the byte-wise masks [8].…”

“…Then we apply these algorithms for the cryptanalysis of SNOW-V against linear approximation attacks. Our attacks target three variants of SNOW-V, two were introduced by SNOW-V designers in [8], while the third one is new.…”

“…SNOW-V [8] is a new member in the SNOW family of stream ciphers, hoping to be competitive in the 5G mobile communication system. It is designed by revising the SNOW 3G architecture and has kept the general design from SNOW 3G.…”