Cryptanalysis of Mir-1: A T-Function-Based Stream Cipher

Abstract

This paper describes the cryptanalysis of Mir-1, a T-function based stream cipher proposed at eSTREAM (the ECRYPT Stream Cipher Project) in 2005. It uses a multiword T-function, with four 64-bit words, as its basic structure. Mir-1 operations process the data in every 64 bits (one word) to generate a keystream. This paper discusses a distinguishing attack against Mir-1, one that exploits the T-function characteristics and the Mir-1 initialization. With merely three or four IV pairs, this attack can distinguish a Mir-1 output sequence from a true random sequence. In this case, the amount of data theoretically needed for cryptanalysis is only 2 10 words.

Latin Dances Revisited: New Analytic Results of Salsa20 and ChaCha

“…If d is large enough, an adversary can distinguish keystream bits from random bit sequences. For example d is suAEciently large for 7-round Salsa20 to distinguish keystream bits [22]. We propose a double-bit distinguisher for 9-round Salsa20 and 8-round ChaCha in the later section.…”

“…The best attack is proposed by Aumasson et al [22] so far, and it covers the 8-round version of Salsa20 with an estimated complexity of 2 251 . Regarding the 128-bit key, Aumasson proposed key-recovery attacks for reduced versions with up to 7 rounds [22].…”

“…The best attack is proposed by Aumasson et al [22] so far, and it covers the 8-round version of Salsa20 with an estimated complexity of 2 251 . Regarding the 128-bit key, Aumasson proposed key-recovery attacks for reduced versions with up to 7 rounds [22]. Priemuth-Schmid proposed a distinguishing attack using slid pairs [23], but Bernstein showed that time complexity of the attack is higher than brute force attack [4].…”

“…For ChaCha, Aumasson attacked the 6-round version with an estimated complexity of 2 139 and the 7-round version with an estimated complexity of 2 248 using a 256-bit key. Regarding the 128-bit key, Aumasson proposed key-recovery attacks for reduced versions with up to 7 rounds with an estimated complexity of 2 107 [22].…”

Analysis of RC4 and Proposal of Additional Layers for Better Security Margin

“…During last few years, there have been many efforts [40,29,8] on the modification of RC4 towards further improvement and there also exist distinguishing attacks on them [20,36,37]. This shows that there is significant interest in the cryptographic community for analysis and design of RC4 and its modifications.…”