Cryptanalysis of Pseudo-random Generators Based on Vectorial FCSRs

Abstract

978-3-642-34930-0 (Print)International audienceFeedback with Carry Shift Registers (FCSRs) have been first proposed in 2005 by F. Arnault and T. Berger as a promising alternative to LFSRs for the design of stream ciphers. The original proposal called F-FCSR simply filters the content of a FCSR in Galois mode using a linear function. In 2008, Hell and Johannson attacked this version using a method called LFSRization of F-FCSR. This attack is based on the fact that a single feedback bit controls the values of all the carry cells. Thus, a trail of 0 in the feedback bit annihilates the content of the carry register, leading to transform the FCSR into an LFSR during a sufficient amount of time. Following this attack, a new version of F-FCSR was proposed based on a new ring FCSR representation that guarantees that each carry cell depends on a distinct cell of the main register. This new proposal prevents the LFSRization from happening and remains unbroken since 2009. In parallel, Alaillou, Marjane and Mokrane proposed to replace the FCSR in Galois mode of the original proposal by a Vectorial FCSR (V-FCSR) in Galois mode. In this paper, we first introduce a general theoretical framework to show that Vectorial FCSRs could be seen as a particular case of classical FCSRs. Then, we show that Vectorial FCSRs used in Galois mode stay sensitive to the LFSRization of FCSRs. Finally, we demonstrate that hardware implementations of V-FCSRs in Galois mode are less efficient than those based on FCSRs in ring mode