Cryptanalysis of Sosemanuk and SNOW 2.0 Using Linear Masks

Abstract

In this paper, we present a correlation attack on Sosemanuk with complexity less than 2 150. Sosemanuk is a software oriented stream cipher proposed by Berbain et al. to the eSTREAM call for stream cipher and has been selected in the final portfolio. Sosemanuk consists of a linear feedback shift register(LFSR) of ten 32-bit words and a finite state machine(FSM) of two 32-bit words. By combining linear approximation relations regarding the FSM update function, the FSM output function and the keystream output function, it is possible to derive linear approximation relations with correlation −2 −21.41 involving only the keystream words and the LFSR initial state. Using such linear approximation relations, we mount a correlation attack with complexity 2 147.88 and success probability 99% to recover the initial internal state of 384 bits. We also mount a correlation attack on SNOW 2.0 with complexity 2 204.38 .

Three Snakes in One Hole: The First Systematic Hardware Accelerator Design for SOSEMANUK with Optional Serpent and SNOW 2.0 Modes

“…These works include the guess and determine attacks in [2,48,20] and linear cryptanalysis of SOSEMANUK and SNOW 2.0 [26,13].…”

Improved Linear Cryptanalysis of SOSEMANUK

“…The highest correlation of (6) holds with the correlation of 2 −21.4 [10]. The correlation attack presented in [10] reduced the data complexity of the attack by the so-called Second LFSR derivative technique that was developed by Berbain et al in [4].…”

“…The correlation attack presented in [10] reduced the data complexity of the attack by the so-called Second LFSR derivative technique that was developed by Berbain et al in [4]. We will discuss this technique in Section 3 .…”

“…In [10], the best linear approximations of FSM and Serpent1 were derived using a single linear mask Γ as follows:…”

“…The eSTREAM project concluded in the final report that SOSEMANUK offers a very considerable margin for security as well as very reasonable performance trade-offs [2]. After the eSTREAM project closed, a linear attack against SOSEMANUK was presented by Lee et al in Asiacrypt 2008 [10]. In this attack, authors used the linear masking method [7] to derive the best linear approximation of the nonlinear function.…”