Fast Correlation Attacks through Reconstruction of Linear Polynomials

Johansson, Thomas; Jönsson, Fredrik

doi:10.1007/3-540-44598-6_19

Cited by 98 publications

(66 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The attacker can thus get 10, 000 linear equations in 10, 000 variables, which he can easily solve by using the precomputed inverse of the coefficient matrix. This stream cipher can thus be broken in less than 2 30 bit operations, even though it could not be attacked by any previous technique, including correlation attacks or the analysis of low Hamming weight LFSR modifications (see for instance [11], [12], [13], [14], [15], and [16]). …”

Section: Applications To Block Ciphersmentioning

confidence: 99%

Cube Attacks on Tweakable Black Box Polynomials

Dinur

Shamir

2009

Advances in Cryptology - EUROCRYPT 2009

318

349

View full text Add to dashboard Cite

Abstract. Almost any cryptographic scheme can be described by tweakable polynomials over GF (2), which contain both secret variables (e.g., key bits) and public variables (e.g., plaintext bits or IV bits). The cryptanalyst is allowed to tweak the polynomials by choosing arbitrary values for the public variables, and his goal is to solve the resultant system of polynomial equations in terms of their common secret variables. In this paper we develop a new technique (called a cube attack ) for solving such tweakable polynomials, which is a major improvement over several previously published attacks of the same type. For example, on the stream cipher Trivium with a reduced number of initialization rounds, the best previous attack (due to Fischer, Khazaei, and Meier) requires a barely practical complexity of 2 55 to attack 672 initialization rounds, whereas a cube attack can find the complete key of the same variant in 2 19 bit operations (which take less than a second on a single PC). Trivium with 735 initialization rounds (which could not be attacked by any previous technique) can now be broken with 2 30 bit operations. Trivium with 767 initialization rounds can now be broken with 2 45 bit operations, and the complexity of the attack can almost certainly be further reduced to about 2 36 bit operations. Whereas previous attacks were heuristic, had to be adapted to each cryptosystem, had no general complexity bounds, and were not expected to succeed on random looking polynomials, cube attacks are provably successful when applied to random polynomials of degree d over n secret variables whenever the number m of public variables exceeds d + log d n. Their complexity is 2 d−1 n + n 2 bit operations, which is polynomial in n and amazingly low when d is small. Cube attacks can be applied to any block cipher, stream cipher, or MAC which is provided as a black box (even when nothing is known about its internal structure) as long as at least one output bit can be represented by (an unknown) polynomial of relatively low degree in the secret and public variables.

show abstract

Section: Applications To Block Ciphersmentioning

confidence: 99%

Cube Attacks on Tweakable Black Box Polynomials

Dinur

Shamir

2009

Advances in Cryptology - EUROCRYPT 2009

318

349

View full text Add to dashboard Cite

show abstract

“…Some improvements of the previous algorithm are presented in [36]. The first one considers all linear combinations of w columns of the generator matrix whose ( − k) last positions lie in a given subset (the original algorithm proposed in [35] corresponds to the case where this subset is reduced to the zero vector).…”

Section: General Decoding Algorithmsmentioning

confidence: 99%

Fast correlation attacks against stream ciphers and related open problems

Canteaut

2005

IEEE Information Theory Workshop on Theory and Practice in Information-Theoretic Security, 2005.

View full text Add to dashboard Cite

show abstract

“…In iterative algorithms, the parity-checks are used to modify the sequence x 0 i and to obtain a new noisyless sequence which converges towards the sequence x i [1,5]. In one-pass algorithms, the parity-checks values enable us to directly compute the correct value of a small number of LFSR output x i from the sequence (x 0 i ) i≥1 [2,3,4,5,6,7].…”

Section: Fast Correlation Attacksmentioning

confidence: 99%

“…2, where this sum is remplaced by x i output of one only register, and the Boolean function by a BSC (binary symmetric channel), i.e. by a channel introducing noise on x i with probability 1 − p. Fast correlation attacks [1,2,3,4,5,6,7] are improvements of basic correlation attack [10] which essentially consists in mounting an hypothesis statistical test in an exhaustive key search procedure. In this article, we present a new asymptotic analysis of iterative fast correlation attacks and a new improvement of these algorithms.…”

Section: Introductionmentioning

confidence: 99%