Improved multi-pass fast correlation attacks with applications

Abstract

In this paper we propose two new algorithms for multi-pass fast correlation attacks on stream ciphers. The first algorithm aims at fast symbol-wise decoding in the circumstances that the noise is not very high and we have little resource for pre-computation. The second algorithm deals with the practical decoding problem in the high noise and limited keystream cases. The new algorithms are applicable to arbitrary form LFSR and compare favorably to the previously known algorithms in the scenarios under consideration. As applications, we demonstrate new key recovery attacks on one-level Bluetooth E0 and LILI-128, respectively. Given 2 37 -bit keystream and 2 28 -byte memory, our attack against one-level E0 needs 2 35.1 operations. Given 2 24 -bit keystream and 2 24.5 -byte memory, our attack on LILI-128 has time complexity 2 70.6 operations.Correlation attacks are a classical class of attacks against the LFSR-based stream ciphers [1][2][3][4][5][6][7][8][9][10][11][12][13][14]. Given a proper correlation, such an attack aims at restoring the initial state of the underlying LFSR with complexity as low as possible. The original idea was proposed by Siegenthaler [13] in 1984. Then Meier and Staffelbach [9] found an interesting way to efficiently explore the correlation, provided that the feedback polynomial of the LFSR has a very low weight. A recent improvement of fast correlation attacks was made in [14] by the authors. The idea is to combine the divide-and-conquer strategy with fast correlation attack, resulting in a multi-pass attack. Though sometimes requiring more keystream bits, such an attack gets a large gain on the efficiency compared with the best previous results [3,12]. However, in real cryptanalysis, the length of the available keystream is often very limited either due to the constraints imposed by the designer of the corresponding cipher or due to the decreasing correlation probability with the keystream length increasing. Neither case can be efficiently decoded by the current fast correlation attacks.In this paper, we propose two new algorithms for fast correlation attacks based on the multi-pass approach and apply the second algorithm to further analyze the security of one-level Bluetooth

A New Two‐Dimensional Mutual Coupled Logistic Map and Its Application for Pseudorandom Number Generator

“…Traditional methods for generating PRNS are mainly based on the linear congruential method or linear feedback shift registers. However, the innerlinear construction of these methods will make a greater risk by correlation attack [4] and algebraic attack [5]. Therefore, an improved method for generating PRNS is to use nonlinear source.…”

Novel way to research nonlinear feedback shift register

“…LFSRs are extensively used as basic functional blocks in key stream generators in stream cipher models due to their large period, good statistical properties and fast implementation in hardware as well as in software. However, one important drawback of LFSR is that the sequences outputted by LFSR are completely linear, and thus cryptographically insecure [9][10][11]. Due to the limitations of LFSR, the application of nonlinear feedback shift register (NLFSR) becomes more popular.…”

“…Next, we demonstrate our cycles joining algorithm through an illustrative example. 2) List all the cycles of the state transition graph of L by the sorting rule, δ 1 16 → δ 2 16 → δ 4 16 → δ 7 16 → δ 13 16 → δ 9 16 → δ 1 16 , δ 3 16 → δ 5 16 → δ 10 16 → δ 3 16 , δ 6 16 → δ 12 16 → δ 8 16 → δ 16 16 → δ 15 16 → δ 14 16 → δ 11 16 → δ 6 2 n . 3) In the second cycle, replace δ 10 16 with δ 2 16 as the new predecessor of δ 3 16 and δ 4 16 with δ 3 16 as the new successor of δ 10 16 .…”

“…The third cycle performs similar operation as shown in Figure 8. In this way, a maximal cycle is obtained as follows: δ 1 16 → δ 2 16 → δ 3 16 → δ 6 16 → δ 12 16 → δ 8 16 → δ 16 16 → δ 15 16 → δ 14 16 → δ 11 16 → δ 5 16 → δ 10 16 → δ 4 16 → δ 7 16 → δ 13 16 → δ 9 16 → δ 1 16 . 4) A new L ′ corresponding to the maximal cycle is L ′ = [2 3 6 7 10 12 13 16 1 4 5 8 9 11 14 15].…”