On the security of nonlinear filter generators

Abstract

Abstract. By regarding a nonlinear filter keystream generator as a finite input memory combiner, it is observed that a recent, important attack introduced by Anderson can be viewed as a conditional correlation attack. Necessary and sufficient conditions for the output sequence to be purely random given than the input sequence is such are pointed out and a new, so-cMled inversion attack is introduced, which may work for larger input memory sizes in comparison with the Anderson's attack. Large input memory size and use of full positive difference sets and correlation immune nonlinear filter functions are proposed as new design criteria to ensure the security against the considered attacks.

An Automatic, Time-Based, Secure Pairing Protocol for Passive RFID

“…In what follows, we discuss these attacks and show that none of them is a serious concern for our application. The inversion attacks of [14,15] rely on the public knowledge of the component LFSR structure and of the nonlinear filtering function (which in our AP protocol are the secrets of the tag), and can be foiled anyway by selecting a proper generator design. Another class of attacks, which also require complete knowledge of both the characteristic polynomial of the LFSR and the filtering function, are the algebraic attacks of [16].…”

Fast correlation attacks against stream ciphers and related open problems

“…However, the binary symmetric channel model which was originally described for combination generator does not hold anymore. The reason is that the inputs of the filtering function at different times are not independent, even if these dependences are usually reduced by an appropriate choice of the input taps (γ i ) 1≤i≤m [19]. In the case of filter generators, the underlying transmission channel is not memoryless.…”

A New Simple Technique to Attack Filter Generators and Related Ciphers

“…Another class of key recovery attacks on filter generators was proposed by Golić, the so-called inversion attacks, see [10,11,12]. In an inversion attack one tries to "invert" the nonlinear function and recover the initial state.…”