Rewriting Variables: The Complexity of Fast Algebraic Attacks on Stream Ciphers

Abstract

Abstract.Recently proposed algebraic attacks [2,6] and fast algebraic attacks [1,5] have provided the best analyses against some deployed LFSR-based ciphers. The process complexity is exponential in the degree of the equations. Fast algebraic attacks were introduced [5] as a way of reducing run-time complexity by reducing the degree of the system of equations. Previous reports on fast algebraic attacks [1,5] have underestimated the complexity of substituting the keystream into the system of equations, which in some cases dominates the attack. We also show how the Fast Fourier Transform (FFT) [4] can be applied to decrease the complexity of the substitution step. Finally, it is shown that all functions of degree d satisfy a common, function-independent linear combination that may be used in the pre-computation step of the fast algebraic attack. An explicit factorization of the corresponding characteristic polynomial yields the fastest known method for performing the pre-computation step.

An Infinite Class of Balanced Functions with Optimal Algebraic Immunity, Good Immunity to Fast Algebraic Attacks and Good Nonlinearity

“…Indeed, if one can find g of low degree and h = 0 of reasonable degree such that f * g = h, then a fast algebraic attack is feasible, see [13,1,24] (note however that fast algebraic attacks need more data than standard ones). This has been exploited in [14] to present an attack on SFINKS [4] and we can say that with this attack, which comes in addition to the standard algebraic attack, Courtois has made very difficult the work of the designer.…”

A Synchronous Stream Cipher Generator Based on Quadratic Fields (SSCQF)

“…It is a lightweight and efficient cryptographic primitive for ensure confidentiality of transmitted data between two communicated pairs. It proves its robustness by its ability to resist against attacks [3][4] [7] [14]. It has a wide application area especially in mobile devices and embedded systems.…”

Cryptanalysis of an E0-like Combiner with Memory

“…The detailed complexities of each step are shown in Table 10. A comparison of our attacks with the similar attack 14 [16] and the best attacks [14,25] (both were algebraic attacks) is shown in Table 11 for Case A and B. Experimental Results with w = 1 We did the small-scale experiment to verify our analysis in Section 5 on the keystream { 4 i=2 (x i t ⊕ z t )} instead of {z t } to save the trouble of searching the multiple Q(x) of Second, we choose some random x 1 , then compute the corresponding average and variance of N (x 1 ) ζ over allx 1 = x 1 individually, it turned out 14 The estimate of data complexity in [16] uses a different heuristic formula than ours.…”