The rakaposhi Stream Cipher

Cid, Carlos; Kiyomoto, Shinsaku; Kurihara, Jun

doi:10.1007/978-3-642-11145-7_5

Cited by 28 publications

(15 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Table 1 lists the values of the 3-tuples (n, n − d, d) for 4 ≤ n ≤ 25. The case n = 4 is trivial, and it is easy to verify that for any k ∈ D d (f ), when n = 6, 8,9,11,12,13,14,15,17,18,21, k always contains two adjacent loop zero runs of length 2, and when n = 16, 19, 20 and n ≥ 22, k has at least one loop zero runs with length no less than 3, which contradicts Lemmas 16 and 10 respectively. Thus we have d ≥ d n .…”

Section: The Case R(k) =mentioning

confidence: 76%

“…The composite Tr(λx −1 ) of these two functions possess many good cryptographic properties as well, including balanceness, high nonlinearity, ideal auto-correlation, etc [11] , and have been adopted by many stream ciphers such as SFINKS [12] (the eStream project), RAKAPOSHI [13] , the simple counter stream cipher (SCSC) proposed by Si and Ding [11] , and so on.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

On algebraic immunity of trace inverse functions on finite fields of characteristic two

Feng

Gong

2016

J Syst Sci Complex

View full text Add to dashboard Cite

The trace inverse functions Tr(λx −1 ) over the finite field F2n are a class of very important Boolean functions and are used in many stream ciphers such as SFINKS, RAKAPOSHI, the simple counter stream cipher (SCSC) presented by Si W and Ding C (2012), etc. In order to evaluate the security of those ciphers in resistance to (fast) algebraic attacks, the authors need to characterize algebraic properties of Tr(λx −1 ). However, currently only some bounds on algebraic immunity of Tr(λx −1 ) are given in the public literature, for example, the NGG upper bound and the Bayev lower bound, etc. This paper gives the exact value of the algebraic immunity of Tr(λx −1 ) over F2n , that is, AI(Tr(λx −1 )) = 2 √ n − 2, where n ≥ 2, λ ∈ F2n and λ = 0, which shows that Dalai's conjecture on the algebraic immunity of Tr(λx −1 ) is correct. What is more, the authors demonstrate some weak properties of Tr(λx −1 ) against fast algebraic attacks.

show abstract

Section: The Case R(k) =mentioning

confidence: 76%

Section: Introductionmentioning

confidence: 99%

On algebraic immunity of trace inverse functions on finite fields of characteristic two

Feng

Gong

2016

J Syst Sci Complex

View full text Add to dashboard Cite

show abstract

“…Finally, the keystream output is generated by linear combination of the outputs of both registers A and B with the output of the N LF function. The reader interested in more detail is referred to the original paper [1].…”

Section: Description Of Rakaposhi Stream Ciphermentioning

confidence: 99%

“…The Rakaposhi stream cipher was designed by Cid, Kiyomoto, and Kurihara in 2009 (see [1]). The cipher is based on a non-linear feedback shift register (NLFSR) and a dynamic linear shift register (DLFSR).…”

Section: Introductionmentioning

confidence: 99%

Security Evaluation of Rakaposhi Stream Cipher

Orumiehchiha

Pieprzyk

Shakour

et al. 2013

Information Security Practice and Experience

View full text Add to dashboard Cite

Abstract. Rakaposhi is a synchronous stream cipher, which uses three main components a non-linear feedback shift register (NLFSR), a dynamic linear feedback shift register (DLFSR) and a non-linear filtering function (N LF ). NLFSR consists of 128 bits and is initialised by the secret key K. DLFSR holds 192 bits and is initialised by an initial vector (IV ). N LF takes 8-bit inputs and returns a single output bit. The work identifies weaknesses and properties of the cipher. The main observation is that the initialisation procedure has the so-called sliding property. The property can be used to launch distinguishing and key recovery attacks. The distinguisher needs four observations of the related (K, IV ) pairs. The key recovery algorithm allows to discover the secret key K after observing 2 9 pairs of (K, IV ). In the proposed relatedkey attack, the number of related (K, IV ) pairs is 2 (128+192)/4 pairs. The key recovery algorithm allows to discover the secret key K after observing 2 9 related (K, IV ) pairs. Further the cipher is studied when the registers enter short cycles. When NLFSR is set to all ones, then the cipher degenerates to a linear feedback shift register with a non-linear filter. Consequently, the initial state (and Secret Key and IV ) can be recovered with complexity 2 63.87 . If DLFSR is set to all zeros, then N LF reduces to a low non-linearity filter function. As the result, the cipher is insecure allowing the adversary to distinguish it from a random cipher after 2 17 observations of keystream bits. There is also the key recovery algorithm that allows to find the secret key with complexity 2 54 .

show abstract

“…As a result, lightweight cryptography is attracting attention of the cryptographic community. A host of lightweight cryptographic algorithms that particularly target for low resource devices have been proposed in the past few years, e.g., block ciphers such as mCrypton [1], HIGHT [2], PRESENT [3], KATAN&KT-ANTAN [4], TWIS [5], MIBS [6], PRINTcipher [7], LED [8], Piccolo [9], KLEIN [10], LBlock [11], TWINE [12] and PRINCE [13], and hash functions such as Quark [14], SPONGENT [15] and PHOTON [16], as well as stream ciphers such as Grain v1 [17], MICKEY 2.0 [18], Trivium [19] Manuscript received October 24, 2013;revised and RAKAPOSHI [20]. Lightweight cryptography is getting more and more important since people started interacting with it in daily life more often.…”

Section: Introductionmentioning

confidence: 99%

Cryptanalysis of Lightweight WG-8 Stream Cipher

Ding

Jin

Guan

et al. 2014

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

WG-8 is a new lightweight variant of the wellknown Welch-Gong (WG) stream cipher family, and takes an 80-bit secret key and an 80-bit initial vector (IV) as inputs. So far no attack on the WG-8 stream cipher has been published except the attacks by the designers. This paper shows that there exist Key-IV pairs for WG-8 that can generate keystreams, which are exact shifts of each other throughout the keystream generation. By exploiting this slide property, an effective key recovery attack on WG-8 in the related key setting is proposed, which has a time complexity of 2 53.32 and requires 2 52 chosen IVs. The attack is minimal in the sense that it only requires one related key. Furthermore, we present an efficient key recovery attack on WG-8 in the multiple related key setting. As confirmed by the experimental results, our attack recovers all 80 bits of WG-8 in <3 min on a PC with 2.5-GHz Intel Pentium 4 processor. This is the first time that a weakness is presented for WG-8, assuming that the attacker can obtain only a few dozen consecutive keystream bits for each IV. Finally, we give a new Key/IV loading proposal for WG-8, which takes an 80-bit secret key and a 64-bit IV as inputs. The new proposal keeps the basic structure of WG-8 and provides enough resistance against our related key attacks.Index Terms-Cryptanalysis, related key attack, WG-8, lightweight stream cipher.

show abstract

The rakaposhi Stream Cipher

Cited by 28 publications

References 23 publications

On algebraic immunity of trace inverse functions on finite fields of characteristic two

On algebraic immunity of trace inverse functions on finite fields of characteristic two

Security Evaluation of Rakaposhi Stream Cipher

Cryptanalysis of Lightweight WG-8 Stream Cipher

Contact Info

Product

Resources

About