Tight Security Bounds for Generic Stream Cipher Constructions

Abstract

The design of modern stream ciphers is strongly influenced by the fact that Time-Memory-Data tradeoff attacks (TMD-TO attacks) reduce their effective key length to SL/2, where SL denotes the inner state length. The classical solution, employed, e.g., by eSTREAM portfolio members Trivium [CP05] and Grain v1 [HJM06], is to design the cipher in accordance with the Large-State-Small-Key construction, which implies that SL is at least twice as large as the session key length KL. In the last years, a new line of research looking for alternative stream cipher constructions guaranteeing a higher TMD-TO resistance with smaller inner state lengths has emerged. So far, this has led to three generic constructions: the Lizard construction [HK18], having a provable TMD-TO resistance of 2 • SL/3; the Continuous-Key-Use construction, underlying the stream cipher proposals Sprout [AM15], Plantlet [MAM17], and Fruit [AH18]; and the Continuous-IV-Use construction, very recently proposed in [HKM17a]. Meanwhile, it could be shown that the Continuous-Key-Use construction is vulnerable against certain nontrivial distinguishing attacks [HKMZ17].In this paper, we present a formal framework for proving security lower bounds on the resistance of generic stream cipher constructions against TMD-TO attacks and analyze two of the constructions mentioned above. First, we derive a tight security lower bound of approximately min{KL, SL/2} on the resistance of the Large-State-Small-Key construction. This shows that the feature KL ≤ SL/2 does not open the door for new nontrivial TMD-TO attacks against Trivium and Grain v1 which are more dangerous than the known ones. Second, we prove a maximal security bound on the TMD-TO resistance of the Continuous-IV-Use construction, which shows that designing concrete instantiations of ultra-lightweight Continuous-IV-Use stream ciphers is a hopeful direction of future research.

Systematic Security Analysis of Stream Encryption With Key Erasure

“…This research focuses more on hardware-based lightweight ciphers and uses similar information-theoretic methods as the one used in this work. More analysis of LIZARD was recently presented by Banik et al [25] and Hamann and Krause [26].…”

The DRACO Stream Cipher

“…Three generic stream cipher constructions have been proposed so far: (1) the Lizard construction [HKM17b], (2) the CKEY construction (underlying Fruit [AGH18], Plantlet [MAM16], Sprout [AM15] and Atom [BCI + 21]), and (3) the CIV construction [HKM17a,HKM19]. The CKEY and the CIV construction rely on an enhanced state which will be explained below in Subsection 3.1.…”

“…This principle underlies the stream cipher proposals Sprout, Plantlet, Fruit and Atom. However, it was shown in [HKM19] that the resistance of the CKEY construction against generic TMDTO distinguishing attacks is at most ℓ v /2. Continuous IV.…”

“…Contrary to CKEY, it does not use the non-volatile key, but it uses the initial values as the nonvolatile part of the internal state. This construction provides a provable security level of ℓ v − log 2 (ℓ p ) [HKM19]. Note that there are no stream cipher instantiations based on the CIV construction so far.…”

“…Instead of continuously using the non-volatile secret key, the non-volatile initial value is employed during the state update. A proof of security was later published in [HKM19]. We refer to these ciphers as the continuous-IV construction, in short CIV.…”