Cryptanalysis of Grain
Cryptanalysis of Grain
复制标题
DOI：
10.1007/11799313_2
复制
发表时间：
2006-03
期刊：
影响因子：
--
通讯作者：
C. Berbain;H. Gilbert;A. Maximov
中科院分区：
文献类型：
--
作者：
C. Berbain;H. Gilbert;A. Maximov
Grane[11]是在欧洲ECRYPT[5]计划的eSTREAM号召下提出的一种轻量级流密码。其160比特的内部状态分为LFSR和NFSR，每个长度为80比特。过滤布尔函数用于从内部状态导出每个密钥流比特。通过组合NFSR的反馈函数和过滤函数的线性近似，可以推导出涉及密钥流和LFSR初始状态的线性近似方程。提出了一种针对Grain的密钥恢复攻击，需要243次计算和238个密钥流比特来确定80比特的密钥。
Grain [11] is a lightweight stream cipher proposed by M. Hell, T. Johansson, and W. Meier to the eSTREAM call for stream cipher proposals of the European project ECRYPT [5]. Its 160-bit internal state is divided into a LFSR and an NFSR of length 80 bits each. A filtering boolean function is used to derive each keystream bit from the internal state. By combining linear approximations of the feedback function of the NFSR and of the filtering function, it is possible to derive linear approximation equations involving the keystream and the LFSR initial state. We present a key recovery attack against Grain which requires 243computations and 238keystream bits to determine the 80-bit key.