Abstract:The fast correlation attack (FCA) is one of the most important cryptanalytic techniques against LFSR-based stream ciphers. In CRYPTO 2018, Todo et al. found a new property for the FCA and proposed a novel algorithm which was successfully applied to the Grain family of stream ciphers. Nevertheless, these techniques cannot be directly applied to Grain-like small state stream ciphers with keyed update, such as Plantlet, Fruit-v2 and Fruit80. In this paper, we study the security of Grain-like small state stream ciphers by the FCA. We first observe that the number of required parity-check equations can be reduced when there are multiple different parity-check equations. With exploiting the Skellam distribution, we introduce a sufficient condition to identify the correct LFSR initial state and derive a new relationship between the number and bias of the required parity-check equations. Then, a modified algorithm is presented based on this new relationship, which can recover the LFSR initial state no matter what the round key bits are. Under the condition that the LFSR initial state is known, an algorithm is given against the degraded system and to recover the NFSR state at some time instant, along with the round key bits. As cases study, we apply our cryptanalytic techniques to Plantlet, Fruit-v2 and Fruit-80. As a result, for Plantlet, our attack takes 2(73.75) time complexity and 2(73.06) keystream bits to recover the full 80-bit key. Regarding Fruit-v2, 2(55.34) time complexity and 2(55.62) keystream bits are needed to determine the secret key. As for Fruit-80, 2(64.47) time complexity and 2(62.82) keystream bits are required to recover the secret key. More flexible attacks can be obtained with lower data complexity at the cost of increasing the attack time. Especially, for Fruit-v2, a key recovery attack can be launched with data complexity of 2(42.38) and time complexity of 2(73.31). Moreover, we have implemented our attack methods on a toy version of Fruit-v2. The attack matches the expected complexities predicted by our theoretical analysis quite well, which proves the validity of our cryptanalytic techniques.

Fault Attacks on Stream Cipher Scream

Fault-cube attack on SIMON family of lightweight block ciphers

Persistence Wears down Resistance: Persistent Fault Analysis on Unprotected and Protected Block Cipher Implementations (Extended Abstract)

Linear Fault Analysis of Block Ciphers.

A Framework for the Analysis and Evaluation of Algebraic Fault Attacks on Lightweight Block Ciphers

Fault Attack on the Authenticated Cipher ACORN V2.

Fault-based guess-and-determine attack on SOSEMANUK

New Key Recovery Attack on the MICKEY Family of Stream Ciphers

Key Schedule Guided Persistent Fault Attack

An Automated Framework for Analysis and Evaluation of Algebraic Fault Attacks on Lightweight Block Ciphers

RAFA: Redundancies-assisted Algebraic Fault Analysis and its implementation on SPN block ciphers.

Related Key Chosen IV Attack on Stream Cipher Espresso Variant

Low-cost Design of Stealthy Hardware Trojan for Bit-Level Fault Attacks on Block Ciphers

Near Collision Attack on the Grain V1 Stream Cipher

Fault-propagate Pattern Based DFA on PRESENT and PRINTcipher

Analysis of an Optimal Fault Attack on the LED-64 Lightweight Cryptosystem.

FaultMorse: an Automated Controlled-Channel Attack Via Longest Recurring Sequence

On Grain-Like Small State Stream Ciphers Against Fast Correlation Attacks: Cryptanalysis of Plantlet, Fruit-v2 and Fruit-80

Improved Differential Fault Analysis on LED with Constraint Equations: Towards Reaching Its Limit

Improving DFA Attacks on AES with Unknown and Random Faults

Differential Fault Analysis on the SMS4 Cipher by Inducing Faults to the Key Schedule