Design and analysis of small-state grain-like stream ciphers

Two trivial key recovery attacks were proposed on Fruit with computational complexities of 2^82.6 and 2^67.5 clocks of Fruit, respectively.

“Two trivial key recovery attacks were proposed on Fruit. The computational complexities of the first and second attacks were 2^82.6 and 2^67.5 clocks of Fruit, respectively [22,24].”

A TMDTO distinguishing attack was successfully applied to all of the ultra-lightweight stream ciphers.

“A TMDTO distinguishing attack was successfully applied to all of the ultra-lightweight stream ciphers [24], but we propose two countermeasures that can strengthen Fruit-80 against TMDTO distinguishing attacks.”

In this structure, there is no vulnerability regarded from using the same IVs twice with the same key.

“In this structure, there is no vulnerability regarded from using the same IVs twice with the same key [24].”

The new idea was to use IV bits not only in the initialization but also in the keystream generation.

“The new idea was to use IV bits not only in the initialization but also in the keystream generation.”

Permanently using IV, similar to the key, in the internal state updating.

“In other words, the new idea was permanently using IV (similar to the key) in the internal state updating [24].”

Without any countermeasure for TMDTO distinguishing attacks on Fruit-80, an attacker can distinguish keystreams of Fruit-80 from truly random sequences with data, time and memory complexity of 2^50.2 bits of keystream, 2^52.4 clocks of the cipher and 2^50.2 bits memory, respectively.

“Without any countermeasure for the TMDTO distinguishing attacks on Fruit-80, an attacker can distinguish keystreams of Fruit-80 from truly random sequences (under every arbitrarily fixed key) with data, time and memory complexity of 2^50.2 bits of keystream, 2^52.4 clocks of the cipher and 2^50.2 bits memory, respectively [24].”

In [24] a new idea was proposed to strengthen the small-state stream ciphers against TMDTO distinguishing attacks.

“In [24] a new idea was proposed to strengthen the small-state stream ciphers against TMDTO distinguishing attacks.”

In Lizard cipher, designers are allowed to produce up to 2^18 keystream bits per key/IV pair, and they mentioned that 2^18 keystream bits are sufficient for many existing scenarios like Bluetooth, WLAN, and HTTPS.

“In Lizard cipher, designers are allowed to produce up to 2¹⁸ keystream bits per key/IV pair, and they mentioned that 2¹⁸ keystream bits are sufficient for many existing scenarios like Bluetooth, WLAN, and HTTPS [24].”