CoChat
Sign Up
Cited by 45Cryptographic Implementations and SecurityCoding theory and cryptographyCryptography and Residue Arithmetic

Fruit-80: A Secure Ultra-Lightweight Stream Cipher for Constrained Environments

Open access
Amin Ghafari, Vahid, Hu, Honggang·2018·Entropy
DOI 10.3390/e20030180PMC PMC7512697
Open this paper in CoChat — free accountOpen PDF

Abstract

In Fast Software Encryption (FSE) 2015, while presenting a new idea (i.e., the design of stream ciphers with the small internal state by using a secret key, not only in the initialization but also in the keystream generation), Sprout was proposed. Sprout was insecure and an improved version of Sprout was presented in FSE 2017. We introduced Fruit stream cipher informally in 2016 on the web page of IACR (eprint) and few cryptanalysis were published on it. Fortunately, the main structure of Fruit was resistant. Now, Fruit-80 is presented as a final version which is easier to implement and is secure. The size of LFSR and NFSR in Fruit-80 is only 80 bits (for 80-bit security level), while for resistance to the classical time-memory-data tradeoff (TMDTO) attacks, the internal state size should be at least twice that of the security level. To satisfy this rule and to design a concrete cipher, we used some new design ideas. It seems that the bottleneck of designing an ultra-lightweight stream cipher is TMDTO distinguishing attacks. A countermeasure was suggested, and another countermeasure is proposed here. Fruit-80 is better than other small-state stream ciphers in terms of the initialization speed and area size in hardware. It is possible to redesign many of the stream ciphers and achieve significantly smaller area size by using the new idea.

AI snapshot

Written from the paper’s full text.

TL;DR

Fruit-80 is an ultra-lightweight stream cipher with an 87-bit internal state (43-bit LFSR, 37-bit NFSR, 7-bit counter) that uses the 80-bit key in both initialization and keystream generation. It is reported at 960 GE in TSMC 0.18 μm and claimed resistant to known attacks, with a proposed 2¹⁶-bit-per-key keystream limit to counter TMDTO distinguishing attacks.

Key findings

  • Fruit-80 uses an 80-bit key, 70-bit IV, and 87-bit internal state; maximum keystream per key/IV is 2⁴³ bits, and IV reuse is prohibited.
  • Hardware results in TSMC 0.18 μm: Fruit-80 requires 960 GE, Plantlet 996 GE, Lizard 1218 GE, and Grain-v1 1270 GE; Grain-v1’s area is about 32% bigger than Fruit-80’s. Internal states are 87, 101, 121, and 160 bits, respectively.
  • Initialization needs 160 clocks, compared with 320 for Plantlet and Sprout and 256 for Lizard; Fruit-80 is claimed to have no weak key-IV because l80 is set to 1.
  • Without countermeasures, a TMDTO distinguishing attack on Fruit-80 has data, time, and memory complexities of 2^50.2 bits of keystream, 2^52.4 clocks, and 2^50.2 bits memory; the paper proposes limiting production to 2¹⁶ keystream bits per key so such attacks are not applicable with complexity significantly below brute force.

Methods

  • Design and specification of the Fruit-80 stream cipher, including its LFSR, NFSR, counter, round key function, g/f/h/output functions, and 160-clock initialization.
  • Security evaluation against TMDTO, guess-and-determine, linear approximation, related-key, Cube, algebraic, fault, and weak key-IV attacks; Cube testing used a 32-bit cube for 100 and 80 initial clocks.
  • Hardware implementation and comparison using Modelsim SE 10.2c, TSMC 0.18 μm technology, and Synopsys Design Compiler 2013.03 sp2 for synthesis and optimization.

Limitations

  • The paper states that its TMDTO countermeasure requires limiting keystream production to up to 2¹⁶ bits per key; if more keystream is produced, security against TMDTO distinguishing attacks decreases, though it argues this is practical for constrained environments or with reinitialization using a new key.
  • The paper states that fault attacks rely on impractical hypotheses, such as inducing a fault at a special time and resetting the cipher to obtain correct keystream, and says hardware mirror/mask protection is possible.
  • Evident from the text: the hardware comparison is limited to TSMC 0.18 μm and a specific toolchain, and the security evidence for final Fruit-80 is primarily the authors’ own analyses rather than reported independent third-party cryptanalysis of the final version.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.3390/e20030180

Cites

38 of 38 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

4 of 38 cited sources checked · 3 supported · 0 flagged · accuracy not yet measured

  • Interpretationcitation

    We ruled out TMDTO distinguishing attacks against Fruit-80, similar to Fruit and Plantlet ciphers.

    “As discussed in the introduction, we ruled out TMDTO distinguishing attacks against Fruit-80 (similar to Fruit and Plantlet ciphers [23,26]).”
    Quote in the paperSubstantial claim1 of 2 sources checked
    • cites [23] Ghafari, V.A., Hu, H., and Xie, C. (2018, March 06). Fruit: Ultra-Lightweight Stream Cipher with Shorter Internal State. Available online: https://eprint.iacr.org/2016/355.pdf.

      Not checked in the free run.

    • cites [26] Mikhalev, 2017, On Ciphers that Continuously Access the Non-Volatile Key, IACR Trans. Symmetric Cryptol. source

      The Plantlet paper’s “Distinguishing attacks” section says a distinguishing attack may be possible but requires at least 2^58 memory, making countermeasures unreasonable for ultra-lightweight devices. Its trade-off discussion says certain Sprout key-recovery attacks do not appear effective against Plantlet. This supports treating those attacks as impractical, but not a categorical claim that TMDTO distinguishing attacks were ruled out; the paper makes no claim about Fruit-80. (LLM, conf=0.82)

      Experimental — accuracy not yet measured
  • Premisecitation

    Fault attacks have been applied successfully to all members of Grain family and Sprout.

    “These attacks have been applied successfully to all members of Grain family [13,34] and also to Sprout [20,33].”
    Quote in the paperNot a substantial claim1 of 4 sources checked
    • cites [13] Banik, 2012, A Differential Fault Attack on Grain-128a Using MACs, Lect. Notes Comput. Sci. source
    • cites [34] Banik, 2012, A Differential Fault Attack on the Grain Family of Stream Ciphers, Lect. Notes Comput. Sci. source
    • cites [20] Maitra, 2015, Key Recovery from State Information of Sprout: Application to Cryptanalysis and Fault Attack, IACR Cryptol. ePrint Arch.

      Not checked in the free run.

    • cites [33] Roy, 2016, Fault analysis and weak key-IV attack on Sprout, IACR Cryptol. ePrint Arch.

      Not checked in the free run.

  • Findingnone given

    The nonlinearity of h function is 976 if kt* is 0.

    “The nonlinearity of h function is 976 if we suppose kt^(*)=0.”
    Quote in the paperNot a substantial claim
  • Findingreasoning

    The space size of Cr is 27 because it is a counter.

    “The space size of Cr is 2⁷ because it is a counter.”
    Quote in the paperSubstantial claim
  • Findingreasoning

    The space size of LFSR is 243−1.

    “As l80 is set to one and after that, it works independently; we are sure that the space size of LFSR is 2⁴³−1.”
    Quote in the paperSubstantial claim
  • Classified as probably not a substantial claim. 18
  • May combine two claims. 19
  • The quote only partly states this claim. 1

  • Classified as probably not a substantial claim.

    Premisecitation

    Lizard is a small-state stream cipher because its internal state is 121 bits for 80-bit security level.

    “Thus, Lizard is a small-state stream cipher because its internal state is 121 bits for 80-bit security level [27].”
    Quote in the paperSubstantial claim1 of 1 sources checked
    • cites [27] Hamann, 2017, LIZARD—A lightweight stream cipher for power-constrained devices, IACR Trans. Symmetric Cryptol. source

  • May combine two claims.

    Premisecitation

    Because the key does not affect independently and proportionally the internal state of Sprout, TMDTO attacks were applied successfully to Sprout.

    “Because the key does not affect independently (and proportionally) the internal state of Sprout, TMDTO attacks were applied successfully to Sprout [17,21].”
    Quote in the paperSubstantial claim1 of 2 sources checked
    • cites [17] Esgin, 2015, Practical Cryptanalysis of Full Sprout with TMD Tradeoff Attacks, Lect. Notes Comput. Sci. source
    • cites [21] Zhang, 2015, Another Tradeoff Attack on Sprout-Like Stream Ciphers, Lect. Notes Comput. Sci. source

  • May combine two claims.

    Findingnone given

    If kt′ is 0, the nonlinearity of g function is 23×3760 and resiliency 2.

    “If we suppose kt^(′)=0, the nonlinearity of g function will be 2³×3760 and resiliency 2.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingreasoning

    The design of Fruit was updated, and the attacks no longer worked.

    “The design of Fruit was updated, and the attacks no longer worked.”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim. May combine two claims.

    Findingnone given

    The internal state sizes of Fruit-80, Plantlet, Lizard, and Grain-v1 are 87, 101, 121, and 160 bits, respectively.

    “These results are expected because the size of the internal states of Fruit-80, Plantlet, Lizard, and Grain-v1 are 87, 101, 121, and 160 bits, respectively.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingreasoning

    Adding 6 linear terms increases the nonlinearity to 26×976=62,464 and makes a function with 5 resiliency.

    “We add 6 linear terms in order to increase the nonlinearity to 2⁶×976=62,464, and also to make a function with 5 resiliency.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingnone given

    The round key function in Fruit-80 involves bits of the key in g function independently, while in Sprout cipher none of the key bits are involved in g function in some clocks.

    “Round key function in Fruit-80 involves bits of the key in g function independently, while in Sprout cipher, none of the key bits are involved in g function in some clocks.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingreasoning

    The space size of the key is 280 because it can take any value.

    “The space size of the key is 2⁸⁰ because it can take any value.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingnone given

    Fruit-80 needs 160 clocks for initialization, while Plantlet, Sprout, and Lizard need 320, 320, and 256 clocks for initialization, respectively.

    “Fruit-80 (similar Grain-v1) needs 160 clocks for initialization, while Plantlet, Sprout, and Lizard need 320, 320, and 256 clocks for initialization, respectively.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingnone given

    Fruit-80 requires access to three key bits sequentially, while the round key function of Fruit uses six key bits randomly.

    “Fruit-80 requires access to three key bits sequentially, while the round key function of Fruit uses six key bits randomly.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Findingnone given

    Unlike the Grain family and Sprout, there is no weak key-IV in Fruit-80.

    “Unlike the Grain family and Sprout, there is no weak key-IV in Fruit-80.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingnone given

    An attacker should fix at least five variables of h function to linearize the output function and to easily identify the special internal states; it is at least two variables for Grain-v1.

    “An attacker should fix at least five variables of h function to linearize the output function and to easily identify the special internal states (it is at least two variables for Grain-v1).”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    Fruit-80, Plantlet, Lizard, and Grain-v1 require 960, 996, 1218, and 1270 GE for implementations in TSMC 0.18 μm technology, respectively.

    “Fruit-80, Plantlet, Lizard, and Grain-v1 require 960, 996, 1218, and 1270 GE for implementations in TSMC 0.18 μm technology, respectively.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    At the present time, the bottleneck of designing a secure ultra-lightweight stream cipher is TMDTO distinguishing attacks.

    “At the present time, the bottleneck of designing a secure ultra-lightweight stream cipher is TMDTO distinguishing attacks.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning

    The effective internal states of Fruit-80 are 167 bits and it is suitable.

    “Therefore, the effective internal states are 167 bits and it is suitable.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationreasoning

    The attacks on Fruit were related to the unsuitable choice of some parameters and the main structure was resistant to key recovery attacks.

    “Fortunately, the attacks were related to the unsuitable choice of some parameters and the main structure was resistant to key recovery attacks.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    Lizard is not an ultra-lightweight stream cipher according to the definitions.

    “Note that Lizard is not an ultra-lightweight stream cipher according the definitions.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning

    The TMDTO attacks to Sprout are not directly related to the main design idea of Sprout; they are related to the unsuitable round key function.

    “The TMDTO attacks to the Sprout are not directly related to the main design idea of Sprout (i.e., using a key not only in initialization but also in keystream generation). It is related to the unsuitable round key function.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    Fruit-80 is easier to implement than Fruit.

    “Now, Fruit-80 is presented as a final version which is easier to implement and is secure.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    Involving directly key bits in the output increases the security margin against some attacks such as guess and determine attacks.

    “The idea of involving directly key bits in the output increases the security margin against some attacks such as guess and determine attacks.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

    Interpretationnone given

    310 initial clocks is unreasonable for a lightweight cipher such as Plantlet.

    “It seems that 310 initial clocks is unreasonable for a lightweight cipher such as Plantlet.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    The degree of NFSR feedback was increased to 4 in Grain-128a to compensate this weakness.

    “The degree of NFSR feedback was increased to 4 in Grain-128a to compensate this weakness [12].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [12] Hell, 2011, Grain-128a: A new version of Grain-128 with optional authentication, Int. J. Wirel. Mob. Comput. source

  • Classified as probably not a substantial claim.

    Premisecitation

    A linear approximation attack was applied to Grain-v0.

    “A linear approximation attack was applied to Grain-v0 [32].”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [32] Maximov, A. (2006, January 21–24). Cryptanalysis of the “Grain” family of stream ciphers. Proceedings of the 2006 ACM Symposium on Information, Computer and Communications Security, Taipei, Taiwan. source

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    In Lizard cipher, designers are allowed to produce up to 2^18 keystream bits per key/IV pair, and they mentioned that 2^18 keystream bits are sufficient for many existing scenarios like Bluetooth, WLAN, and HTTPS.

    “In Lizard cipher, designers are allowed to produce up to 2¹⁸ keystream bits per key/IV pair, and they mentioned that 2¹⁸ keystream bits are sufficient for many existing scenarios like Bluetooth, WLAN, and HTTPS [24].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [24] Hamann, M., Krause, M., Meier, W., and Zhang, B. (2017). Design and analysis of small-state grain-like stream ciphers. Cryptogr. Commun. source

  • Classified as probably not a substantial claim.

    Premisecitation

    The new idea was to use IV bits not only in the initialization but also in the keystream generation.

    “The new idea was to use IV bits not only in the initialization but also in the keystream generation.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [24] Hamann, M., Krause, M., Meier, W., and Zhang, B. (2017). Design and analysis of small-state grain-like stream ciphers. Cryptogr. Commun. source

  • May combine two claims.

    Premisecitation

    In Grain-v1, key bits are loaded into the NFSR, and IV bits are loaded into the LFSR; key and IV bits use only one time and combine together directly.

    “In Grain-v1, key bits are loaded into the NFSR, and IV bits are loaded into the LFSR. Key and IV bits use only one time and combine together directly in Grain-v1 [3].”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [3] Hell, 2007, Grain: A stream cipher for constrained environments, Int. J. Wirel. Mob. Comput. source

  • Classified as probably not a substantial claim.

    Premisereasoning

    Allowed IVs in A5/1, which are 22-bit frame numbers, are produced only one time for every key.

    “Allowed IVs, which are 22-bit frame numbers, only one time are produced for every key (reusing the same IV is strictly prohibited with the same key in all stream ciphers).”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Reusing the same IV with the same key is strictly prohibited in all stream ciphers.

  • May combine two claims.

    Premisecitation

    Algebraic attacks have not been applied to the Grain family, but a type of algebraic attack was applied to Sprout.

    “Algebraic attacks have not been applied to the Grain family, but a type of algebraic attack was applied to Sprout [20].”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [20] Maitra, 2015, Key Recovery from State Information of Sprout: Application to Cryptanalysis and Fault Attack, IACR Cryptol. ePrint Arch.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    Fruit-80's IV loading is more resistant to related-key attacks than that of Grain-v1 and Plantlet.

    “Another advantage of Fruit-80’s IV loading is that it is more resistant to related-key attacks than that of Grain-v1 and Plantlet (as already discussed).”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning

    The main design idea of Sprout is not potentially weak to classical TMDTO attacks, and Fruit-80 can be resistant to classical TMDTO attacks.

    “This shows that the main design idea of Sprout is not potentially weak to classical TMDTO attacks, and also, Fruit-80 can be resistant to classical TMDTO attacks.”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim.

    Premisecitation

    If the NFSR and output function are chosen with high nonlinearity and suitable resiliency, ciphers similar to Grain-v0 will be resistant to linear approximation attacks.

    “In [32] it has been discussed that if the NFSR and the output function are chosen with high nonlinearity and suitable resiliency, the ciphers similar to Grain-v0 will be resistant to linear approximations attacks.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [32] Maximov, A. (2006, January 21–24). Cryptanalysis of the “Grain” family of stream ciphers. Proceedings of the 2006 ACM Symposium on Information, Computer and Communications Security, Taipei, Taiwan. source

  • The quote only partly states this claim.

    Interpretationreasoning

    The new IV loading scheme and asymmetric padding in Fruit-80 increase its resistance to related-key attacks.

    “Thus, the new idea increases the resistance to the related-key attacks.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationreasoning

    In Fruit-80, key bits are independently involved in keystream generation and in g function, therefore there is no problem from this point of view.

    “In Fruit-80, key bits are independently involved in keystream generation and in g function, therefore there is no problem from this point of view.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given

    If the key is fixed in Grain-v1, the internal state space is equal to twice the security level, i.e., 2160.

    “If it is supposed that key is fixed in Grain-v1, the internal state space is equal to twice of the security level (i.e., 2¹⁶⁰).”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given

    For a small-state stream cipher, the internal state space is less than twice the security level under a fixed key.

    “For a small-state stream cipher, the internal state space is less than twice of the security level under a fixed key.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Premisecitation

    In [24] a new idea was proposed to strengthen the small-state stream ciphers against TMDTO distinguishing attacks.

    “In [24] a new idea was proposed to strengthen the small-state stream ciphers against TMDTO distinguishing attacks.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [24] Hamann, M., Krause, M., Meier, W., and Zhang, B. (2017). Design and analysis of small-state grain-like stream ciphers. Cryptogr. Commun. source
36 of 36

  • The paper relies on this without support.

    The internal state size of a stream cipher must be at least twice its security level to resist classical TMDTO attacks.

    “The necessary condition for a stream cipher to be resistant to TMDTO attacks is that the internal state size should be at least twice that of its security level, such as Trivium, MICKEY 2.0, and Grain-v1.”
    “It is well known that the cipher is vulnerable to these attacks if the size of its internal state is not at least twice that of the security level.”

  • The paper relies on this without support.

    A key should be saved for reuse by other IVs in most real-world stream ciphers.

    “It is obvious that key should be saved for reuse by other IVs in the most real world stream ciphers.”

  • The paper relies on this without support.

    Reusing the same IV with the same key is strictly prohibited in all stream ciphers.

    “Allowed IVs, which are 22-bit frame numbers, only one time are produced for every key (reusing the same IV is strictly prohibited with the same key in all stream ciphers).”

  • The paper relies on this without support.

    A TMDTO distinguishing attack has been successfully applied to all small-state stream ciphers.

    “A TMDTO distinguishing attack was successfully applied to all of the small-state stream ciphers.”

  • The authors state this as an assumption.

    In the linear approximation analysis, kt* = 0.

    “If we suppose kt^(*)=0, the best linear approximation of the output has 2^(−5.415) bias as follows.”

  • The authors state this as an assumption.

    In the linear approximation analysis, kt' = 0.

    “If we suppose kt^(′)=0, the best linear approximation of the NFSR feedback function has 2^(−4.6) bias as follows.”

  • The authors state this as an assumption.

    In the algebraic attack analysis, the attacker can solve equations of keystream and obtain 1 bit of LFSR in each clock.

    “It is not easy to solve the equations, but we suppose that the attacker can solve equations of keystream and obtain 1 bit of LFSR in each clock.”

  • The authors state this as an assumption.

    In the hardware implementation, there is a memory for storing IV bits when all bits of IV are available at once.

    “In this case, we suppose that there is a memory for storing IV bits in the where that IV bits are produced in out of Fruit-80.”
8 of 8

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Reported nonlinearity exceeds the maximum for the stated variables

    Major

    With kt^(*) set to 0, the displayed h function depends on only 10 distinct state bits, so its nonlinearity cannot exceed 512. The reported value of 976 is impossible; adding six new variables would still leave the reported output nonlinearity of 62,464 above the corresponding maximum of 32,768.

  • Plantlet initialization is given as both 310 and 320 clocks

    Minor

    The paper gives two different initialization clock counts for Plantlet.

2 of 2

Cites

Flagged first, then by citations

2 of the 40 references couldn’t be matched to a known paper.

Research works printed but not linked: 3

  1. Dey, 2017, Cryptanalysis of full round Fruit, IACR Cryptol. ePrint Arch., 2017, 87
  2. Roy, 2016, Fault analysis and weak key-IV attack on Sprout, IACR Cryptol. ePrint Arch., 2016, 207
  3. Good, T., and Benaissa, M. (2008, January 13–14). Hardware performance of eStream phase-III stream cipher candidates. Proceedings of the Workshop on the State of the Art of Stream Ciphers (SACS 2008), Lausanne, Switzerland.

Cited by

Sorted by citations

Related

Authors
Amin Ghafari, V., & Hu, H.
Affiliations
  • Key Laboratory of Electromagnetic Space Information, Chinese Academy of Sciences, School of Information Science and Technology, University of Science and Technology of China, Hefei 230026, China
  • University of Science and Technology of China (CN)
Corresponding author
Hu, Honggang
ORCID
Venue
Entropy
Publisher
MDPI AG
Published
2018-03-08
Volume
20
Issue
3
Pages
180
ISSN
1099-4300 (ISSN-L)
DOI
10.3390/e20030180
PMC
PMC7512697
OpenAlex
W2794355405
Semantic Scholar
680fb8affba809d14242ddbb68bbbe18707a98c2
Cited by
45
References
40
Citations by year
2026: 3 · 2025: 2 · 2024: 7 · 2023: 4 · 2022: 10 · 2021: 6 · 2020: 8 · 2019: 5
FWCI
2.65
Type
journal article
Language
en
Open access
Licence
Locations
  • Entropy (publishedVersion, cc-by)
  • PubMed Central (publishedVersion, cc-by)
  • PubMed (publishedVersion)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
  • Physical Sciences › Computer Science › Artificial Intelligence › Coding theory and cryptography
  • Physical Sciences › Computer Science › Information Systems › Cryptography and Residue Arithmetic
Keywords
stream ciphers, sprouts, linear feedback shift registers, hardware area reduction, constrained environments

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-21.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-21.

Cited sources are checked by gpt-6-sol.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review