CoChat
Sign Up
Cited by 121Cryptographic Implementations and SecurityCoding theory and cryptographyCryptography and Residue Arithmetic

LIZARD—A lightweight stream cipher for power-constrained devices

Open access
Hamann, Matthias, Krause, Matthias, Meier, Willi·2017·IACR Transactions on Symmetric Cryptology
DOI 10.46586/tosc.v2017.i1.45-79
Open this paper in CoChat — free accountOpen PDF

Abstract

Time-memory-data (TMD) tradeoff attacks limit the security level of many classical stream ciphers (like E0, A5/1, Trivium, Grain) to 1/2n, where n denotes the inner state length of the underlying keystream generator. In this paper, we present Lizard, a lightweight stream cipher for power-constrained devices like passive RFID tags. Its hardware efficiency results from combining a Grain-like design with the FP(1)-mode, a recently suggested construction principle for the state initialization of stream ciphers, which offers provable 2/3n-security against TMD tradeoff attacks aiming at key recovery. Lizard uses 120-bit keys, 64-bit IVs and has an inner state length of 121 bit. It is supposed to provide 80-bit security against key recovery attacks. Lizard allows to generate up to 218 keystream bits per key/IV pair, which would be sufficient for many existing communication scenarios like Bluetooth, WLAN or HTTPS.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.46586/tosc.v2017.i1.45-79

Cites

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

No references could be resolved yet.

Research works printed but not linked: 40

  1. Martin Ågren, Martin Hell, Thomas Johansson, and Willi Meier. Grain-128a: A New Version of Grain-128 with Optional Authentication. International Journal of Wireless and Mobile Computing, 5(1):48-59, December 2011.
  2. Nitesh Saxena and Ahmad-Reza Sadeghi, editors, Radio Frequency Identifica- tion: Security and Privacy Issues: 10th International Workshop, RFIDSec 2014, Oxford, UK, July 21-23, 2014, Revised Selected Papers, pages 1-18. Springer International Publishing, Cham, 2014.
  3. Frederik Armknecht and Vasily Mikhalev. On Lightweight Stream Ciphers with Shorter Internal States. In Gregor Leander, editor, Fast Software Encryption: 22nd International Workshop, FSE 2015, Istanbul, Turkey, March 8-11, 2015, Revised Selected Papers, pages 451-470. Springer Berlin Heidelberg, Berlin, Heidelberg, 2015.
  4. S.H. Babbage. Improved "exhaustive search" attacks on stream ciphers. In Security and Detection, 1995., European Convention on, pages 161-166, May 1995.
  5. Subhadeep Banik. Some Results on Sprout. In Alex Biryukov and Vipul Goyal, editors, Progress in Cryptology -INDOCRYPT 2015: 16th International Confer- ence on Cryptology in India, Bangalore, India, December 6-9, 2015, Proceedings, pages 124-139. Springer International Publishing, Cham, 2015.
  6. Elad Barkan and Eli Biham. Conditional Estimators: An Effective Attack on A5/1. In Bart Preneel and Stafford Tavares, editors, Selected Areas in Cryptog- raphy: 12th International Workshop, SAC 2005, Kingston, ON, Canada, August 11-12, 2005, Revised Selected Papers, pages 1-19. Springer Berlin Heidelberg, Berlin, Heidelberg, 2006.
  7. Côme Berbain, Henri Gilbert, and Antoine Joux. Algebraic and Correlation Attacks against Linearly Filtered Non Linear Feedback Shift Registers. In Roberto Maria Avanzi, Liam Keliher, and Francesco Sica, editors, Selected Areas in Cryptography: 15th International Workshop, SAC 2008, Sackville, New Brunswick, Canada, August 14-15, Revised Selected Papers, pages 184-198. Springer Berlin Heidelberg, Berlin, Heidelberg, 2009.
  8. Côme Berbain, Henri Gilbert, and Alexander Maximov. Cryptanalysis of Grain. In Matthew Robshaw, editor, Fast Software Encryption: 13th International Workshop, FSE 2006, Graz, Austria, March 15-17, 2006, Revised Selected Papers, pages 15-29. Springer Berlin Heidelberg, Berlin, Heidelberg, 2006.
  9. Christof Beierle, Jérémy Jean, Stefan Kölbl, Gregor Leander, Amir Moradi, Thomas Peyrin, Yu Sasaki, Pascal Sasdrich, and Siang Meng Sim. The SKINNY Family of Block Ciphers and Its Low-Latency Variant MANTIS. In Matthew Robshaw and Jonathan Katz, editors, Advances in Cryptology -CRYPTO 2016: 36th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 14-18, 2016, Proceedings, Part II, pages 123-153. Springer Berlin Heidelberg, Berlin, Heidelberg, 2016.
  10. A. Bogdanov, L. R. Knudsen, G. Leander, C. Paar, A. Poschmann, M. J. B. Robshaw, Y. Seurin, and C. Vikkelsoe. PRESENT: An Ultra-Lightweight Block Cipher. In Pascal Paillier and Ingrid Verbauwhede, editors, Cryptographic Hardware and Embedded Systems -CHES 2007: 9th International Workshop, Vienna, Austria, September 10-13, 2007. Proceedings, pages 450-466. Springer Berlin Heidelberg, Berlin, Heidelberg, 2007.
  11. Alex Biryukov and Adi Shamir. Cryptanalytic Time/Memory/Data Tradeoffs for Stream Ciphers. In Tatsuaki Okamoto, editor, Advances in Cryptology - ASIACRYPT 2000: 6th International Conference on the Theory and Application of Cryptology and Information Security Kyoto, Japan, December 3-7, 2000 Proceedings, pages 1-13. Springer Berlin Heidelberg, Berlin, Heidelberg, 2000.
  12. Alex Biryukov, Adi Shamir, and David Wagner. Real Time Cryptanalysis of A5/1 on a PC. In Gerhard Goos, Juris Hartmanis, Jan van Leeuwen, and Bruce Schneier, editors, Fast Software Encryption: 7th International Workshop, FSE 2000 New York, NY, USA, April 10-12, 2000 Proceedings, pages 1-18. Springer Berlin Heidelberg, Berlin, Heidelberg, 2001.
  13. Peter H. Cole and Damith C. Ranasinghe. Networked RFID Systems and Lightweight Cryptography: Raising Barriers to Product Counterfeiting. Springer Berlin Heidelberg, first edition, 2008.
  14. Christophe De Cannière, Orr Dunkelman, and Miroslav Knežević. KATAN and KTANTAN -A Family of Small and Efficient Hardware-Oriented Block Ciphers. In Christophe Clavier and Kris Gaj, editors, Cryptographic Hardware and Embedded Systems -CHES 2009: 11th International Workshop Lausanne, Switzerland, September 6-9, 2009 Proceedings, pages 272-288. Springer Berlin Heidelberg, Berlin, Heidelberg, 2009.
  15. Christophe De Cannière, Özgül Küçük, and Bart Preneel. Analysis of Grain's Initialization Algorithm. In Serge Vaudenay, editor, Progress in Cryptology - AFRICACRYPT 2008: First International Conference on Cryptology in Africa, Casablanca, Morocco, June 11-14, 2008. Proceedings, pages 276-289. Springer Berlin Heidelberg, Berlin, Heidelberg, 2008.
  16. Elena Dubrova and Martin Hell. Espresso: A stream cipher for 5G wireless communication systems. Cryptography and Communications, pages 1-17, 2015.
  17. Itai Dinur and Adi Shamir. Breaking Grain-128 with Dynamic Cube Attacks. In Antoine Joux, editor, Fast Software Encryption: 18th International Workshop, FSE 2011, Lyngby, Denmark, February 13-16, 2011, Revised Selected Papers, pages 167-187. Springer Berlin Heidelberg, Berlin, Heidelberg, 2011.
  18. Elena Dubrova. A Scalable Method for Constructing Galois NLFSRs With Period 2 n -1 Using Cross-Join Pairs. IEEE Transactions on Information Theory, 59(1):703-709, January 2013.
  19. Muhammed F. Esgin and Orhun Kara. Practical Cryptanalysis of Full Sprout with TMD Tradeoff Attacks. In Orr Dunkelman and Liam Keliher, editors, Selected Areas in Cryptography -SAC 2015: 22nd International Conference, Sackville, NB, Canada, August 12-14, 2015, Revised Selected Papers, pages 67-85. Springer International Publishing, Cham, 2016.
  20. Scott Fluhrer, Itsik Mantin, and Adi Shamir. Weaknesses in the Key Scheduling Algorithm of RC4. In Serge Vaudenay and Amr M. Youssef, editors, Selected Areas in Cryptography: 8th Annual International Workshop, SAC 2001 Toronto, Ontario, Canada, August 16-17, 2001 Revised Papers, pages 1-24. Springer Berlin Heidelberg, Berlin, Heidelberg, 2001.
  21. Tim Good, William Chelton, and Mohamed Benaissa. Review of stream cipher candidates from a low resource hardware perspective. eSTREAM, ECRYPT Stream Cipher Project, Report 2006/016, 2006. http://www.ecrypt.eu.org/ stream/papersdir/2006/016.pdf.
  22. Jovan Dj. Golić. On the security of nonlinear filter generators. In Dieter Gollmann, editor, Fast Software Encryption: Third International Workshop Cambridge, UK, February 21-23 1996 Proceedings, pages 173-188. Springer Berlin Heidelberg, Berlin, Heidelberg, 1996.
  23. Nicholas J. Hopper and Manuel Blum. Secure Human Identification Protocols. In Colin Boyd, editor, Advances in Cryptology -ASIACRYPT 2001: 7th International Conference on the Theory and Application of Cryptology and Information Security Gold Coast, Australia, December 9-13, 2001 Proceedings, pages 52-66. Springer Berlin Heidelberg, Berlin, Heidelberg, 2001.
  24. M. Hellman. A cryptanalytic time-memory trade-off. IEEE Transactions on Information Theory, 26(4):401-406, Jul 1980.
  25. Martin Hell, Thomas Johansson, Alexander Maximov, and Willi Meier. The Grain Family of Stream Ciphers. In Matthew Robshaw and Olivier Billet, editors, New Stream Cipher Designs: The eSTREAM Finalists, pages 179-190. Springer Berlin Heidelberg, Berlin, Heidelberg, 2008.
  26. Institute of Electrical and Electronics Engineers. IEEE Standard for Infor- mation Technology -Telecommunications and Information Exchange Between Systems -Local and Metropolitan Area Networks -Specific Requirements -Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications. IEEE Std 802.11-1997, pages i-445, 1997.
  27. Institute of Electrical and Electronics Engineers. IEEE Standard for Information Technology -Telecommunications and Information Exchange Between Systems -Local and Metropolitan Area Networks -Specific Requirements -Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifi- cations: Amendment 6: Medium Access Control (MAC) Security Enhancements. IEEE Std 802.11i-2004, pages 1-190, July 2004.
  28. Institute of Electrical and Electronics Engineers. IEEE Standard for Information Technology -Telecommunications and Information Exchange Between Systems -Local and Metropolitan Area Networks -Specific Requirements -Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Spec- ifications. IEEE Std 802.11-2012 (Revision of IEEE Std 802.11-2007), pages 1-2793, March 2012.
  29. Ari Juels and Stephen A. Weis. Authenticating Pervasive Devices with Human Protocols. In Victor Shoup, editor, Advances in Cryptology -CRYPTO 2005: 25th Annual International Cryptology Conference, Santa Barbara, California, USA, August 14-18, 2005. Proceedings, pages 293-308. Springer Berlin Heidelberg, Berlin, Heidelberg, 2005.
  30. Matthias Krause. BDD-Based Cryptanalysis of Keystream Generators. In Lars R. Knudsen, editor, Advances in Cryptology -EUROCRYPT 2002: International Conference on the Theory and Applications of Cryptographic Techniques Ams- terdam, The Netherlands, April 28 -May 2, 2002 Proceedings, pages 222-237. Springer Berlin Heidelberg, Berlin, Heidelberg, 2002.
  31. Michael Lehmann and Willi Meier. Conditional Differential Cryptanalysis of Grain-128a. In Josef Pieprzyk, Ahmad-Reza Sadeghi, and Mark Manulis, editors, Cryptology and Network Security: 11th International Conference, CANS 2012, Darmstadt, Germany, December 12-14, 2012. Proceedings, pages 1-11. Springer Berlin Heidelberg, Berlin, Heidelberg, 2012.
  32. Yi Lu, Willi Meier, and Serge Vaudenay. The Conditional Correlation Attack: A Practical Attack on Bluetooth Encryption. In Victor Shoup, editor, Advances in Cryptology -CRYPTO 2005: 25th Annual International Cryptology Conference, Santa Barbara, California, USA, August 14-18, 2005. Proceedings, pages 97-117. Springer Berlin Heidelberg, Berlin, Heidelberg, 2005.
  33. Virginie Lallemand and María Naya-Plasencia. Cryptanalysis of Full Sprout. In Rosario Gennaro and Matthew Robshaw, editors, Advances in Cryptology -CRYPTO 2015: 35th Annual Cryptology Conference, Santa Barbara, CA, USA, August 16-20, 2015, Proceedings, Part I, pages 663-682. Springer Berlin Heidelberg, Berlin, Heidelberg, 2015.
  34. Vasily Mikhalev, Frederik Armknecht, and Christian Müller. On Ciphers that Continuously Access the Non-Volatile Key. IACR Transactions on Symmetric Cryptology, 2016(2):52-79, 2017.
  35. Pierrick Méaux, Anthony Journault, François-Xavier Standaert, and Claude Carlet. Towards Stream Ciphers for Efficient FHE with Low-Noise Ciphertexts. In Marc Fischlin and Jean-Sébastien Coron, editors, Advances in Cryptology -EUROCRYPT 2016: 35th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Vienna, Austria, May 8-12, 2016, Proceedings, Part I, pages 311-343. Springer Berlin Heidelberg, Berlin, Heidelberg, 2016.
  36. Willi Meier and Othmar Staffelbach. Fast correlation attacks on certain stream ciphers. Journal of Cryptology, 1(3):159-176, 1989.
  37. Bruce Schneier. Applied Cryptography (2nd Ed.): Protocols, Algorithms, and Source Code in C. John Wiley & Sons, Inc., New York, NY, USA, 1995.
  38. Thomas Siegenthaler. Decrypting a Class of Stream Ciphers Using Ciphertext Only. IEEE Transactions on Computers, 34(1):81-85, January 1985.
  39. Dirk Stegemann. Extended BDD-Based Cryptanalysis of Keystream Generators. In Carlisle Adams, Ali Miri, and Michael Wiener, editors, Selected Areas in Cryptography: 14th International Workshop, SAC 2007, Ottawa, Canada, August 16-17, 2007, Revised Selected Papers, pages 17-35. Springer Berlin Heidelberg, Berlin, Heidelberg, 2007.
  40. Bin Zhang and Xinxin Gong. Another Tradeoff Attack on Sprout-Like Stream Ciphers. In Tetsu Iwata and Hee Jung Cheon, editors, Advances in Cryptology - ASIACRYPT 2015: 21st International Conference on the Theory and Application of Cryptology and Information Security, Auckland, New Zealand, November 29 -December 3, 2015, Proceedings, Part II, pages 561-585. Springer Berlin Heidelberg, Berlin, Heidelberg, 2015.

Cited by

Sorted by citations

Authors
Hamann, M., Krause, M., & Meier, W.
Affiliations
  • University of Mannheim (DE)
  • FHNW University of Applied Sciences and Arts Northwestern Switzerland (CH)
ORCID
Venue
IACR Transactions on Symmetric Cryptology
Publisher
Universitatsbibliothek der Ruhr-Universitat Bochum
Published
2017-03-08
Pages
45-79
ISSN
2519-173X (ISSN-L)
DOI
10.46586/tosc.v2017.i1.45-79
OpenAlex
W4256468542
Cited by
121
References
0
Citations by year
2026: 10 · 2025: 8 · 2024: 14 · 2023: 11 · 2022: 17 · 2021: 16 · 2020: 14 · 2019: 13 · 2018: 7 · 2017: 11
FWCI
7.34
Type
journal article
Language
en
Open access
Licence
Locations
  • IACR Transactions on Symmetric Cryptology (publishedVersion, cc-by)
  • MADOC (University of Mannheim) (acceptedVersion, cc-by)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
  • MADOC (University of Mannheim) (submittedVersion, cc-by)
  • University Library BOCHUM (Ruhr University Bochum) (cc-by)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
  • Physical Sciences › Computer Science › Artificial Intelligence › Coding theory and cryptography
  • Physical Sciences › Computer Science › Information Systems › Cryptography and Residue Arithmetic
Keywords
lightweight stream cipher, power-constrained devices, RFID tags, state initialization, key recovery attack, keystream generation

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review