![](bg4.png)
To illustrate the complexities of the two attacks,
we consider the following example:
f(x
0
,. ..,x
49
) = x
0
· x
25
+ x
1
· x
26
+ ··· + x
23
· x
48
+S(x
25
,. ..,x
48
) + x
24
+ x
49
where S is a degree 24 function comprising the sum of
many high degree monomials such that it is difficult
to find a low degree multiple.
This is a degree 24, 1-resilient (balanced and 1-
correlation immune) boolean function with a high
nonlinearity of 2
49
− 2
25
, and it is also resistant to al-
gebraic attack due to the lack of a low degreemultiple.
Suppose the key size n = 128. We let the input to f
0
be a linear mixing of key and IV.
Our resync attack requires 3×50×2
24
≈ 2
31
func-
tion evaluations, and 3 × 26
2
× 2
24
+
128
3
64
≈ 2
35
row
operations, as well as approximately 26 resyncs.
The cube attack needs 3 × 50 × 51 × 2
23
≈ 2
36
function evaluations and
128
3
64
= 2
15
row operations
for the precomputation stage, as well as 3×50×2
23
≈
2
30
function evaluations and
128
2
64
= 2
8
multiplications
for the online phase. It also requires approximately
2
29
chosen IV resyncs.
Table 3: Our Attack.
f-function evaluations 2
31
Row operations 2
35
Number of resyncs 26
Number of clocks 3
Table 4: Cube Attack.
f-function evaluations (precomp) 2
36
Row operations (precomp) 2
15
f-function evaluations (online) 2
30
Multiplications (online) 2
8
Number of chosen IV resyncs 2
29
Number of clocks 3
As shown in the Tables 3 and 4, the number of
function evaluations required for our attack is compa-
rable to that for the cube attack. However, our attack
requires a much smaller number of resyncs. Further-
more, the IVs do not need to be of a chosen form.
4 CONCLUSIONS
We have applied the resynchronization attack on
stream ciphers with linearly clocked registers filtered
with Maiorana-McFarland functions. While Boolean
functions with large input sizes, nonlinearities, re-
siliencies and algebraic degrees may be ideal choices
for the cryptographic components in a synchronous
stream cipher we have described, it is not the case
for the class of functions we have studied. Despite
their good trade-off between cryptographically desir-
able properties, their simple algebraic form has made
them prone to guess-and-linearize-likeattacks such as
that we have described. Our study has also affirmed
the common view that the internal state should not be
linearly resynchronized from the key and IV.
REFERENCES
Canteaut, A., Carlet, C., Charpin, P., and Fontaine, C.
(2000). Propagation characterisics and correlation-
immunity of highly nonlinear boolean functions. In
Eurocrypt 2000. LNCS 1807:507-522.
Carlet, C. (2002). A larger class of cryptographic boolean
functions via a study of the Maiorana-McFarland con-
struction. In Crypto 2002. LNCS 2442:549-564.
Daemen, J., Govaerts, R., and Vandewalle, J. (1993).
Resynchronization weakness in synchronous stream
ciphers. In Eurocrypt 1993. LNCS 765:159-167.
Dinur, I. and Shamir, A. (2009). Cube attacks on tweakable
black-box polynomials. In Eurocrypt 2009. LNCS
5479:278-299.
Hell, M., Johansson, T., and Meier, W. Grain
- a stream cipher for constrained environments.
In The eStream Project - eStream Phase 3:
http://www.ecrypt.eu.org/stream/grainp3.html.
Mihaljevic, M. and Imai, H. (2002). Cryptanalysis of
Toyocrypt-HS1 stream cipher. In IEICE Trans. Fun-
damentals, vol. E85-A no. 1, pp. 66-73.
Sarkar, P. and Maitra, S. (2000). Nonlinearity bounds and
constructions of resilient boolean functions. In Crypto
2000. LNCS 1880:515-532.
Seberry, J., Zhang, X., and Zheng, Y. (1993). On construc-
tions and nonlinearity of correlation immune func-
tions (extended abstract). In Eurocrypt 1993. LNCS
765:181-199.
SECRYPT 2009 - International Conference on Security and Cryptography
162