![](bga.png)
8 DISCUSSION
In this paper, we have documented improvements to
the Dragon cipher, and presented them as Dragon-
2. Users of Dragon-2 have a choice to use the AES
round function within the cipher, gaining the benefit
of the recent AES-NI set, which provides blisteringly
fast encryption support. This version of the cipher
is called Black Dragon. Alternatively, the user can
specify four iterations of the SMS-4 round function,
in which case the cipher is called Yellow Dragon.
Dragon-2 represents a relatively conservative de-
sign that benefits from good hardware support. In the
future, once more widespread analysis has been con-
ducted, it might be considered a viable alternative to
the eSTREAM software portfolio members.
For example, HC-128 is very fast for long mes-
sages, but its much larger state requires a long time
for rekeying, and so it is not as agile as Dragon-2. De-
pending on the application, Dragon-2 might be prefer-
able.
Salsa-20 relies on the iterated weak non-linearity
of addition, compared to the provenhighnon-linearity
of the AES and SMS-4 s-boxes. Relying on the prop-
erties of a single operation does not provide robust-
ness. Advances in differential cryptanalysis are likely
to weaken Salsa-20. Dragon-2 is a more conservative
and equally efficient choice.
Sosemanuk has been shown to be unable to pro-
vide 256 bits of security; it is not termed broken only
because its designers specified 128 bits of security
even for the larger key. Rabbit appears to be strong,
but only accepts a 128-bit key (Robshaw and Billet,
2008). In either case, if Dragon-2 withstands crypt-
analysis, it is a stronger choice.
There is still much work to do on Dragon-2. We
continue to cryptanalyse it, but it must be scrutinized
by impartial cryptographers. We have met the remark
made in the eSTREAM report, as presented in the first
section of this paper. Due to space limitations in this
paper, test vectors are available upon request.
REFERENCES
Berbain, C., Billet, O., Canteaut, A., Courtois, N., Gilbert,
H., Goubin, L., Gouget, A., Granboulan, L., Lau-
radoux, C., Minier, M., Pornin, T., and Sibert, H.
(2008). SOSEMANUK, a Fast Software-Oriented
Stream Cipher. In (Robshaw and Billet, 2008), pages
98–118.
Billet, O. and Gilbert, H. (2005). Resistance of SNOW 2.0
against algebraic attacks. In Menezes, A. J., editor,
Topics in Cryptology - CT-RSA 2005, The Cryptog-
raphers' Track at the RSA Conference 2005, volume
3376 of Lecture Notes in Computer Science, pages
19–28. Springer.
Biryukov, A. and Shamir, A. (2000). Cryptanalytic
time/memory/data tradeoffs for stream ciphers. In
Okamoto, T., editor, Advances in Cryptology - Pro-
ceedings of Asiacrypt 2000, volume 1976 of Lecture
Notes in Computer Science, pages 1–13. Springer.
Chen, K., Henricksen, M., Millan, W., Fuller, J., Simpson,
L. R., Dawson, E., Lee, H., and Moon, S. (2004).
Dragon: A fast word based stream cipher. In Park, C.
and Chee, S., editors, ICISC, volume 3506 of Lecture
Notes in Computer Science, pages 33–50. Springer.
Cho, J. Y. (2008). An improved estimate of the correlation
of distinguisher for Dragon. In SASC2008, pages 11–
20, Lausanne, Switzerland. Special Workshop hosted
by the ECRYPT Network of Excellence. Proceedings
available at http://www.ecrypt.eu.org/stvl/sasc2008/.
Daemen, J. and Rijmen, V. (2002). The Design of Rijndael:
AES - The Advanced Encryption Standard. Springer.
Englund, H. and Maximov, A. (2005). Attack the dragon.
In Maitra, S., Madhavan, C. E. V., and Venkatesan, R.,
editors, INDOCRYPT, volume 3797 of Lecture Notes
in Computer Science, pages 130–142. Springer.
eSTREAM (2008). Third phase report. At
http://www.ecrypt.eu.org/stream/index.html.
Feng, X., Liu, J., Zhou, Z., Wu, C., and Feng, D. (2010).
A Byte-Based Guess and Determine Attack on SOSE-
MANUK. In ASIACRYPT'10, pages 146–157.
Fog, A. (2011). Instruction tables. Lists of instruc-
tion latencies, throughputs and microoperation break-
downs for Intel, AMD and VIA CPUs. At
www.agner.org/assem/.
People’s Republic of China Office of State Com-
mercial Cryptography Administration (2006).
The SMS4 Block Cipher. Archive available at
http://www.oscca.gov.cn/UpFile/20062101642319799
0.pdf (in Chinese).
Robshaw, M. and Billet, O., editors (2008). New Stream
Cipher Designs: The eSTREAM Finalists. Number
4986 in Lecture Notes in Computer Science. Springer.
VAMPIRE - Virtual Applications and Implementa-
tions Research Lab (2012). eBACS: ECRYPT
Benchmarking of Cryptographic Systems.
http://bench.cr.yp.to/results-stream.html.
Wu, H. (2008). The stream cipher HC-128. In (Robshaw
and Billet, 2008), pages 39–47.
SECRYPT2012-InternationalConferenceonSecurityandCryptography
44