A new stream cipher, Grain, is proposed. The design targets hardware environments where gate count, power consumption and memory is very limited. It is based on two shift registers and a non-linear output function. The cipher has the additional feature that the speed can be increased at the expense of extra hardware. The key size is 80 bits and no attack faster than exhaustive key search has been identified. The hardware complexity and throughput compares favourably to other hardware oriented stream ciphers like E0 and A5/1.

/pdf/grain-a-stream-cipher-for-constrained-environments-2azyz8fiei.pdf

Grain: a stream cipher for constrained environments

Implementations of cryptographic algorithms continue to proliferate in consumer products due to the increasing demand for secure transmission of confidential information. Although the current standard cryptographic algorithms proved to withstand exhaustive attacks, their hardware and software implementations have exhibited vulnerabilities to side channel attacks, e.g., power analysis and fault injection attacks. This paper focuses on fault injection attacks that have been shown to require inexpensive equipment and a short amount of time. The paper provides a comprehensive description of these attacks on cryptographic devices and the countermeasures that have been developed against them. After a brief review of the widely used cryptographic algorithms, we classify the currently known fault injection attacks into low-cost ones (which a single attacker with a modest budget can mount) and high-cost ones (requiring highly skilled attackers with a large budget). We then list the attacks that have been developed for the important and commonly used ciphers and indicate which ones have been successfully used in practice. The known countermeasures against the previously described fault injection attacks are then presented, including intrusion detection and fault detection. We conclude the survey with a discussion on the interaction between fault injection attacks (and the corresponding countermeasures) and power analysis attacks.

/pdf/fault-injection-attacks-on-cryptographic-devices-theory-12qo1dda0z.pdf

Fault Injection Attacks on Cryptographic Devices: Theory, Practice, and Countermeasures

Processing encrypted signals requires special properties of the underlying encryption scheme. A possible choice is the use of homomorphic encryption. In this paper, we propose a selection of the most important available solutions, discussing their properties and limitations.

/pdf/a-survey-of-homomorphic-encryption-for-nonspecialists-3h2jygsf38.pdf

A Survey of Homomorphic Encryption for Nonspecialists

Recent growth in the processing and memory resources of mobile devices has fueled research within the field of mobile virtualization. Mobile virtualization enables multiple persona on a single mobile device by hosting heterogeneous operating systems (OSs) concurrently. However, adding a virtualization layer to resource-constrained mobile devices with real-time requirements can lead to intolerable performance overheads. Hardware virtualization extensions that support efficient virtualization have been incorporated in recent mobile processors. Prior to hardware virtualization extensions, virtualization techniques that are enabled by performance prohibitive and resource consuming software were adopted for mobile devices. Moreover, mobile virtualization solutions lack standard procedures for device component sharing and interfacing between multiple OSSs. The objective of this article is to survey software- and hardware-based mobile virtualization techniques in light of the recent advancements fueled by the hardware support for mobile virtualization. Challenges and issues faced in virtualization of CPU, memory, I/O, interrupt, and network interfaces are highlighted. Moreover, various performance parameters are presented in a detailed comparative analysis to quantify the efficiency of mobile virtualization techniques and solutions.

A Survey of Mobile Device Virtualization: Taxonomy and State of the Art

In this paper, we propose a new stream cipher construction based on block cipher design principles The main idea is to replace the building blocks used in block ciphers by equivalent stream cipher components In order to illustrate this approach, we construct a very simple synchronous stream cipher which provides a lot of flexibility for hardware implementations, and seems to have a number of desirable cryptographic properties

Trivium: A Stream Cipher Construction Inspired by Block Cipher Design Principles

In 2000, the stream cipher SNOW was proposed. A few attacks followed, indicating certain weaknesses in the design. In this paper we propose a new version of SNOW, called SNOW 2.0. The new version of the cipher does not only appear to be more secure, but its implementation is also a bit faster in software.

/pdf/a-new-version-of-the-stream-cipher-snow-f60zcs5mt3.pdf

A New Version of the Stream Cipher SNOW

A5/1 is a stream cipher used in the Global System for Mobile Communications (GSM) standard. Several time-memory tradeoff attacks against A5/1 have been proposed, most notably the attack by Biryukov, Shamir and Wagner (1978), which can break A5/1 in seconds using huge precomputation time and memory. This article presents a completely different attack on A5/1, based on ideas from correlation attacks. Whereas time-memory tradeoff attacks have a complexity which is exponential with the shift-register length, the complexity of the proposed attack is almost independent of the shift-register length. Our implementation of the suggested attack breaks A5/1 in a few minutes using 2-5 min of conversation plaintext.

Another attack on A5/1

In this paper a new word-oriented stream cipher, called SNOW, is proposed. The design of the cipher is quite simple, consisting of a linear feedback shift register, feeding a nite state machine. The design goals of producing a stream cipher signi cantly faster than AES, with signi cantly lower implementation costs in hardware, and a security level similar to AES is currently met. Our fastest C implementation requires under 1 clock cycle per running key bit. The best attacks are generic attacks like an exhaustive key search attack.

SNOW - A new stream cipher

Stream ciphers are cryptographic primitives used to ensure privacy in digital communication. In this thesis we focus on stream ciphers built using Linear Feedback Shift Registers (LFSRs). Several different stream ciphers are analysed and new attacks are presented. In addition, two new stream ciphers are presented, both based on the same design.

The first attack is performed on SOBER-t16 and SOBER-t32. A new distinguishing attack is presented for simplified versions of the two ciphers, as well as for the complete version of SOBER-t16.

Next, the cipher A5/1, used in the GSM standard for mobile telephones, is analysed. The resulting attack is an initial state recovery attack which recovers the secret key using approximately 5 minutes of known keystream. The attack takes roughly 5 minutes to perform on today's standard PC.

Bluetooth is a well-known standard for wireless communication and the cipher responsible for the secrecy within that standard is called E0. An initial state recovery algorithm on E0 is presented, based on recently discovered correlations within the cipher. These new correlations are stronger than previously known. This attack, however, is only applicable to E0 in a theoretical perspective, since the required length of the observed keystream is longer than allowed in the Bluetooth standard.

Following this, two distinguishing attacks are presented targeting clock controlled generators; the shrinking generator and the self-shrinking generator. The attack on the shrinking generator is based on a new observation that the majority bits of a block surrounding the tap positions in the LFSR output also fulfils the linear recurrence equation. The attack on the self-shrinking generator identifies two new classes of weak feedback polynomials. For the first class, both a distinguishing attack and an initial state recovery attack are presented. This distinguishing attack is remarkable in the sense that the required length of the observed keystream only grows linearly in the length of the shift register. For the second class of weak feedback polynomials a distinguishing attack is given.

The final part of this thesis concerns the design of stream ciphers. Two new designs are presented, SNOW 1.0 and SNOW 2.0, the latter being an improvement on the former. These ciphers are designed to be very fast, especially in a software implementation.

On LFSR based Stream Ciphers - analysis and design

Two ways of mounting distinguishing attacks on two similar stream ciphers, SOBER-t16 and SOBER-t32, are proposed. It results in distinguishing attacks faster than exhaustive key search on full SOBER- t16 and on SOBER-t32 without stuttering.

/pdf/distinguishing-attacks-on-sober-t16-and-t32-2pwr9kq25h.pdf

Patrik Ekdahl

Papers

A New Version of the Stream Cipher SNOW

Another attack on A5/1

SNOW - A new stream cipher

On LFSR based Stream Ciphers - analysis and design

Distinguishing Attacks on SOBER-t16 and t32