Key Recovery from State Information of Sprout: Application to Cryptanalysis and Fault Attack.

摘要: Design of secure light-weight stream ciphers is an important area in cryptographic hardware & embedded systems and a very recent design by Armknecht Mikhalev (FSE 2015) has received serious attention that uses shorter internal state still claims to resist the time-memory-data-tradeoff (TMDTO) attacks. An instantiation this paradigm cipher named Sprout with 80-bit secret key. In paper we cryptanalyze refute various claims. The designers claim key can not be recovered efficiently from complete information using guess determine attack. However, paper, show it possible few hundred bits practical time. More importantly, around 850 key-stream bits, knowledge NFSR (40 bits) partial LFSR (around one third, i.e., 14 bits); obtain all bits. This cryptanalyzes 2 attempts (considering constant time complexity required SAT solver each attempt, which 1 minute laptop). less than exhaustive search. Further, how related ideas employed mount fault attack against requires 120 faults random locations (20 faults, if are known), whereas such may possible. Our cryptanalytic results raise quite questions about general should revisited greater care.