Stream Ciphers and Algebraic Attack Methods
MIDN 1/C Jake Felton
United States Naval Academy
Introduction
This paper is a Capstone effort in cryptography (more particularly, cryptanalysis) at the
United States Naval Academy. The intended audience, however, is much larger. I have
endeavored to make the paper as accessible yet streamlined as possible. As a result, the heart of
the paper – algebraic attack methods on stream ciphers based on linear feedback shift registers –
is well motivated by definitions and mathematical context. A familiarity with cryptography is
helpful but not necessary, so long as the reader is sufficiently fluent in mathematics generally.
Stream ciphers take back seat to block ciphers in many of the most common usage
scenarios, such as electronic data transmission over the internet. However, stream ciphers
remain an important part of modern cryptography, particularly in low-power environments.
Stream ciphers are often used in radio frequency identification (RFID) and mobile
communication for their efficiency in hardware, simplicity, and ability to manipulate messages
of any size rather than discrete blocks. The ‘traditional’ stream cipher is based on a block of
memory called a linear feedback shift register, along with a nonlinear keystream function. As a
result, the attack method presented in this paper is applicable to a large subset of stream ciphers.
When important terms are introduced, they are written in italics until they have been
properly defined. Afterwards they are written normally.
Basic Definitions
A cryptosystem is simply a collection of five objects – three sets or spaces and two rules
(or functions). The three sets, taken from some alphabet 𝒜, are the plaintext set 𝒫, the
ciphertext set 𝒞, and the keyspace 𝒦. The following definition based on that in [1] formalizes
this notion. Note that all other definitions in this section, unless otherwise indicated, are based
on those found in [4].
Definition 1 (cryptosystem)
An alphabet 𝒜 is a set of symbols.
The finite set 𝒫 ⊆ 𝒜 is the set of all possible messages, called plaintexts.
The finite set 𝒞 ⊆ 𝒜 is the set of all possible encodings, called ciphertexts.
The finite set 𝒦 ⊆ 𝒜 is the set of all possible keys, called the keyspace.
1
For every key 𝐾 ∈ 𝒦, there is an encryption rule 𝑒𝐾 ∈ ℰ and a corresponding decryption rule
𝑑𝐾 ∈ 𝒟 such that:



the function 𝑒𝐾 ∶ 𝒫 → 𝒞
the function 𝑑𝐾 ∶ 𝒞 → 𝒫
𝑑𝐾 (𝑒𝐾 (𝑥)) = 𝑥 for every plaintext 𝑥 ∈ 𝒫
The fundamental purpose of any cryptosystem is to enable secure, accurate, and
authenticable communication between two parties, called Alice and Bob. The assumption, of
course, is that there will always be an eavesdropper Eve attempting to compromise some element
of that security. To assume to the contrary would defeat the purpose of secret communication.
Eve has significant implications for the study of cryptosystems. She highlights the important
relationship between the arts of making ciphers and breaking ciphers. This dynamic will
resurface later in the discussion of the attack, in the form of consequences that inform further
design. For now, consider some famous notions of security that help illuminate the notion of a
secure cryptosystem.
Definition 2 (Kerckhoff’s Principle): In 1883 Auguste Kerckhoffs formulated six design
principles for military ciphers in [2]. Perhaps the most notable of these stipulates that the cipher
“must not require secrecy, and that it can conveniently fall into the hands of the enemy”. In
other words, cryptographers must assume that every object of the cipher except the secret key is
public. This implies that the security of a cryptosystem must rely solely on the strength of the
secret key. *For ciphers that operate over the finite field GF(2), and with key size n, the
‘strength’ of the secret key is often measured in terms of the size of the keyspace, 2𝑛 . Indeed,
this value is sometimes called the security parameter of the cipher.
Definition 3 (Perfect Secrecy): In 1949 Claude Shannon published a landmark paper that
introduced many of the notions of secrecy currently used. Among these are the principles of
confusion and diffusion, most often realized as some type of substitution and permutation in
modern ciphers. In addition, he provided the following theorem defining perfect secrecy, taken
directly from [3]:
2
Theorem 1 (Shannon): A necessary and sufficient condition for perfect secrecy is that
𝑃{𝑥|𝑦} = 𝑃{𝑥}
For all 𝑥 ∈ 𝒫 and 𝑦 ∈ 𝒞.
In other words, the probability of guessing the plaintext that corresponds to any given ciphertext
is simply the probability of guessing the plaintext given nothing at all.
This is a useful idea, but does not guarantee a practical (or even secure) cipher. For
instance, the One-Time Pad (OTP) is a tantalizingly simple cipher that achieves perfect secrecy.
It requires Alice and Bob to agree on a secret key K that is the same length as the plaintext x they
wish to encrypt (normally in GF(2)). The key K is then added to x bit-wise to produce the
ciphertext y. However, Alice and Bob must find a way to secretly agree on a K that is the same
length as the plaintext they wish to communicate secretly. This defeats the purpose of the OTP
in almost all applications.
A better idea is to reframe the condition of perfect secrecy in a more pragmatic way
called conditional security, thereby relaxing the design criteria of ciphers.
Definition 4 (Conditional Security): A system is called conditionally secure if it can be broken
in principle, but requires more computing power than a realistic adversary would have. In this
case its security is measured via complexity theory.
Recall that Kerckhoff’s principle stated that the security of a cryptosystem relies entirely
on the strength of the secret key. We can say, then, that a cryptosystem is conditionally secure if
the plaintext cannot be recovered from the ciphertext with any less cost than searching every key
𝐾 ∈ 𝒦. We call this attack a brute force or exhaustive key search attack. This provides a
benchmark [conditional] value of security for designers of cryptosystems and implies one
obvious condition for security: the keyspace 𝒦 must be large (recall the security parameter 2𝑛
for ciphers over GF(2)). Modern computing can perform a brute force attack on key sizes up to
about 264.
Just as conditional security is to perfect secrecy, so are stream ciphers to the OTP.
Stream ciphers capture the spirit of the OTP in a more practical way.
3
Definition 5 (Stream Cipher): A stream cipher is a key-dependent algorithm with internal
memory that receives symbols of a message x one-by-one over the alphabet 𝒜, and in parallel
produces the ciphertext y over the same alphabet, perhaps, with some delay.
The internal memory refers to an internal state described in more detail later, which
differentiates stream ciphers from block ciphers according to this definition.
Before providing a rigorous treatment of stream ciphers, it is helpful to consider where
they live in the taxonomy of cryptographic primitives.
Definition 6 (Cryptographic primitive): A cryptographic primitive is a fundamental (primitive)
component of cryptographic systems. For instance, one cryptographic system may be made of a
public-key cipher in which Alice and Bob privately agree on a secret key to be used in a
symmetric-key cipher for communication, to be signed to guarantee authenticity. The primitives
are the elements that make up the system as a whole.
The following diagram is based on one in [4].
Hash Functions
Unkeyed
Primitives
Random Sequences
Block Ciphers
Cryptographic
Primitives
Symmetric-key ciphers
Symmetrickey Primitives
Stream Ciphers
Pseudo-random Sequences
Public-key ciphers
Public-Key
Primitives
Signatures
Figure 1: Taxonomy of Cryptographic Primitives
4
Structure of Stream Ciphers
According to definition 5, a stream cipher encrypts elements of the plaintext one-by-one.
In order to do so, the small key K must somehow generate a long keystream and combine it with
the plaintext.
Definition 7 (Keystream, Keystream Generator): The keystream generated by secret key K over
some alphabet 𝒜 is a sequence of symbols from the same alphabet 𝒜, denoted
𝑧 𝑛 = 𝑧1 , 𝑧2 , … , 𝑧𝑛
𝑧𝑖 ∈ 𝒜, 𝑖 = 1, 2, … , 𝑛
The object that produces the keystream is called the keystream generator (KSG). Usually (and
for our purposes), 𝒜 ⊆ 𝐺𝐹(2𝑛 ) and 𝑧𝑖 ⊂ 𝐺𝐹(2). In other words, the keystream is a sequence
of 0’s and 1’s of length n, the length of the plaintext. The usual operation of combining plaintext
and keystream bits is the exclusive or (XOR), or addition modulo 2, denoted ⊕.
Definition 8 (Synchronous Stream Cipher): The simplest class of stream cipher is the
synchronous stream cipher. It is so named because it requires that Alice and Bob keep their
encryption and decryption operations synchronized on the same time t. It also means that, by
itself, the SSC has no tolerance for error. According to [4] while adopting the notation in [5], an
SSC is built from

Internal state (IS), s, denotes the value of the internal state at time t.

Update function (UF), L, (also called the connection function) takes as input the state
(and perhaps key) at time t and produces as output the state at time t+1. So the update
function updates the IS with each iteration.
at time t = 0, 1, …
L(st, K) = st+1

Keystream function, f, (also called a nonlinear filter) takes as input the state st (and
perhaps key) and produce as output the keystream element zt. In other words, f uses the
internal state at time t to produce one keystream bit zt.
at time t = 0, 1, …
f(st, K) = zt

Output function, h, is the function that combines the keystream and the plaintext,
resulting in the ciphertext. Again, h is normally the XOR.
at time t = 0, 1, …
h(xt, zt) = ct
5
The goal of any stream cipher is to produce as random a keystream as possible in order to
mimic the security of the OTP. However, since truly random sequences are inherently difficult
to obtain, pseudo-random sequences are used instead. Pseudo-random sequences are generated
using pseudo-random number generators (PRNG), which have a wide range of application. In
essence, the stream cipher is actually just a PRNG with a combining operation.
Definition 9 (Pseudo-random number generator): A PRNG is a deterministic algorithm that
produces samples from some alphabet 𝒜 that look independent and uniformly distributed. A
PRNG uses a seed as its initialization parameter, and always produces the same sequence of
numbers given the same seed.
The PRNG drastically increases practicality and scalability of stream ciphers because it reduces
the key to a manageable size. Rather than attempt to secretly transmit a truly random sequence
that is as long as the message, Alice and Bob can simply use any popular public-key
cryptographic primitive to agree on a sequence of n bits, which will produce a pseudo-random
keystream with large period.
Boolean Functions
Recall that in most cases, the alphabet for stream ciphers is over GF(2) and the keystream
bits are in GF(2). The keystream function, then, is a Boolean Function.
Definition 10 (Boolean Function (BF), Degree, Linear and Affine):

A Boolean Function f maps a binary string of length n to one binary variable.
f(x1, x2, … , xn) = y,
𝑦 ∈ 𝐺𝐹(2)
One important property of BF’s is that each BF has a unique representation as a
multivariate polynomial over GF(2), called the algebraic normal form (ANF). In other words,
the keystream function f is a multivariate polynomial.

The algebraic degree of a function, d, is the number of variables in the highest order term
with non-zero coefficient.
o Ex: deg(x2y2 + xy2 + x3) = 4 in ℝ
o Ex: deg(𝑠1 + 𝑠2 + 𝑠1 𝑠2 + 𝑠1 𝑠2 𝑠3 + 𝑠4 + 𝑠2 𝑠4 ) = 3 in GF(2)
6

A BF is affine if there exists no term of degree greater than 1 in the ANF.

An affine function with zero constant term is a linear function.
The concepts of nonlinear, low-degree Boolean functions are at the heart of this paper.
Linear Feedback Shift Registers
Perhaps the most common type of PRNG used in stream ciphers is the linear feedback
shift register (LFSR). A LFSR of length l is a collection of l memory cells which are each filled
with an element of GF(2) (usually). The state of the LFSR at time t is simply the contents of the
l memory cells.
Figure 2: General LFSR Structure
The LFSR updates by running the current state s through a linear recurrence relation
𝑙−1
𝑐𝑡+𝑙 = 𝑐𝑙 ∙ ∑ 𝑐𝑖 ∙ 𝑠𝑡+𝑖
over 𝐺𝐹(2)
𝑖=0
The constants 𝑐0 , 𝑐1 , … , 𝑐𝑙 are called the feedback coefficients, the connection at cl is called the
feedback position, and the connections at 𝑐0 , 𝑐1 , … , 𝑐𝑙−1 are called the tap positions. The output
ct+l moves onto one end of the LFSR, pushing all other elements over and outputting one element
out the opposite side.
LFSR’s are attractive because they are easy to implement, have large period, and look
statistically random. However, since the recurrence relation is linear, the LFSR has low linear
complexity, defined as the length of the shortest LFSR able to produce any given sequence. If
we take the sequence of outputs as the keystream, the keystream will be susceptible to linear
attacks. We can avoid this problem by introducing a non-linear component between the LFSR
7
and the keystream. This component is the keystream function f, which as we learned before is a
function on the state of the LFSR.
The Problem
Consider a LFSR-based cipher with key in GF(2n). We have an internal states st at time t,
a state update function L, and a multivariate Boolean keystream function f (the nonlinear filter
function). The update function L is linear by definition of LFSR and the keystream function f
does not depend on the secret key K, but only the state of the LFSR. In the spirit of Kerckhoff,
assume both L and f are public and only the state is secret. All of the following content is
described in [5].
Let (𝑘0 , 𝑘1 , … , 𝑘𝑛−1 ) be the initial state at time t = 0, where 𝑘0 , 𝑘1 , … , 𝑘𝑛−1 = K, the
secret key of length n. Then the ‘zeroth’ keystream bit is:
𝑧0 = 𝑓(𝑘0 , 𝑘1 , … , 𝑘𝑛−1 )
At time t = 1, the state is given by L(𝑘0 , 𝑘1 , … , 𝑘𝑛−1 ) so the keystream bit is given by:
𝑧1 = 𝑓(𝐿(𝑘0 , 𝑘1 , … , 𝑘𝑛−1 ))
Repeating the process, the keystream is generated as follows:
𝑧0 = 𝑓(𝑘0 , 𝑘1 , … , 𝑘𝑛−1 )
𝑧1 = 𝑓(𝐿(𝑘0 , 𝑘1 , … , 𝑘𝑛−1 ))
𝑧2 = 𝑓(𝐿2 (𝑘0 , 𝑘1 , … , 𝑘𝑛−1 ))
⋮
𝑧𝑡 = 𝑓(𝐿𝑡 (𝑘0 , 𝑘1 , … , 𝑘𝑛−1 ))
*Goal: Recover the initial state, and therefore the key K, given a subset of keystream bits zi.*
Once K is known, Eve can use it to generate the entire keystream using the update and key
generating functions. At that point she can decrypt just like Bob. The obvious first idea is to
solve the system of multivariate equations using an existing technique such as linearization or
the XL algorithm introduced in [5].
8
Question 1: The number N of monomials of degree less than or equal to d is given by
𝑑
𝑙
𝑁 = ∑( )
𝑖
𝑖=1
Suppose l = 128 and d = 6. Then
6
𝑁 = ∑(
𝑖=1
128
128
)≈(
) = 232.337
𝑖
6
Using linearization and Gaussian elimination on a problem this size proves intractable. How can
we solve the system of multivariate polynomials if f is of high degree?
Idea 1: Suppose d = 3. Then
3
𝑁 = ∑(
𝑖=1
128
128
)≈(
) = 218.381
𝑖
3
If we can reduce the degree of the keystream function, then the problem falls outside the realm of
conditional security.
Find a low degree function that approximates f with probability close to 1. Then for ‘most’ of
the known keystream bits the approximating function produces a low degree equation that holds.
The system of equations can now be solved.
Question 2: What if no good low degree approximation of f exists?
Idea 2: The subject of this paper. Reduce the degree of f by multiplying it by a well-chosen
multivariate polynomial. Then the system holds with probability 1 and we can solve the
overdefined system of low degree equations. The term overdefined simply means that there are
more equations than unknowns, or the number of equations > 𝑛, the size of the key.
The Algebraic Attack
The Problem calls for a known subset of keystream bits zi and their positions in the
keystream. The positions provide the exponents i of Li, eliminating the requirement that the
known keystream bits are consecutive. An outline of the attack follows. Note that the content of
following sections is based almost entirely on [5], and thus any quotes are from [5] unless
specified otherwise.
9
0. Let s denote the state at any time. Then every know keystream bit zi produces an
equation f(s) = zi.
1. Multiply f(s) = zi by a well-chosen multivariate polynomial g(s), such that f(s)∙g(s) is of
significantly lower degree than f, denoted by d.
2. Set up a system of equations f(s)g(s) = zi g(s) for all known keystream bits zi. The system
of equations is on the initial state bits ki, which make up the secret key K.
3. If sufficiently many keystream bits are known, the system is highly overdefined and can
be solved efficiently.
The methods for solving the system of multivariate equations are discussed only cursorily
here. The big mystery, then, is the polynomial g. The rest of the paper will explore how to
choose g and demonstrate the attack on a few examples.
Assumptions





Only synchronous stream ciphers are discussed (i.e., stream ciphers “in which each state
is generated from the previous state independently of the plaintext”)
Assume a binary stream cipher (i.e., the alphabet is over GF(2))
The update function (connection function) L is linear over GF(2) and public
The keystream function (nonlinear filter) f is public and not a function of K
Only the state is secret (Recall: the goal is to find the initial state, which is K)
Scenarios
Breaking the problem down into different scenarios helps provide direction on which
attack method to choose. The following scenarios, introduced in [5], focus on the characteristics
of the keystream function f, specifically the degree d. They reprise the logical progression given
by the questions and ideas in the ‘Problem’ section above.
Scenario 1 (S1): either the keystream function f has low algebraic degree d
Scenario 2 (S2): or f can be approximated by a low degree function with probability close to 1.
The new idea here calls for multiplying f by a well-chosen function g to produce a function f g of
low degree. It relaxes the condition that f be of low degree in S1 by providing an alternative to
S2 using equations that are true with probability 1.
10
Scenario 3 (S3): there exists some non-zero multivariate polynomial g such that f g is of low
degree d. *Note that S3 is actually a generalization of S1, where g = 1
It is also important to note that each of these scenarios provides a route of attack that
must be taken into account with future stream cipher designs. The implications of these
strategies are discussed briefly after the example attacks.
The Problem Redefined
Recall that the strategy to recover the key K, which is the initial state of the LFSR at time
t0, is to create a system of multivariate nonlinear equations
𝑧0 = 𝑓(𝑘0 , 𝑘1 , … , 𝑘𝑛−1 )
𝑧1 = 𝑓(𝐿(𝑘0 , 𝑘1 , … , 𝑘𝑛−1 ))
𝑧2 = 𝑓(𝐿2 (𝑘0 , 𝑘1 , … , 𝑘𝑛−1 ))
⋮
𝑧𝑡 = 𝑓(𝐿𝑡 (𝑘0 , 𝑘1 , … , 𝑘𝑛−1 ))
where each known keystream bit zi produces one equation. Now, however, multiply both sides
of each equation by the well-chosen g to produce
𝑧0 ∙ 𝑔(𝑘0 , 𝑘1 , … , 𝑘𝑛−1 ) = 𝑔(𝑘0 , 𝑘1 , … , 𝑘𝑛−1 ) ∙ 𝑓(𝑘0 , 𝑘1 , … , 𝑘𝑛−1 )
𝑧1 ∙ 𝑔(𝐿(𝑘0 , 𝑘1 , … , 𝑘𝑛−1 )) = 𝑔(𝐿(𝑘0 , 𝑘1 , … , 𝑘𝑛−1 )) ∙ 𝑓(𝐿(𝑘0 , 𝑘1 , … , 𝑘𝑛−1 ))
𝑧2 ∙ 𝑔(𝐿2 (𝑘0 , 𝑘1 , … , 𝑘𝑛−1 )) = 𝑔(𝐿2 (𝑘0 , 𝑘1 , … , 𝑘𝑛−1 )) ∙ 𝑓(𝐿2 (𝑘0 , 𝑘1 , … , 𝑘𝑛−1 ))
⋮
𝑧𝑡 ∙ 𝑔(𝐿𝑡 (𝑘0 , 𝑘1 , … , 𝑘𝑛−1 )) = 𝑔(𝐿𝑡 (𝑘0 , 𝑘1 , … , 𝑘𝑛−1 )) ∙ 𝑓(𝐿𝑡 (𝑘0 , 𝑘1 , … , 𝑘𝑛−1 ))
The problem reduces to three questions:
1. How do we solve the system once we have it?
2. How many known keystream bits are necessary?
3. How do we choose 𝑔?
11
Linearization
The simplest answer to the first question is the linearization technique. Recall that
Gaussian Elimination (or row reduction) is a simple and efficient method of solving systems of
linear equations. However, systems of nonlinear equations like those we have constructed
cannot be solved using Gaussian Elimination. The idea behind the linearization technique, as the
name implies, is to transform the system of nonlinear equations into a system of linear equations
in order to apply Gaussian elimination. To do so, simply replace every nonlinear monomial in
the equation with a new, symbolic linear value. Then, solve the system using Gaussian
elimination.
Recall also that Gaussian elimination requires at least as many equations as there are
variables. This fact motivates the answer to question two. Let m be the number of known
keystream bits and R the number of nonlinear equations of degree d (and on n variables) that the
m keystream bits produce. We wish to find a bound for m. Note that in the attack overview, 𝑅 =
𝑚. That is, each known keystream bit produces one nonlinear equation. However, finding
multiple – say, k – different 𝑔 functions for one f allows for each keystream bit to produce k
equations. In this case, 𝑅 = 𝑘𝑚.
As noted above, the number of monomials of degree ≤ 𝑑 is 𝑁 ≈ (𝑛𝑑). So R must be ≥ 𝑁.
𝑅 = 𝑘𝑚 ≥ 𝑁
𝑛
𝑁 (𝑑 )
𝑚≥ =
𝑘
𝑘
The third question is the heart of this paper. It is the new idea that makes algebraic
attacks feasible and effective. How do we choose 𝑔? The answer is easiest to see using an
example.
Algebraic Attack on Toyocrypt
The stream cipher Toyocrypt – a submission to the Japanese Cryptrec call for
cryptographic primitives – fits the assumptions nicely. Toyocrypt uses one 128-bit LFSR with
an associated linear state update function L and nonlinear filter f. At the time of publication,
Toyocrypt was assumed secure against all know attacks, but the construction of the nonlinear
filter f proves susceptible to both S2 and S3. The nonlinear filter f is
12
62
𝑓(𝑠0 , … , 𝑠127 ) = 𝑠127 + ∑ 𝑠𝑖 𝑠𝛼𝑖 + 𝑠10 𝑠23𝑠32 𝑠42 +
𝑖=0
62
+𝑠1 𝑠2 𝑠9 𝑠12𝑠18𝑠20 𝑠23 𝑠25𝑠26 𝑠28 𝑠33𝑠38 𝑠41𝑠42 𝑠51 𝑠53𝑠59 + ∏ 𝑠𝑖
𝑖=0
with {𝛼0 , … , 𝛼62 } some permutation of the set {63, …, 125}.
The previous attack following S2 approximates f with a multivariate linear function of
degree 4 and probability 1 – 2-17. However, the attack requires 292 CPU clocks, which takes
about 9,813,705,283.5 years on a single four core 4 GHZ CPU and 9,583,696.6 years on 1024
parallel four core 4 GHZ CPU’s.
The new attack scenario S3 calls for a well-chosen function 𝑔 such that 𝑓(𝑠) ∙ 𝑔(𝑠) is of
low degree. Note that Toyocrypt’s f function has one 63 degree term, one 17 degree term, and
one 4 degree term (disregarding the low degree terms). In addition, each of the three high degree
terms are divisible by s23 and s42.
Fact: In Boolean algebra, multiplication is analogous to the and operation, whose truth table is
given below. In short, the and operation works just like multiplication over the reals because the
only two elements are 0 and 1. Note that any variable squared reduces to that variable.
Truth Table for Boolean and
1 and 1
1
1 and 0
0
0 and 1
0
0 and 0
0
12 = 1 ∙ 1 = 1
02 = 0 ∙ 0 = 0
It follows that multiplying f by the function 𝑔(𝑠) = 𝑔′ (𝑠) − 1 produces a lower degree
function 𝑓(𝑠) ∙ 𝑔(𝑠). This is because the terms that share the common factor 𝑔′ reduce back to
themselves and are subtracted off since 𝑔′2 = 𝑔′ ∙ 𝑔′ = 𝑔′ .
Starting with the general equation 𝑓(𝑠) = 𝑧𝑡 , multiply both sides by 𝑔(𝑠) = (𝑠23 − 1) to
produce 𝑓(𝑠)𝑠23 − 𝑓(𝑠) = 𝑧𝑡 (𝑠23 − 1). In this way, every monomial divisible by 𝑠23 will
cancel out, leaving an equation of degree 3 true with probability 1.
13
62
𝑓(𝑠0 , … , 𝑠127 ) ∙ 𝑠23 = 𝑠127 𝑠23 + 𝑠23 ∙ ∑ 𝑠𝑖 𝑠𝛼𝑖 + 𝑠10 𝑠23 𝑠23 𝑠32𝑠42 +
𝑖=0
62
+𝑠1 𝑠2 𝑠9 𝑠12𝑠18𝑠20 𝑠23𝑠23 𝑠25 𝑠26𝑠28 𝑠33 𝑠38𝑠41 𝑠42 𝑠51𝑠53 𝑠59 + 𝑠23 ∙ ∏ 𝑠𝑖
𝑖=0
62
𝑓(𝑠0 , … , 𝑠127 ) ∙ 𝑠23 − 𝑓(𝑠) = 𝑠127 𝑠23 + 𝑠23 ∙ ∑ 𝑠𝑖 𝑠𝛼𝑖
𝑖=0
Similarly, multiplying both sides by (𝑠42 − 1) produces another equation of degree 3.
Therefore, each of the m known keystream bits produces two low degree multivariate nonlinear
equations; 𝑘 = 2. Therefore 𝑁 ≈ (128
) = 218.38. Finally,
3
𝑚≥
𝑁 218.38
=
= 217.38
𝑘
2
This corresponds to about 20 kilobytes of memory. Finally, assuming a proper implementation
of Strassen’s algorithm for Gaussian reduction (not important here) that runs 64 operations per
CPU clock, the number of CPU clocks necessary is 7⁄64 ∙ 𝑁 log2 7 = 249. Again assuming a
single four core 4 GHZ CPU, the new approach requires 9.77 hours. 1024 parallel four core 4
GHZ CPU’s require about 34 seconds. The low number of required keystream bits m, and the
elimination of the constraint that they be consecutive, makes this attack much more attractive
and practical than any previous efforts.
Generalization
As noted before, the more 𝑔 functions that can be found for one f, the fewer known
keystream bits required to perform the attack. The attack on Toyocrypt, and other stream ciphers
like it, relies on the idea of factoring the high-degree portions of the f function to reduce the
degree. The example using Toyocrypt was simple enough to notice by inspection. However, a
method of systematizing the search for these linear dependencies is useful. The following is
from section 6 in [5].
Consider a stream cipher with n state bits and whose f function only takes advantage of a
small subset k of those n bits. In other notation, {𝑥1 , 𝑥2 , … , 𝑥𝑘 } ⊂ {𝑠0 , 𝑠1 , … , 𝑠𝑛 }. Construct the
multiset 𝐶 = 𝐴 ∪ 𝐵 as follows.
14
A is the set of all possible monomials up to degree d:
𝐴 = {1, 𝑥1 , 𝑥2 , … , 𝑥𝑛 , 𝑥1𝑥2 , … }
B is the set of all multiples of f and elements of A:
𝐵 = {𝑓(𝑥), 𝑓(𝑥) ∙ 𝑥1 , 𝑓(𝑥) ∙ 𝑥2, … , 𝑓(𝑠) ∙ 𝑥𝑛 , 𝑓(𝑠) ∙ 𝑥1𝑥2 , … }
Fact: A set of multivariate polynomials on k variables cannot dimension greater than 2𝑘 .
The set C is simply a set of all the multivariate polynomials in the 𝑥𝑖 up to degree d.
Therefore, if C contains more than 2𝑘 elements, some linear dependencies exist and some
combinations of the elements will produce the desired polynomials 𝑔. Luckily, this is always the
case.
Theorem 2: (Courtois and Meier)
Let f be any Boolean function 𝑓 ∶ 𝐺𝐹(2)𝑘 → 𝐺𝐹(2). Then there is a Boolean function
𝑔 ≠ 0 of degree at most ⌈𝑘⁄2⌉ such that 𝑓(𝑥) ∙ 𝑔(𝑥) is of degree at most ⌊𝑘⁄2⌋.
Proof: We wish to show that ∣ 𝐶 ∣ > 2𝑘 . If we let A include all monomials with degree up to
⌊𝑘⁄2⌋ and for B, multiply f by all the monomials with degree up to ⌈𝑘⁄2⌉, then:
⌈𝑘⁄2⌉
⌊𝑘⁄2⌋ ⌈𝑘⁄2⌉
𝑘
𝑖=0
𝑖=0 𝑖=0
𝑖=0
𝑘
𝑘
𝑘
𝑘
∣ 𝐶 ∣=∣ 𝐴 ∣ ∪ ∣ 𝐵 ∣ = ∑ ( ) + ∑ ∑ ( ) = ∑ ( ) + ( 𝑘 ) > 2𝑘
𝑖
𝑖
𝑖
⌊ ⁄2⌋
There are no linear dependencies in A, which means all linear dependencies are in either B itself
or in both A and B, which ensures 𝑔 ≠ 0.
15
Consequences and Conclusions
Cryptanalysis and crypto system design are two sides of the same coin. The
former imposes requirements on the latter, which in turn creates new avenues for attack in a
cyclic process. In this case, the new attack scenario presented has several implications for the
design of synchronous stream ciphers, in particular the keystream function. In principle,
algebraic attacks are possible whenever a Boolean function is used to generate the keystream,
regardless of the method of input (irregularly clocked LFSR, multiple LFSRs, alternatives to
LFSRs). However, LFSRs still offer a simple, effective way of generating a keystream.
Designers must be careful, however, to ensure that ‘good’ Boolean combining functions are truly
good.
For one, the keystream function should use a large subset of the n state bits. In other
words, k should be large. More precisely, if there exists any function 𝑔such that 𝑓 ∙ 𝑔 is of
degree < 𝑑 (the degree of f), the degree of 𝑓 ∙ 𝑔 should still be at least 6 when 𝑛 = 128. This
corresponds to an attack in about 288 operations, which is currently considered safe. Whatever
minimum degree we specify, Courtois and Meier’s theorem implies that k should be at least
double that.
Secondly, the attack on Toyocrypt implies that the function should have many varied
terms of high degree to avoid common factors. Toyocrypt does have a large k value, but the
small number of high degree terms and common factor between them allows for a factoring
approach that cuts the degree of the keystream function from 6 to 3.
In addition, some stream ciphers attempt to add confusion to the encryption by using
multiple filtering functions 𝑓𝑖 . This scenario is analogous to the single f scenarios discussed in
this paper when the 𝑓, 𝑓 ∘ 𝐿, 𝑓 ∘ 𝐿2 , … are considered multiple different functions. In general, the
condition imposed by this algebraic approach is that there should be no non-trivial low degree
relationships between the key bits and the keystream bits.
16
References
1. Douglas R. Stinson: Crytography: Theory and Practice (3rd edition), Chapman & Hall/CRC
(2006), pp. 1.
2. Auguste Kerckhoffs: La cryptographie militaire, ou, Des chiffres usités en temps de guerre,
Paris (1883), pp. 8. Archived copy accessed on Google Play Books and translated by Google
Translate.
3. Claude E. Shannon: Communication Theory of Secrecy Systems, Bell System Technical
Journal 28 (1949), pp. 656-715.
4. Alexander Maximov: Some Words on Crptanalysis of Stream Ciphers, PhD thesis, Lund
University (2006).
5. Nicolas Courtois and Willi Meier: Algebraic Attacks on Stream Ciphers with Linear
Feedback, Eurocrypt 2003, Warsaw, Poland, LNCS 2656, pp. 345-359, Springer. An extended
version is available at http://www.minrank.org/toyolili.pdf
17