This paper presents the first comprehensive algebraic cryptanalysis of Trivium-LE, an energy-efficient variant of the Trivium stream cipher, with a specific focus on its resistance to cube attacks. As energy-optimal alternatives to Trivium, Trivium-LE is offered in two versions: Trivium-LE(F), with 15% energy savings, and Trivium-LE(S), with a 25% reduction. First, we model the complete structure of Trivium-LE using MILP-based monomial prediction to perform a security evaluation. This approach provides a more precise estimation of Trivium-LE’s algebraic degree compared to its original design document. Our analysis reveals a more accurate characterization of how the algebraic degree evolves as the number of rounds increases. Second, we conduct the first key-recovery cube attacks against Trivium-LE, targeting the more secure Trivium-LE(F) variant by recovering its superpolys through monomial prediction. For the 770-round Trivium-LE(F) cube attack, we identify 17 distinct cubes corresponding to different superpolys, with a total attack complexity of \(2^{67.7}\) . For 775-round, we find 10 cubes to launch cube attack, with the overall attack complexity to \(2^{73.4}\) approximately. For 776-round, the cube attack utilizing 5 recovered superpolys requires \(2^{77.6}\) complexity. To the best of our knowledge, this is the first cube attack against round-reduced Trivium-LE, offering new insights into its resistance against algebraic attacks.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Algebraic Cryptanalysis on Reduced-Round Trivium-LE

  • Zhenguo Yan,
  • Zhiyu Zhang,
  • Shuai Chang,
  • Lei Hu

摘要

This paper presents the first comprehensive algebraic cryptanalysis of Trivium-LE, an energy-efficient variant of the Trivium stream cipher, with a specific focus on its resistance to cube attacks. As energy-optimal alternatives to Trivium, Trivium-LE is offered in two versions: Trivium-LE(F), with 15% energy savings, and Trivium-LE(S), with a 25% reduction. First, we model the complete structure of Trivium-LE using MILP-based monomial prediction to perform a security evaluation. This approach provides a more precise estimation of Trivium-LE’s algebraic degree compared to its original design document. Our analysis reveals a more accurate characterization of how the algebraic degree evolves as the number of rounds increases. Second, we conduct the first key-recovery cube attacks against Trivium-LE, targeting the more secure Trivium-LE(F) variant by recovering its superpolys through monomial prediction. For the 770-round Trivium-LE(F) cube attack, we identify 17 distinct cubes corresponding to different superpolys, with a total attack complexity of \(2^{67.7}\) . For 775-round, we find 10 cubes to launch cube attack, with the overall attack complexity to \(2^{73.4}\) approximately. For 776-round, the cube attack utilizing 5 recovered superpolys requires \(2^{77.6}\) complexity. To the best of our knowledge, this is the first cube attack against round-reduced Trivium-LE, offering new insights into its resistance against algebraic attacks.