Advanced conditional differential attack on Grain‐like stream cipher and application on Grain v1

IET Information SecurityVolume 13, Issue 2 p. 141-148 Research ArticleFree Access Advanced conditional differential attack on Grain-like stream cipher and application on Grain v1 Jun-Zhi Li, Jun-Zhi Li Zhengzhou Institute of Information Science and Technology, 62 Kexue Road, Zhengzhou, 450001 People's Republic of ChinaSearch for more papers by this authorJie Guan, Corresponding Author Jie Guan guanjie007@163.com Zhengzhou Institute of Information Science and Technology, 62 Kexue Road, Zhengzhou, 450001 People's Republic of ChinaSearch for more papers by this author Jun-Zhi Li, Jun-Zhi Li Zhengzhou Institute of Information Science and Technology, 62 Kexue Road, Zhengzhou, 450001 People's Republic of ChinaSearch for more papers by this authorJie Guan, Corresponding Author Jie Guan guanjie007@163.com Zhengzhou Institute of Information Science and Technology, 62 Kexue Road, Zhengzhou, 450001 People's Republic of ChinaSearch for more papers by this author First published: 01 March 2019 https://doi.org/10.1049/iet-ifs.2018.5180Citations: 1AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract Conditional differential attacks against non-linear feedback shift register based cryptosystems were proposed by Knellwolf et al. at Asiacrypt 2010. In this study, the authors propose an advanced conditional differential attack on Grain-like stream cipher. They trace propagations of a single bit difference of internal states both inversely and forward. Methods of both searching for the longest inverse difference characteristic with probability one and deriving initial value (IV) conditions with the max inverse round are introduced. When tracing forward, conditions are imposed to limit the propagation of difference to obtain a high bias. Conditions of the proposed method are only imposed on IV bits and the proposed attack works in the single-key setting. Moreover, a method of recovering key expressions as well as bias-complexity-success probability target is presented in this study. Using the proposed method, the authors conduct a key recovery attack on 114-round Grain v1, recovering 6 key expressions with the time complexity of 232, which is also verified by experiments. With more conditions imposed, this attack can be improved to Grain v1 of 120 rounds, recovering 12 key expressions with the time complexity of 242.75 and theoretical success probability of about 93%, which is ten rounds longer than the longest previous result of Grain v1 in the single-key setting. 1 Introduction Conditional differential attacks (CDAs) against non-linear feedback shift register (NFSR) based cryptosystems were first proposed by Knellwolf et al. at Asiacrypt 2010 [1]. This method has been successfully used to analyse Grain v1 [1], Trivium [2] and KATAN [2]. CDA can be classified into two categories according to the means of deducing the probability. One kind of CDA only focuses on forward propagation of difference, such as [3-7]. Another kind of CDA concentrates on both inverse and forward propagation of difference, such as [8-10]. As differences quickly spread into keys, this method always works in the related-key setting or weak-key setting. In [8], Zhang et al. proposed an improved CDA of this type, without concerning the attack setting. In [9], Knellwolf conducted this method in the related-key setting. Recently, Watanabe et al. [10] improved this technique to work in the weak-key setting. Grain-like stream cipher is a family of stream ciphers with the similar structure as Grain v1 [11]. Grain-like stream cipher consists of a linear feedback shift register (LFSR), a NFSR and a filter function. Grain v1, Grain 128 [12] and Grain 128a [13] are typical Grain-like stream ciphers, among which Grain v1 is the main research subject of this paper. Grain v1 is one of eSTREAM [14] hardware-oriented finalists proposed by Hell, Johansson and Meier in 2005. So far, several cryptanalytic results against Grain v1 have been proposed such as CDA [3-5], dynamic cube attack [6, 15], related-key chosen initial value (IV) attack [16], near collision attack [17], differential fault attack [18, 19] and internal state recovery attack [20, 21]. We give some CDA results on Grain v1 in this paper. CDA has been widely used for reduced round Grain v1. In [1], Knellwolf et al. gave distinguishing and key recovery attacks for 97 rounds and extended the attack to 104 rounds with complexity of 235 and advantage of about 0.45. However, results of [1] are only based on experiments. Then Banik provided a theoretical framework to prove the biases of 97 rounds in [3]. Describing CDA as dynamic cube attack, Banik further attacked Grain v1 to 105 rounds and recovered six key expressions with complexity of O (234) and successful probability of about 92% in [6]. Later, Sarkar presented a new distinguisher of 106-round Grain v1 using the similar approach with complexity of O (230) and advantage of about 0.63 in [4]. However, this work could not recover key expressions due to the lack of free IV variables. In [5], Ma et al. improved CDA on Grain v1 to 110 rounds with complexity of O (247). As they focused on highly saving IV, it required to guess more key expressions, leading to larger complexity. In [10], Watanabe et al. showed conditional differential distinguisher on Grain v1 up to 114 rounds in O (240) weak key subspace. In [9], Knellwolf presented a related-key CDA on 133-round Grain v1 with complexity of O (235). In this paper, we propose an advanced CDA on Grain-like stream cipher in the following aspects. Starting from a single bit difference of the internal states, propagations of difference are traced both inversely and forward. When tracing inversely, conditions of IVs are imposed to obtain the longest difference trail with initial difference only involving IV bits. When tracing forward, conditions are imposed to limit the propagation of difference to obtain a high bias of the keystream output. Conditions of our method are only imposed on IV bits. So our attack works in the single-key setting, which is more feasible than previous similar attacks. Moreover, a method for recovering key expressions as well as bias-complexity-success probability target is presented in this paper. By applying our method, a distinguishing and key recovery attack is conducted on 114-round Grain v1, recovering 6 key expressions with time complexity of , data complexity of and theoretical success probability of about 96%. Experiments verify our attack that can recover key expressions in 17.6 min on personal PC with success rate of about 97%. With more conditions imposed, this attack can be improved to Grain v1 of 120 rounds, recovering 12 key expressions with time complexity of 242.75, data complexity of 229.75 and theoretical success probability of about 93%. The memory complexity of the two attacks is negligible. Our result, which is ten rounds longer than the previous results, is the longest rounds attack on reduced Grain v1 in the single-key setting. Table 1 summarises previous results of CDAs on Grain v1. Table 1. Results of CDA on Grain v1 Rounds Attack setting Type of attack Time complexity Data complexity Reference 104 single-key distinguishing and recovery (15 key expressions) O (240) O (225) [5] 105 single-key distinguishing and recovery (6 key expressions) O (235) O (228) [6] 106 single-key distinguishing only O (230) O (224) [4] 107 single-key distinguishing and recovery (12 key expressions) O (242) O (230) [5] 110 single-key distinguishing and recovery (15 key expressions) O (247) O (231) [5] 114 40 bits weak-key distinguishing and recovery (1 key bit) O (233) O (232) [10] 114 single-key distinguishing and recovery (6 key expressions) O (232) O (226) Section 4.1 120 single-key distinguishing and recovery (12 key expressions) O (242.75) O (229.75) Section 4.2 133 2 related-keys distinguishing and recovery (8 key expressions) O (235) O (227) [9] The italic words are used to emphasise that the attacks settings of these two attacks are different with other attacks in this table. The bold words are used to emphasise that these two results are first reported in this paper. This paper is organised as follows. The description of Grain-like stream cipher and differential engine of Grain-like stream cipher are presented in Section 2. Section 3 provides our advanced CDA on Grain-like stream cipher. Section 4 presents our attacks on Grain v1 of 114 and 120 rounds. Then we conclude our paper in Section 5. 2 Preliminaries 2.1 Notations : addition modulo 2; : t th bit of x; : Hamming weight of vector X. Differential forms of x and corresponding notations: 0: x is constant 0; 1: x is constant 1; : with probability 1; : with probability 1; : with probability p, . : LFSR internal states of i th clock; : NFSR internal states of i th clock. : differential engine of Grain-like stream cipher. Notations of parameters of Algorithm 1: : inverse round; : characteristic corresponding to and , where ; : difference in LFSR of inverse round; : max inverse round; : characteristic corresponding to and , where ; : difference in LFSR of the max inverse round. 2.2 Description of Grain v1 Grain v1 uses an 80-bit secret key and a 64-bit IV and has a compact structure. It consists of an 80-bit NFSR, an 80-bit LFSR and a filter function combined the two registers. The registers are filled by key and IV bits as follows: The update function of LFSR is and the update function of NFSR is (1)The keystream generating function is where and h is a function of degree 3 defined as (2)The cipher outputs keystream after the initialisation phase. During the initialisation phase, the cipher is clocked 160 times without outputting keystream. Instead, the output is xored feedback in both the LFSR and NFSR. Figs. 1 and 2 show the structure of Grain v1. Fig. 1Open in figure viewerPowerPoint Overview of Grain v1's initialisation algorithm Fig. 2Open in figure viewerPowerPoint Overview of Grain v1's keystream generation algorithm In this paper, Grain v1 reduced to r rounds means the cipher outputs keystream after r clocks feedback and the first keystream bit is . 2.3 Description of Grain-like stream cipher Grain-like stream cipher consists of two FSRs, a LFSR of n bits and a NFSR of m bits. The LFSR is used to control the NFSR. The update function of LFSR is defined as The update function of NFSR is defined as where only contribute linearly. The keystream generating function is defined as At the beginning of the initialisation stage, the LFSR is filled by IV bits and the NFSR is filled by key bits. In the initialisation stage, the cipher does not output keystream instead of xoring it to LFSR and NFSR. So the update function of LFSR in the initialisation stage is The update function of NFSR in the initialisation stage is 2.4 Differential engine of Grain-like stream cipher In CDA, the first information that cryptanalyst should obtain is how the differences propagate in the internal states. In order to eliminate , the exact differences of the internal states used to compute must be obtained. So far, several methods are proposed to solve this problem. In [3], Banik presented a differential engine to track the differential trails of Grain family. In [5], Ma et al. improved the differential engine by considering the constant situation that missed by Banik. In this section, we introduce the differential engine of Grain-like stream cipher considering constant. There are several differential forms for the difference of state bits. Differential forms of x and the corresponding notes are given in Section 2.1 [22]. Then, the xor operation between differential forms is defined in Table 2. Table 2. Xor operation between differential forms 0 1 0 0 1 1 1 0 Without loss of generality, suppose , where only contribute linearly. The differential form of a Boolean function f is Df that is determined as follows. If there are constants in , we substitute the constant variables with their value and rearrange function f to the form , where only contribute linearly and no constant is in . Then, compute and . Now, suppose there is no constant in , according to Table 2, Df could be computed as follows: (i) If , leading to or leading to , then . (ii) If situation (i) does not happen, then , where means the differential form of . 3 Advanced CDA on Grain-like stream cipher The main idea of advanced CDA on Grain-like stream cipher is as follows: starting from a single bit difference of the internal states, propagations of difference are traced both inversely and forward. When tracing inversely, conditions of IVs are imposed to obtain a difference characteristic as long as possible with the initial difference only involving IV bits. In this step, conditions are set to keep the difference from affecting NFSR. So the initial difference does not involve key bits. When tracing forward, conditions are imposed to limit the propagation of difference to obtain a high bias of the keystream. Then, a method for recovering key expressions as well as bias-complexity-success probability target is presented in this section. 3.1 Inverse technique The main steps of the inverse technique are given below: Step 1: Compute the inverse function. The inverse update function of Grain-like stream cipher is given below. The inverse keystream generating function is The inverse update function of LFSR is The inverse update function of NFSR is Step 2: Search for the longest inverse difference characteristic which starts from a single bit difference and matches the search principle. Starting from a single bit difference in LFSR, is used inversely to track the inverse difference propagation. Then, we search for the characteristic that keeps no difference in NFSR and can be derived as many rounds as possible with the probability as high as possible. Step 2 only focus on the longest characteristics and the corresponding IV conditions are handled in Step 3. This paper only considers the inverse difference characteristic with probability one. The algorithm of searching for the longest inverse difference characteristic of given input with probability one is presented in Algorithm 1 with the notations given in Section 2.1. With the input (, , , , , ), Algorithm 1 recursively computes the max inverse round, the corresponding characteristic and the initial difference in LFSR. The algorithm tries every possible value of uncertain to find the difference characteristic that can be derived as many rounds as possible. Then, for all single bit differences in LFSR , Algorithm 1 is run with input (, , ) to find the longest difference characteristic starting from a single bit difference in LFSR. Denote the difference starting from and inverse round. Then, the characteristic is and the initial difference in LFSR is (Fig. 3). Fig. 3Open in figure viewerPowerPoint Algorithm 1: Search for the longest inverse difference characteristic of given input with probability one Step 3: Derive IV conditions for the characteristic with the max inverse round. Suppose the initial difference in LFSR and the characteristic have been obtained. We need to derive the IV conditions to satisfy the characteristic. The method of computing conditions to set uncertain to certain difference or is presented below. Without loss of generality, suppose there are IV bits in with difference , denoted as . Regarding as the difference of round 0, the expression of for key and IV bits is computed and transformed to the form: where is a vector of dimension and is the i th bit of t. is defined as and . Every is a function independent with . Denote as unit vector which the i th bit is 1 and other bits are zero. So can be transformed to If should be set to , IV conditions are set to make sure that and , where and . If should be set to , IV conditions are set to make sure that and , where and . As mentioned in [1], the conditions imposed in CDA can be classified into three types: Type 0 conditions only involve bits of IV; Type 1 conditions involve bits of IV and bits of key; Type 2 conditions only involve bits of key. Type 0 conditions can be easily controlled by setting IV bits to certain value. Type 1 conditions can be used to recover part of the key bits. The complexity will increase when imposing conditions of this type because right values of key expressions have to be guessed. Whether the Type 2 condition is satisfied depends on the specific key. If Type 2 conditions are proposed, the attack succeeds in a weak-key setting. In this paper, conditions of IV bits, which are all Type 0 and Type 1 conditions, are derived from given inverse characteristic. So the attack setting of the advanced CDA is the single key. Then, Algorithm 2 derives IV conditions for the input initial difference and inverse characteristic (Fig. 4). Fig. 4Open in figure viewerPowerPoint Algorithm 2: Deriving IV conditions for the given initial difference and characteristic With the input (, , ), the conditions of the characteristic with the max inverse round can be computed by Algorithm 2. If the algorithm failed, attackers should repeat Step 2 and Step 3 to search for the conditions of the characteristic for the max inverse round with no contradictions. After three steps above, the longest difference characteristic and corresponding conditions of only IV bits are obtained. Indeed, when these conditions are satisfied, the longest difference trail is valid with probability 1. 3.2 Forward technique Due to difference characteristics obtained by inverse technique hold with probability 1, the forward technique is important to gain a longer difference characteristic with a larger bias of keystream. However, the previous results that contain inverse process on Grain v1 did not pay enough attention on forward technique. For example, in forward process, results of [10] did not set conditions to limit the propagation of difference and results of [9] controlled only one difference of keystream. On the contrary, we are able to control two and three differences of keystream for 114-round and 120-round Grain v1, respectively. As a consequence, advanced CDA can attack Grain v1 to more rounds with larger biases. In this section, the method of setting conditions is familiar with that of Section 3.1 which the inverse update functions replaced by update functions, while the principle of setting conditions is different. Here, conditions are set to obtain good difference characteristics. The 'good difference characteristics' is defined by the principle that the difference characteristic makes no difference in the internal states as long as possible. This principle has a good performance when it is applied to Grain v1. In this paper, statistic method is used to estimate the bias of difference of keystream. With 232 keys and IVs randomly chosen, bias of difference of keystream is computed statistically with conditions set to appropriate values. Considering the accuracy of experiences, only the keystream bits which absolute value of the biases is larger than 0.0001 are recorded and used to distinguish and recover key expressions. 3.3 Method for recovering key expressions and bias-complexity-success probability target Suppose the initial difference, imposed conditions and the bias of difference of keystream have already been obtained. Then, the problem is how to distinguish and recover key expressions and how to determine the complexity and success probability. A method is introduced in this section to solve this problem. The main idea of this method is that randomly choosing enough number of IVs, the statistical bias of keystream for right guess of expressions will be obviously larger than that for wrong guess. So the right guess can be distinguished from wrong guesses. The idea is natural while the key is the relation of bias, complexity and success probability. Suppose the bias of keystream of R -round Grain-like cipher is and the key expressions needed to be guessed are . The initial difference is denoted by . A frame work of CDA is presented in Algorithm 3 and parameters of Algorithm 3 are analysed in detail below the algorithm (Fig. 5). Fig. 5Open in figure viewerPowerPoint Algorithm 3: CDA on R-round Grain-like cipher Suppose when the guesses of key expressions are wrong, the difference of R -round keystream obey random distribution. Then, Theorem 1 describes the success probability of Algorithm 3. Theorem 1.The success probability of Algorithm 3 is denoted by Ps. Then, the inequality below is true where denotes the standard normal distribution Proof.: We only consider the situation and the situation is the same for .According to realistic assumptions and Algorithm 3, the probability of zero difference of keystream for wrong and right guess is and , respectively. Suppose, in Algorithm 3, the values of counters of the wrong guess and the right guess are Cw and Cr, respectively. As 2D is large, Cw and Cr approximately obey normal distribution and , respectively.Hence, the probability of one counter of wrong guess that satisfies is Supposing Cw of different guesses are independent, the probability of every counter of wrong guess satisfies is .Then, the probability of the counter of right guess satisfies is Hence, the probability of no counter of wrong guess satisfies and at the same time the counter of right guess satisfies is When the above situation appears, Algorithm 3 will be success.Considering that there may exist the situation when some Cw satisfies but every Cw < Cr, this probability is not contained by P0 while Algorithm 3 will be success. So the success probability of Algorithm 3 is no less than . □ In this paper, apposite and Y are chosen to obtain a large . Some specific parameters of Algorithm 3 are presented in Table 3. Table 3. Some specific parameters of Algorithm 3 Ps Y D 0.000143 93% 0.000100 12 28.75 0.000240 96% 0.000151 6 27 0.000478 96% 0.000301 6 25 4 Applications on reduced Grain v1 In this section, advanced CDA is applied to reduced Grain v1. We are able to attack 114-round and 120-round Grain v1. Conditions are imposed in inverse process and forward process. Both of the attacks share the same initial difference and difference characteristic of inverse process. The detail of inverse deduction process is shown below. The inverse keystream generating function is where The inverse update function of LFSR is The inverse update function of NFSR is where Then, we use to trace the inverse difference propagation. Every single bit difference in LFSR is examined to find the difference position for the longest inverse round with no difference in NFSR. Finally, the difference is proved to lead to the longest inverse round, which is rmax = 24. The detail is as follows. According to Algorithm 1, the rounds that are i = −2, −5 and −23 and we set . The initial difference in LFSR is . Then, run Algorithm 2 with the parameters above. When i = 1, (3)So the conditions are . When i = 19 where f1 (K) is a function for only key bits. Hence, the conditions are (4) When i = 22 (5)where f2 (K) is a function for only key bits. Hence, the conditions are (6) Above all, the conditions leading to the longest differential characteristic are which are four Type 0 conditions and two Type 1 conditions. The propagations of differences are shown in Table 4. Table 4. Propagations of differences under conditions Round(i) Conditions Differences with restriction Differences without restriction 0 1 2 3–18 a 19 20 21 b 22 23 24 a We suppose J1 is satisfied and just show the conditional effect of J19. b We suppose J1, J19 are satisfied and just show the conditional effect of J22. Then, using forward technique from 24th round on, several are set to zero and the keystream bits are inspected to search for an obvious bias for as long rounds as possible. With 232 keys and IVs randomly chosen, experiments show the results below: The two probabilities are the bases of the CDA on Grain v1 of 114 rounds and 120 rounds. The details of the two attacks are presented below. 4.1 Advanced CDA on 114-round Grain v1 In this section, conditions are set to impose Δz40 = 0 and Δz44 = 0. For i = 40: The expression of Δz40 is , where F1 and F2 are functions of key and IV bits. In order to eliminate Δz40, conditions are set to impose F1 = 0 and F2 = 0. So the conditions are where f3 (K) is a function of only key bits. For i = 44: The expression of Δz44 is , where F3, F4 and F5 are functions of key and IV bits. In order to eliminate Δz44, conditions are set to impose F3 = 0 and F4 = 0. So the conditions are where f4 (K) is a function of only key bits. Rearrange J, J40 and J44. All conditions are shown as follows: (7)where (8) (9)and other are non-linear polynomials of key bits. There are 17 Type 0 conditions and 6 Type 1 conditions. The number of free IV bits is 39. Then, with the parameters R = 114, Y = 6, D = 25, , of Algorithm 3, the CDA on 114-rounds Grain v1 could recover six key expressions with success probability of about 96%. The time complexity and data complexity of this attack is and O (226), respectively. The memory complexity of this attack is negligible. For 100 random keys, experiments successfully recover all the key expressions for 97 times, which is in good agreement with Theorem 1. The experiments are running in the platform of C++ on Computer of Intel Corei5-3470 CPU @ 3.20 GHz with Windows7 OS and it takes about 17.6 min to complete for each attack. 4.2 Advanced CDA on 120-round Grain v1 With and satisfied, other conditions are set to impose Δz50 = 0. For i = 50: The expression of Δz50 is , where F6 and F7 are functions of key and IV bits. In order to eliminate Δz50, conditions are set to impose F6 = 0 and F7 = 0. So the conditions are (10)Rearrange J, J40, J44 and J50 and modify some conditions to obtain more free IVs. All conditions are shown in the following equation: (11)where (12)and other gj are non-linear polynomials of key bits. There are 23 Type 0 conditions and 12 Type 1 conditions. There are 3 special Type 0 conditions which tenable probability is 0.75, so the number of free IV bits is 28.75. Then, we substitute the parameters R = 120, Y = 12, D = 28.75, , into Algorithm 3. The advanced CDA on 120-rounds Grain v1 could recover 12 key expressions with theoretical success probability of about 93%. The time complexity and data complexity of this attack is and O (229.75), respectively. The memory complexity of this attack is negligible. The experimental complexity of full attack is beyond our capability. However, we can partly verify our attack through experiments. For 100 random keys and 228.75 pairs of chosen IVs, with the Type 2 conditions set to right values, experiments show that about 97% keys pass the test. Considering when the Type 2 conditions set to wrong values, the difference of keystream is random. Hence, the probability that all of the wrong guesses cannot pass the test is about 95.9%. The success probability of full attack is about 93%. 5 Conclusion In this paper, we propose an advanced CDA on Grain-like stream cipher. Propagations of a single bit difference of internal states are traced both inversely and forward. Methods of searching for the longest inverse difference characteristic with probability one and deriving IV conditions for the characteristic with the max inverse round are introduced. When tracing forward, conditions are imposed to limit the propagation of difference to obtain a high bias of keystream. Unlike previous attacks of weak-key or the related-key setting, our attack works in the single-key setting. Moreover, a method for recovering key expressions as well as bias-complexity-success probability target is presented in this paper. Applying our method, a distinguishing and key recovery attack is conducted on 114-round Grain v1 with a high success probability and verified by experiments. With more conditions imposed, this attack can be improved to Grain v1 of 120 rounds. Based on the advanced CDAs in Sections 4.1 and 4.2, the recoveries of the full keys on Grain v1 with 114 and 120 initialisation rounds are faster than exhaustive searches by a factor of 26 and 212. Due to the unobvious bias of keystream and the lack of free IV bits, we think the full Grain v1 could resist advanced CDA. Hopefully, advanced CDA could be combined with other techniques and used to attack Grain v1 for more rounds and even other NFSR based cryptosystems, which is one of our future work. 6 Acknowledgments This work is supported by the National Natural Science Foundations of China under grant nos. 61572516, 61602514 and 61272488. 7 References 1Knellwolf, S., Meier, W., Naya-Plasencia, M.: 'Conditional differential cryptanalysis of NLFSR-based cryptosystems'. Advances in Cryptology – ASIACRYPT 2010, Singapore, 5–9 December 2010, pp. 130– 145 2Knellwolf, S., Meier, W., Naya-Plasencia, M.: 'Conditional differential cryptanalysis of Trivium and KATAN'. Int. Workshop on Selected Areas in Cryptography (SAC 2011), Toronto, ON, Canada, 11–12 August 2011, pp. 200– 212 3Banik, S.: 'Some insights into differential cryptanalysis of Grain v1'. Australasian Conf. on Information Security and Privacy (ACISP 2014), Wollongong, NSW, Australia, 7–9 July 2014, pp. 34– 49 4Sarkar, S.: 'A new distinguisher on Grain v1 for 106 rounds'. Int. Conf. on Information Systems Security (ICISS 2015), Kolkata, India, 16–20 December 2015, pp. 334– 344 5Ma, Z., Tian, T., Qi, W.F.: 'Improved conditional differential attacks on Grain v1', IET Inf. Sec., 2017, 11, (1), pp. 46– 53 6Banik, S.: 'Dynamic cube attack on 105 round Grain v1', Appl. Stat., 2014, 34, (2), pp. 49– 50 7Ma, Z., Tian, T., Qi, W. F.: 'Conditional differential attacks on Grain-128a stream cipher', IET Inf. Sec., 2017, 11, (3), pp. 139– 145 8Zhang, K., Guan, J., Fei, X.: 'Improved conditional differential cryptanalysis', Secur. Commun. Netw., 2015, 8, (9), pp. 1801– 1811 9Knellwolf, S.: ' Cryptanalysis of hardware-oriented ciphers the Knapsack generator, and SHA-1'. PhD dissertation, ETH Zurich, 2012 10Watanabe, Y., Todo, Y., Morii, M.: 'New conditional differential cryptanalysis for NLFSR-based stream ciphers and application to Grain v1'. 2016 11th Asia Joint Conf. on Information Security (AsiaJCIS), Fukuoka, Japan, 2016, pp. 115– 123 11Hell, M., Johansson, T., Meier, W.: 'Grain: a stream cipher for constrained environments', Int. J. Wireless Mob. Comput., 2007, 2, (1), pp. 86– 93 12Hell, M., Johansson, T., Maximov, A. et al: 'A stream cipher proposal: Grain-128'. 2006 IEEE Int. Symp. on Information Theory, Seattle, WA, USA, 2006, pp. 1614– 1618 13Gren, M., Hell, M., Johansson, T. et al: 'Grain-128a: a new version of Grain-128 with optional authentication', Int. J. Wirel. Mob. Comput., 2011, 5, (1), pp. 48– 59 14Robshaw, M.: ' The eSTREAM project', in M. Robshaw, O. Billet (Eds.): ' New stream cipher designs: the eSTREAM finalists' ( Springer Berlin Heidelberg, Berlin, Heidelberg, 2008), pp. 1– 6 15Rahimi, M., Barmshory, M., Mansouri, M.H. et al: 'Dynamic cube attack on Grain-v1', IET Inf. Sec., 2013, 10, (4), pp. 165– 172 16Lee, Y., Jeong, K., Sung, J. et al: 'Related-key chosen IV attacks on Grain-v1 and Grain-128'. Australasian Conf. on Information Security and Privacy (ACISP 2008), Wollongong, Australia, 7–9 July 2008, pp. 321– 335 17Zhang, B., Li, Z., Feng, D. et al: 'Near collision attack on the Grain v1 stream cipher'. Int. Workshop on Fast Software Encryption (FSE 2013), Singapore, 11–13 March 2013, pp. 518– 538 18Banik, S., Maitra, S., Sarkar, S.: 'A differential fault attack on the grain family of stream ciphers'. CHES 2012: 14th Int. Workshop, Leuven, Belgium, 9–12 September 2012, pp. 122– 139 19Sarkar, S., Banik, S., Maitra, S.: 'Differential fault attack against grain family with very few faults and minimal assumptions', IEEE Trans. Comput., 2015, 64, (6), pp. 1647– 1657 20Mihaljević, M.J., Gangopadhyay, S., Paul, G. et al: 'Internal state recovery of Grain-v1 employing normality order of the filter function', IET Inf. Sec., 2012, 6, (2), pp. 55– 64 21Zhen, M., Tian, T., Wenfeng, Q.: 'Internal state recovery of Grain v1 employing guess-and-determine attack', IET Inf. Sec., 2017, 11, (6), pp. 363– 368 22Zhang, K.: ' Research on the security evaluation against mixed operation based cipher model'. PhD dissertation, Information Engineering University, 2016 Citing Literature Volume13, Issue2March 2019Pages 141-148 FiguresReferencesRelatedInformation