# Quantum Time-Memory-Data Tradeoff Attacks on the SNOW-V Stream Cipher
## 1 Introduction  
Starting with the GSM (Global System for Mobile Communication) system, which employs the A5-1 stream cipher [1], symmetric cryptosystems (i.e., stream ciphers and block ciphers) have always played an important role in securing the various generations of 3 GPP (3 rd Generation Partnership Project) mobile telephony systems. The block cipher KASUMI [2] is the heart of 3 GPP confidentiality algorithm f8 and 3 GPP integrity algorithm f9. SNOW 3G [3] is a stream cipher used by the 3 GPP standards, as the core part of the confidentiality and integrity algorithms for the UMTS (Universal Mobile Telecommunications System) and LTE (Long Term Evolution) networks. The stream cipher ZUC [4] forms the core component in 3 GPP confidentiality and integrity algorithms 128-EEA3 and 128-EIA3. The SNOW-V stream cipher, proposed by [PERSON], [PERSON], [PERSON] and [PERSON] [5], in November 2018, is the most recent member of the SNOW family of stream ciphers. The latest version of this stream cipher was published in September 2019 in [5], which is the focus of this analysis. The SNOW-V stream cipher follows the same design principles of its predecessors, SNOW [6], SNOW 2.0 [7] and the 3 GPP-standard stream cipher SNOW 3G [3], but introduces changes that make the stream cipher more suitable for high-speed encryption in virtualized environments. The target application of the cipher is to provide confidentiality and integrity for 5G communications. In the specification of SNOW-V, the designers had given a comprehensive security analysis, including almost all known cryptanalytic techniques. The results show that SNOW-V is secure against these attacks and can provide a 256-bit security level, as claimed. **Related works. ** Up to now, some cryptanalytic results of SNOW-V have been published. In January 2020, [PERSON], [PERSON] and [PERSON] [8] proposed a byte-based guess-and-determineattack on SNOW-V, with complexity \(2^{406}\), using seven keystream blocks. Later, it was improved by [PERSON], [PERSON] and [PERSON] [9], to have a time complexity of \(2^{378}\). To make a better understanding of the design of SNOW-V, several attacks on the simplified variants of SNOW-V were published. In [9], a distinguishing attack on a simplified variant of SNOW-V, where 32-bit adders are replaced with exclusive or, was proposed with a time complexity of \(2^{303}\). At FSE 2021, [PERSON] and [PERSON] [10] gave a fast correlation attack on another simplified variant of SNOW-V, where some of the 32-bit adders are replaced with 8-bit adders, which recovers all 896 internal state bits with a time complexity of \(2^{377,01}\), requiring a memory space of \(2^{363}\) and \(2^{253,73}\) keystream outputs. In [11, 12], [PERSON], [PERSON], [PERSON], [PERSON] and [PERSON] constructed a MILP model, to search for integral characteristics using the division property, and applied this search model to SNOW-V. They proposed distinguishing and key recovery attacks on the reduced-round versions of the SNOW-V stream cipher. Note that none of these attacks above threaten the security of full SNOW-V. Recently, an automatic-linear-trails search method, by solving the SMT/SAT model, was proposed for full SNOW-V, by [PERSON], [PERSON], [PERSON], [PERSON], [PERSON] and [PERSON] [13], at EUROCRYPT 2022. The authors gave a correlation attack on full SNOW-V, which recovers all 896 internal state bits with a time complexity of \(2^{246,53}\), requiring a memory space of \(2^{238,77}\) and \(2^{237,5}\) keystream outputs. Later, [PERSON], [PERSON] and [PERSON] [14] proposed an improved correlation attack on full SNOW-V, which recovers all 896 internal state bits with a time complexity of \(2^{240,86}\), requiring a memory space of \(2^{240,37}\) and \(2^{236,87}\) keystream outputs. There two attacks show that SNOW-V is vulnerable against correlation attacks and cannot offer 256-bit security. **Our contributions. ** To the best of our knowledge, there have been no time-memory-data tradeoff (TMDTO) attacks on the cipher published so far.