# A Novel Hybrid Elementary Cellular Automata and Its Application in a Stream Cipher
## 4 Stream Cipher Based on HECA-M
### Description of Proposed Stream Cipher
The GDA belongs to the known-plaintext attack, which is effective for the stream cipher. The enemy can acquire a portion of the keystream. Then, some portions of the internal state in the keystream generator can be guessed. Additionally, other portions of the internal state can be derived from this guess and the portion of the keystream. Finally, the enemy can recover the internal state of the keystream generator. Moreover, the secret key can be acquired by the enemy further. To estimate whether the proposed stream cipher can resist the GDA, the most unsecure scenarios need to be taken into account. We assume the enemy can get keystream with enough length and has acquired the iterations of HECA-M. Firstly, we assign that the keystream is generated by all the cells, including odd and even, in the driving part, though it is different from the proposed stream cipher. The length of this keystream is \(L\) bits, which is divisible by 256. Then, the enemy can easily recover the internal states of the driving part in L/256 iterations, as shown in Figure 13.

In Figure 13, \(S_{x,y}\) indicates the state value of cell \(y\)th at iteration \(x\)th. If the state groups \([S_{x,y-1},S_{x,y},S_{x,y+1}]\) in \(\mathcal{S}\) can cover all the elements in \(\{000,\,001,\,010,\,\ldots,\,111\}\), and the corresponding iterative result \(S_{x+1,y}\) is also in \(\mathcal{S}\), the enemy can acquire a state transition table as Table 10. \begin{table}
\begin{tabular}{c c c c c c c} \hline \multirow{2}{*}{512 bits} & \(p\)-value & 0.9572 & 0.9009 & 0.9427 & 0.9570 & 0.9557 \\  & Pass or Not & Pass & Pass & Pass & Pass & Pass \\ \hline \multirow{2}{*}{256 bits} & \(p\)-value & 0.9629 & 0.9576 & 0.9545 & 0.9754 & 0.9411 \\  & Pass or Not & Pass & Pass & Pass & Pass & Pass \\ \hline \end{tabular}
\end{table} 
Table 9: The \(t\)-test of the two correlation coefficients between \(\mathcal{S}\)K and \(\mathcal{K}\)S and \(\mathcal{S}\)K and \(\mathcal{T}\)RS. In Table 10, the results \(b_{7}\), \(b_{6}\), \(\ldots\), \(b_{0}\) and \(b_{7}^{*}\), \(b_{6}^{*}\), \(\ldots\), \(b_{0}^{*}\) with binary can be converted to the decimal numbers \(r\) and \(r^{*}\), which can be regarded as the rule pair (\(r0\), \(r1\)) in the LUT (Table 5). If no rule pair (\(r0\), \(r1\)) in Table 5 is equal to (\(r\), \(r^{*}\)), the enemy can switch the state values of \(b_{n}\) and \(b_{n}^{*}\) until the rule pair (\(r\), \(r^{*}\)) can be found in Table 5, where \(n\) belongs to {0, 1, 2, \(\ldots\), 7}. The total number of switches in Table 9 is \(2^{8}\), which is acceptable for the enemy to guess. Once the rule pair (\(r0\), \(r1\)) of the HECA-M is acquired, the enemy can also deduce the rule of the mask part \(rm\) easily. Furthermore, if \(b_{n}^{*}\
eq b_{n}\), the state value of the mask part can be determined. For instance, if \(S_{x,y-1}\), \(S_{x,y}\), \(S_{x,y+1}\) = 011, (\(r\), \(r^{*}\)) = (\(r0\), \(r1\)), and \(S_{x+1,y}\) = \(b_{3}\) (\(b_{3}^{*}\)), the corresponding state \(M_{x,y}\) in the mask part can be determined to be 1 (0). However, if \(b_{n}^{*}=b_{n}\), \(M_{x,y}\) is uncertain. Hence, the enemy should guess these states in the mask. Moreover, the enemy can always find an iteration in \(S\) with the least occurrence of \(b_{n}^{*}=b_{n}\). Then, guess these states of the mask part in this iteration and verify the correctness of this guess according to subsequent iterations in \(S\). Change the states of the guess until this guess is correct. Once one iteration of the mask part is recovered, the enemy can generate the subsequent keystream at any length. In conclusion, the enemy can easily crack the keystream generated by all the cells in the driving part. Fortunately, as for the proposed stream cipher, only odd (or even) cells in the driving part generate the keystream. This design can avoid the above GDA effectively. The enemy can acquire the keystream generated by the even or odd cells. Thus, the internal states of the driving part cannot be recovered completely as \(S\) in Figure 13. Only the odd or even column can be recovered.