Some observations on HC-128
In this paper, we study HC-128 in detail from cryptanalytic point of view. First, we use linear approximation of the addition modulo 2 (n) of three n-bit integers to identify linear approximations of g (1), g (2), the feedback functions of HC-128. This, in turn, shows that the process of keystream output generation of HC-128 can be well approximated by linear functions. In this direction, we show that the "least significant bit" based distinguisher (presented by the designer himself) of HC-128 works for the complete 32-bit word. Using the above linear approximations of g (1), g (2), we present a new distinguisher for HC-128 which is slightly weaker than Wu's distinguisher. Finally, in the line of Dunkelman's observation, we also study how HC-128 keystream words leak secret state information of the cipher due to the properties of the functions h (1), h (2) and present improved results.
linear approximation keystream bias cryptography distinguishing attack estream stream cipher