Grain 128a
The Grain 128a stream cipher was first purposed at Symmetric Key Encryption Workshop (SKEW) in 2011 as an improvement of the predecessor Grain 128, which added security enhancements and optional message authentication using the Encrypt & MAC approach. One of the important features of the Grain family is that the throughput can be increased at the expense of additional hardware. Grain 128a is designed by Martin Ågren, Martin Hell, Thomas Johansson and Willi Meier. Description of the cipher. Grain 128a consists of two large parts: Pre-output function and MAC. The pre-output function has an internal state size  of 256 bits, consisting of two registers of size 128 bit: NLFSR and LFSR. The MAC supports variable tag lengths w such that formula_1. The cipher uses a 128 bit key. The cipher supports two modes of operation: with or without authentication, which is configured via the supplied formula_2 such that if formula_3 then authentication of the message is enabled, and if formula_4 authentication of the message is disabled. Pre-output function. The pre-output function consists of two registers of size 128 bit: NLFSR (formula_5) and LFSR (formula_6) along with 2 feedback polynomials formula_7 and formula_8 and a boolean  function formula_9. formula_10 formula_11 formula_12 In addition to the feedback polynomials, the update functions for the NLFSR and the LFSR are: formula_13 formula_14 The pre-output stream (formula_15) is defined as: formula_16 Initialisation. Upon initialisation we define an formula_17 of 96 bit, where the formula_2 dictates the mode of operation. The LFSR is initialised as: formula_19 for formula_20 formula_21 for formula_22 formula_23 The last 0 bit ensures that similar key-IV pairs "do not" produce shifted versions of each other. The NLFSR is initialised by copying the entire 128 bit key (formula_24) into the NLFSR: formula_25 for formula_26 Start up  clocking. Before the pre-output function can begin to output its pre-output stream it has to be clocked 256 times to warm up, during this stage the pre-output stream is fed into the feedback polynomials formula_8 and formula_7. Key stream. The key stream (formula_29) and MAC functionality in Grain 128a both share the same pre-output stream (formula_15). As authentication is optional our key stream definition depends upon the formula_2. When authentication is enabled, the MAC functionality uses the first formula_32 bits (where formula_33 is the tag size) after the start up clocking to initialise. The key stream  is then assigned every other bit due to the shared pre-output stream. If authentication is enabled: formula_34 If authentication is disabled: formula_35 MAC. Grain 128a supports tags of size formula_33 up to 32 bit, to do this 2 registers of size formula_33 is used, a shift register(formula_38) and an accumulator(formula_39). To create a tag of a message formula_40 where formula_41 is the length of formula_42 as we have to set formula_43 to ensure that i.e. formula_44 and formula_45 has different tags, and also making it impossible to generate a tag that completely ignores the input from the shift register  after initialisation. For each bit formula_46 in the accumulator we at time formula_47 we denounce a bit in the accumulator as formula_48. Initialisation. When authentication is enabled Grain 128a uses the first formula_32 bits of the pre-output stream(formula_15) to initialise the shift register and the accumulator. This is done by: Shift register: formula_51 for formula_52 Accumulator: formula_53 for formula_46 Tag generation. Shift register: The shift register is fed all the odd bits of the pre-output stream(formula_15): formula_56 Accumulator: formula_57 for formula_47 Final tag. When the cipher has completed the L iterations the final tag(formula_59) is the content of  the accumulator: formula_60 for formula_61