The low degree relation for algebraic attacks on E0 combiner given in \cite{DBLP:conf/crypto/ArmknechtK03}
had an error. The correct version of low degree relation for the E0 combiner for use in algebraic attack is given

N.  Rajesh Pillai

Roopika Chaudhary

S.  S.  Bedi

Sanjay Kumar

Cryptology ePrint Archive

Relation for Algebraic Attack on E0 combinerN. Rajesh Pillai, S. S. Bedi, Sanjay Kumar, Roopika ChaudharyAbstractThe low degree relation for algebraic attacks on E0 combiner given in[1] had an error. The correct version of low degree relation for the E0combiner for use in algebraic attack is given.1 IntroductionIn this article, equation for algebraic attack for the E0 cipher (a stream cipherused in Bluetooth) is computed. A brief description of the cipher is givenfollowed by description of the results obtained by us by applying our attack.2 Description of E0The E0 stream cipher has 4 LFSRs and a combiner with 4-bit memory whichtakes 4 input bits and produces 1 output bit. The registers are of length 25,31, 33 and 39 respectively adding up to 128 bits. Let (xt1, xt2, xt2, xt4) denotethe 4 LFSR outputs which are inputs to the combiner at time t and let St =(qt, pt, qt−1, pt−1) denote the combiner state at time t. The output bit zt andthe new combiner state St+1 are given as follows.zt = xt1 ⊕ xt2 ⊕ xt3 ⊕ xt4 ⊕ ptSt+1 = (qt+1, pt+1, qt, pt)whereqt+1 = st+11 ⊕ qt ⊕ pt−1pt+1 = st+10 ⊕ qt−1 ⊕ pt ⊕ pt−1(st+11 , st+10 ) = bxt1 + xt2 + xt3 + xt4 + 2qt + pt2c3 Algebraic Relation for the E0 combinerThe Theorem by Krause and Armknecht says that a relation of degree 10 in-volving 5 sets of consecutive inputs will always exist for E0. The complexity ofthe attack with a 10 degree relation will be more than exhaustive trials of allkeys. So finding low degree equations is required. Armknecht and Krause [1]1derived the following low degree relation by symbolic manipulations.0 = 1⊕ zt−1 ⊕ zt ⊕ zt+1 ⊕ zt+2⊕ π1(t)(ztzt+2 ⊕ ztzt+1 ⊕ ztzt−1 ⊕ zt−1 ⊕ zt+1 ⊕ zt+2 ⊕ 1)⊕ π2(t)(1⊕ zt−1 ⊕ zt ⊕ zt+1 ⊕ zt+2)⊕ π3(t)zt ⊕ π4(t)⊕ π1(t− 1)⊕ π1(t− 1)π1(t)(1⊕ zt)⊕ π1(t− 1)π2(t)⊕ π1(t+ 1)zt+1 ⊕ π1(t+ 1)π1(t)zt+1(1⊕ zt)⊕ π1(t+ 1)π2(t)zt+1⊕ π2(t+ 1)⊕ π2(t+ 1)π1(t)(1⊕ zt)⊕ π2(t+ 1)π2(t)⊕ π1(t+ 2)⊕ π1(t+ 2)π1(t)(1⊕ zt)⊕ π1(t+ 2)π2(t)(1)where πi(t) denotes the symmetric function of degree i on xt1, xt2, xt2, xt4, theinput variables at time t.The algebraic equation for the E0 combiner was computed using an opti-mized implementation of the algorithm in [2]. The expression obtained by us isgiven below.0 = zt−1 ⊕ zt ⊕ zt+1 ⊕ zt+2⊕ π1(t)(zt−1 ⊕ zt ⊕ zt+1 ⊕ zt+2 ⊕ ztzt+1 ⊕ ztzt+2 ⊕ ztzt−1)⊕ π2(t)(zt−1 ⊕ zt ⊕ zt+1 ⊕ zt+2)⊕ π3(t)zt ⊕ π4(t)⊕ π1(t− 1)⊕ π1(t− 1)π1(t)(1⊕ zt)⊕ π1(t− 1)π2(t)⊕ π1(t+ 1)zt+1 ⊕ π1(t+ 1)π1(t)zt+1(1⊕ zt)⊕ π1(t+ 1)π2(t)zt+1⊕ π2(t+ 1)⊕ π2(t+ 1)π1(t)(1⊕ zt)⊕ π2(t+ 1)π2(t)⊕ π1(t+ 2)⊕ π1(t+ 2)π1(t)(1⊕ zt)⊕ π1(t+ 2)π2(t)(2)It was observed that the low degree relation (2) obtained by us was differentfrom (1) by few terms. The xor of the two expressions is 1+π1(t)(1+zt)+π2(t)We could obtain the same expression by following the symbolic manipulationsindicated in [1] also.4 VerificationFor verification of the correctness the expressions, the relations were evaluatedfor all possible input-output pairs generated by the E0 combiner. Outputs offour consecutive time steps of the E0 combiner for all the 24∗4 = 216 possiblecombinations of input bits and for all the 24 possible choices for memory bitswere computed. Correct relations should hold for all the 220 input-output pairs.The equation (2) was holding for all the 220 pairs where as equation (1) wasnot holding for 393216 of the 220 cases. In hindsight the fact that the expression(1)was incorrect could have been easily detected by checking on the case whereall inputs and initial memory is zero.The new relation (2) was used to successfully recover the initial contents inalgebraic attacks against variants of E0 with shorter LFSRs and in algebraicattack on E0 itself when 56 bits of LFSR 1 and LFSR 2 were assumed to beknown and remaining 72 unknown.2AcknowledgementsThe authors wish to thank Dr. P. K. Saxena, Director SAG, for his supportand encouragement for the work.References[1] F. Armknecht and M. Krause. Algebraic attacks on combiners with memory.In D. Boneh, editor, CRYPTO, volume 2729 of Lecture Notes in ComputerScience, pages 162–175. Springer, 2003.[2] N. Courtois. Algebraic attacks on combiners with memory and several out-puts. In C. Park and S. Chee, editors, ICISC, volume 3506 of Lecture Notesin Computer Science, pages 3–20. Springer, 2004.3

Relation for Algebraic Attack on E0 combiner

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive