Nawaz, Gupta and Gong recently proposed a 32-bit RC4-like stream cipher. In this paper, we show that the keystream generated from their stream cipher is not random. The keystream can be distinguished from random with only about 100 outputs (3200 bits) in 2 milliseconds on Intel Centrino 1.6GHz processor

Hongjun Wu

Cryptology ePrint Archive

Cryptanalysis of a 32-bit RC4-like StreamCipherHongjun WuKatholieke Universiteit Leuven, Dept. ESAT/COSICwu.hongjun@esat.kuleuven.beAbstract. Nawaz, Gupta and Gong recently proposed a 32-bit RC4-likestream cipher. In this paper, we show that the keystream generated fromtheir stream cipher is not random. The keystream can be distinguishedfrom random with only about 100 outputs (3200 bits) in 2 millisecondson Intel Centrino 1.6GHz processor.1 IntroductionA 32-bit RC4-like stream cipher was recently proposed by Nawaz, Gupta andGong [1]. It is very efficient in software and it is claimed that its the speed isabout 3.5 times that of RC4.In the rest of this paper, we refer this cipher as NGG stream cipher. And wewill focus on the version which is fully specified, i.e., the version with 256 32-bitelements in the table.In this paper, we point out that the NGG stream cipher is very weak. Thekeystream can be distinguished from random with only about 100 outputs andnegligible amount of computation time. We will describe the NGG stream cipherin Section 2 and give our attack in Section 3.2 The Stream Cipher NGGNGG is a 32-bit RC4-like stream cipher. The table in NGG is with 256 32-bitelements. At each step, one 32-bit element is generated and one 32-bit output isupdated.We ignore the key schedule here. The keystream generation of NGG is givenbelow. (The S is a table with 256 32-bit elements. ai (0 ≤ i ≤ 255) are somerandom constants, N = 256, M = 232).i = 0j = 0iterate until enough keystream bits are generatedi = (i + 1) mod Nj = (j + S[i]) mod NSwap (S[i], S[j])output = S[(S[i] + S[j]) mod N ]S[(S[i] + S[j]) mod N ] = (S[i]+S[j]) mod M3 Distinguishing attack on the NGG stream cipherWe notice the value of each element is updated as the sum of two elements inthe table. And each output of NGG is given as an element randomly chosenfrom the table. The flaw is that if S[k] is updated as S[k] = S[i] + S[j], andif S[i], S[j], and S[k] are selected as three outputs out′i, out′j and out′k, thenout′k = out′i + out′j (Here the i′, j′ and k′ are three random numbers).In the attack, we do not know which elements are selected as outputs andtheir positions in the table and the keystream, but we are certain that for threeoutputs outx, outy and outz, the probability that outx = outy + outz wouldincrease due to the flaw indicated above.We carried out the experiment to compute the probability that outx =outy + outz . For n consecutive outputs outb, outb+1, outb+2, ... , outb+n−1,we carry out the experiment with the following pseudo code:counter1 = 0counter2 = 0for i = b to b + n− 1for j = i to b + n− 1for k = b to b + n− 1count1++;if (outk == outi + outj) count2++;The probability p = count2count1We mention here that in the above pseudo code, if i = j = k, then the valuesof counter1 and counter2 should remain unchanged. And this experiment is re-peated for a number of times with different keystream to compute the averageprobability.For n = 100, this probability is 2−18.7, which is much larger than the randomprobability 2−32. It means that once we find the first outk = outi + outj in theexperiment above, then we are almost certain that the keystream is distinguishedfrom random. And in average, for every consecutive 100 outputs, we find about1.1 cases that outx = outy +outz. It is the same as to say that with 100 outputs,we can distinguish the keystream from random with probability close to 1.Thus our attack can distinguish the output of NGG cipher from randomwith only 100 outputs. The attack requires only about 2 milliseconds on theIntel Centrino 1.6GHz processor.We note that there are some other attacks that can also be applied to dis-tinguish the keystream of NGG from random. For example, in the keystreamgeneration process given in Section 2, we do the approximation j ≈ j + i, and(output mod 256) ≈ (i + j) mod 256. The two expressions hold with chancelarger than 2−8, and it results in the probability that (outx − outx−1 − x −21)&255 = 0 larger than 2−8. We ignore the details of those attacks in this re-port.4 DiscussionThe NGG stream cipher is very weak. The attack given in this paper can dis-tinguish the keystream of NGG from random efficiently.In [1], the designers of NGG stream cipher suggested using rotation in thecipher to enhance the security of the cipher. However, that improvement fails toresist the attack given in this paper.References1. Y. Nawaz, K.C. Gupta, and G. Gong, “A 32-bit RC4-like Keystream Generator”,Available at http://eprint.iacr.org/2005/1753

Cryptanalysis of a 32-bit RC4-like Stream Cipher

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive