1. Differential Distinguishing Attack of Shannon Stream Cipher Mehdi Hassanzadeh University of Bergen Selmer Center, Norway Mehdi.hassanzadeh@ii.uib.no Yaser Esmaeili Elham Shakour Zaeim Electronic Ind. R&D Department {yesmaeili, shakour}@zaeim.co.ir

2. Differential Distinguishing Attack of Shannon Stream Cipher Hassanzadeh Cryptology2008, Malaysia 2/16 Outline Introduction Description of the Shannon Differential Properties of the f 2 Function Our Differential Distinguishing Attack Conclusion

3. Differential Distinguishing Attack of Shannon Stream Cipher Hassanzadeh Cryptology2008, Malaysia 3/16 Introduction The Shannon stream cipher was proposed by Philip Hawkes et al. for Ecrypt/eStream competitive. An entirely new design, influenced by members of the SOBER family of stream ciphers. Designed for a software- efficient algorithm up to 256 bits key length 32-bit words based based on a single NLFSR and a NLF

4. Differential Distinguishing Attack of Shannon Stream Cipher Hassanzadeh Cryptology2008, Malaysia 4/16 A Brief Description The Shannon algorithm consists of two parts: Key loading key generation

5. Differential Distinguishing Attack of Shannon Stream Cipher Hassanzadeh Cryptology2008, Malaysia 5/16 Keystream Generation Mode 1) r t+1 [i] ← r t [i+1] for i = 1...14 2) r t+1 [15] ← f 1 (r t [12]  r t [13]  Konst)  (r t [0] <<<1) 3) temp ← f 2 (r t+1 [2]  r t+1 [15]) 4) r t+1 [0]← r t [1]  temp(“feed forward” to the new lowest element ) 5) v t ← temp  r t+1 [8]  r t+1 [12].

6. Differential Distinguishing Attack of Shannon Stream Cipher Hassanzadeh Cryptology2008, Malaysia 6/16 f Function f : (A,B,C,D are fixed numbers) t ← w  ((w <<< A) | (w <<< B)) f(w) = t  (( t <<< C) | (t <<< D)) f 1 : (A,B,C,D)=(5,7,19,22) f 2 : (A,B,C,D)=(7,22,5,19)

7. Differential Distinguishing Attack of Shannon Stream Cipher Hassanzadeh Cryptology2008, Malaysia 7/16 Differential Analysis for Stream Ciphers A differential of a stream cipher is a prediction that a given input difference (it can be the key, IV or internal state) produce some output difference (it can be the keystream or internal state)

8. Differential Distinguishing Attack of Shannon Stream Cipher Hassanzadeh Cryptology2008, Malaysia 8/16 Suppose that 31st bit of input is activated.  W, W  31 9 bits of output from f 2 function will be impressed by  31 The output differential of f 2 function is determined bit by bit. Differential Property of f 2

9. Differential Distinguishing Attack of Shannon Stream Cipher Hassanzadeh Cryptology2008, Malaysia 9/16 Differential Property of f 2 Theoretically: Shannon is a RNG, therefore the output bits of the Shannon are independent The output is generated by the output of f 2 function the differential output bits of f 2 function are 32 bit word  M (i.e. 0x80000000 from Table ) with the probability of

10. Differential Distinguishing Attack of Shannon Stream Cipher Hassanzadeh Cryptology2008, Malaysia 10/16 IS IS‘=IS  v t  v' t =∆t v t, v' t TRNG Repeat for N times Attack Scenario

11. Differential Distinguishing Attack of Shannon Stream Cipher Hassanzadeh Cryptology2008, Malaysia 11/16 Differential properties of the output N differential outputs are generated by black box (scenario is repeated N times) In each repeatation, 9th output word is exracted. A sequence consisting of N 32-bit differential words is provided (O 9 ) IS‘[11]=IS [11]   31

12. Differential Distinguishing Attack of Shannon Stream Cipher Hassanzadeh Cryptology2008, Malaysia 12/16 Hypotheses Test Two hypotheses for O 9 :

13. Differential Distinguishing Attack of Shannon Stream Cipher Hassanzadeh Cryptology2008, Malaysia 13/16 Our Differential Distinguishing Attack By using of frequency test, we can distinguish the sequance O 9 (T= number of 0x80000000) If T≥10 => generated by the Shannon If T was NOT generated by the Shannon The probability of error is 10 -3 We need N=2 8.92 words in sequence O 9

14. Differential Distinguishing Attack of Shannon Stream Cipher Hassanzadeh Cryptology2008, Malaysia 14/16 Complexity We need N=2 8.92 words in sequence O 9 Then we need to run the Shannon 2*N=2*2 8.92 times Then, the computational complexity is equal to O(2 9.92 )

15. Differential Distinguishing Attack of Shannon Stream Cipher Hassanzadeh Cryptology2008, Malaysia 15/16 Conclusion We showed that the keystream generator part of the Shannon stream cipher is not strong. It should be replaced by stronger one. The Key loading part is strong.