On the probability distribution of the carry cells of stream ciphers F-FCSR-H v2 and F-FCSR-H v3

Authors:
Haixin Song;Xiubin Fan;Chuankun Wu;Dengguo Feng
Affiliations:
State Key Laboratory of Information Security, Institute of Software, Chinese Academy of Sciences, Beijing, China,Graduate University of Chinese Academy of Sciences, Beijing, China;State Key Laboratory of Information Security, Institute of Software, Chinese Academy of Sciences, Beijing, China;State Key Laboratory of Information Security, Institute of Software, Chinese Academy of Sciences, Beijing, China;State Key Laboratory of Information Security, Institute of Software, Chinese Academy of Sciences, Beijing, China
Venue:
Inscrypt'11 Proceedings of the 7th international conference on Information Security and Cryptology
Year:
2011

Citing 5
Cited 0

2-Adic Shift Registers

Fast Software Encryption, Cambridge Security Workshop
Breaking the F-FCSR-H Stream Cipher in Real Time

ASIACRYPT '08 Proceedings of the 14th International Conference on the Theory and Application of Cryptology and Information Security: Advances in Cryptology
A New Approach for FCSRs

Selected Areas in Cryptography
Periodicity and distribution properties of combined FCSR sequences

SETA'06 Proceedings of the 4th international conference on Sequences and Their Applications
Fibonacci and Galois representations of feedback-with-carry shift registers

IEEE Transactions on Information Theory

Quantified Score

Hi-index	0.00

Visualization

Abstract

F-FCSR-H v2 is one of the 8 final stream ciphers in the eSTREAM portfolio. However, it was broken by M. Hell and T. Johansson at ASIACRYPT 2008 by exploiting the bias in the carry cells of a Galois FCSR. In order to resist this attack, at SAC 2009 F. Arnault $et \ al.$ proposed the new stream cipher F-FCSR-H v3 based upon a ring FCSR. M. Hell and T. Johansson only presented experimental results but no theoretical results for the success probability of their powerful attack against F-FCSR-H v2. And so far there are no analytical results of F-FCSR-H v3. This paper discusses the probability distribution of the carry cells of F-FCSR-H v2 and F-FCSR-H v3. We build the probability model for the carry cells of the two stream ciphers and prove that the consecutive output sequence of a single carry cell is a homogeneous Markov chain and the inverse chain is also a homogeneous Markov chain. We also prove that the probability of l consecutive outputs of a single carry cell to be zeros is (1/2)·(3/4)l−1, which is a weakness of the carry cells of F-FCSR-H v2 and F-FCSR-H v3, noticing that (1/2)·(3/4)l−12−l for l1. FCSR is a finite-state automata, so its distribution is stable. Based on this fact, we construct a system of equations using the law of total probability, and present a theoretical probability of breaking F-FCSR-H v2 by solving the equations. Applying this technique to F-FCSR-H v3, we obtain that the probability of all the 82 carry cells of F-FCSR-H v3 to be zeros at the same clock is at least 2−64.29, which is much higher than 2−82. This is another weakness of the carry cells of F-FCSR-H v3. Our results provide theoretical support to M.Hell and T.Johansson's cryptanalysis of F-FCSR-H v2 and establish a theoretical foundation for further cryptanalysis of F-FCSR-H v3.