I am implementing in C++ the Scream stream cipher. The Scream family is composed of Scream-0, Scream-S and Scream-F. For this question, assume that I'm using Scream-S.

The specifications of the Scream cipher are given in the paper "Scream: a software-efficient stream cipher", but I didn't find a reference sourcecode for this cipher which could have helped me.

Maybe because the specs include many notations, I have some questions about the scream cipher:

  1. In section 2 about the two 2X2 matrices : Am I right to say that $x$ and $x+1$ (from the $GaloisField(256)$) are replaced respectively by $2$ and $3$?

  2. In section 3, it's possible to implement the function $F$ to optimize it. The author didn't define the multiplication ($u0 = M1(0,0) . S1[x]$). Is it a multiplication following $GF(256)$ with the polynomial $x^8 + x^7 + x^6 + x + 1$ (0x1C3) ?

  3. In the algorithm of $F$ in section 3, they write 'byte0'. Does $byte_0$ refer to the MSB or LSB of an integer ?

Since $F$ is the core of the algorithm, it's important for me to know and understand these kind of details.


1 Answer 1


I've just dived into that paper for you, with the following results:

  1. You've got that one correct.

  2. The eight-byte input is multiplied with matrix M. There is no mention or indication of the polynomial you mention. Simply follow the paper.

    The matrices are fixed [[1,2],[2,1]] and [[1,3],[1,3]]. So, 2 and 3 are NOT replaced by x. The multiplication is on GF(256) with the polynomial specified at page 4. Thus, you have to do something like this: GF256_Multiply(2, S1[x], 0x1C3) where 2 = M1(0,1) = M1(1,0) for example. That's why they call T0 and T1 "lookup tables". These are fixed tables which imply M1 and M2 are fixed too.

    (Notice: This was corrected thanks to OP's own research and the corrections OP mentioned in the comments to this answer.)

  3. I think you got a bit confused there. MSB (= Most Significant Bit) and LSB (= Least Significant Bit) define "bits", while the paper explicitly talks about "bytes" in section 3. Therefore, they did not need to define any MSB or LSB. The paper simply defines $byte_0$ (which is, reading from left to right, the leftmost byte), and $byte_3$ (which is the rightmost byte). So you practically extract the 4 bytes into $byte_0$ up to $byte_3$ from left to right (aka "first in, first out").

Hope that helps.

  • $\begingroup$ Comments are not for extended discussion; this conversation has been moved to chat. $\endgroup$
    – e-sushi
    Dec 17, 2017 at 13:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.