# Trivium example

I started learning cryptography from Understanding Cryptography book of Christof Paar and Jan Pelzl. Here is the problem I have solved but I want to be sure that it is correct.

Assume the IV(initialization vector) and the key of Trivium each consists of 80 all-zero bits. Compute the first 70 bits s1....,s70 during the warm-up phase of Trivium. Note that these are only internal bits which are not used for encryption since the warm-up phase lasts for 1152 clock cycles.

Here is my code in Python:

reg_A = [''] * 93
reg_B = [''] * 84
reg_C = [''] * 111

for i in [93, 84, 111]:
for j in range(i):
if i == 93:
reg_A[j] = 0
elif i == 84:
reg_B[j] = 0
elif i == 111:
reg_C[j] = 0

reg_C[108] = reg_C[109] = reg_C[110] = 1
for i in range(80):  # initializing key
reg_A[i] = 0
reg_B[i] = 0

stream = []
for i in range(70):
# first calculate output bits of every register
Cz = reg_C[110] ^ reg_C[65] ^ (reg_C[108] & reg_C[109])
Ax = reg_A[92] ^ reg_A[65] ^ (reg_A[90] & reg_A[91])
By = reg_B[83] ^ reg_B[68] ^ (reg_B[81] & reg_B[82])
# then calculate first bit of every register
a1 = Cz ^ reg_A[68]
b1 = Ax ^ reg_B[77]
c1 = By ^ reg_C[86]
for x in range(92, 0, -1):  # go to 1, because we already have first bit calculated
reg_A[x] = reg_A[x-1]
reg_A[0] = a1
for x in range(83, 0, -1):
reg_B[x] = reg_B[x-1]
reg_B[0] = b1
for x in range(110, 0, -1):
reg_C[x] = reg_C[x-1]
reg_C[0] = c1
stream.append(Ax ^ By ^ Cz)

print reg_A, "FINAL"
print reg_B
print reg_C

print stream, "FINAL STREAM AFTER 70 CLOCKS"


Since I have no solution I don't know how to check if I did it right. That's why I am asking here for help.

• Comments are not for extended discussion; this conversation has been moved to chat. – e-sushi Nov 14 '15 at 19:49

I have found an interesting approach to the discussion. I have developed my own version of Trivium and I have tried to solve the exercise described by Nicolas which says:

### Exercise 2.12 - Understanding Cryptography

Assume the IV and the key of Trivium each consist of 80 all-zero bits. Compute the first 70 bits s1, . . . , s70 during the warm-up phase of Trivium. Note that these are only internal bits which are not used for encryption since the warm-up phase lasts for 1152 clock cycles

The exercise mention Warm-up phase. If you read the specifications of the algorithm it has one slight difference between 2.1 (key stream generation) and 2.2 (Key and IV setup). In the former the output is computed right after the 3 XOR operations between 2 bits of each register (as Henno has explained). But in the latter, all the operations are merge.

In conclusion, I have done the following:

1. I have modified the code to print the first 70 bits during 2.2 or warm-up phase and, as a result, I have obtained the following keystream

 0110000000000000000000000000000000000000000000000000000000000000000110

2. I have generated 70 bits using the 2.1 section or Key stream generation phase and the outcome was the keystream below

1110000000000000000000000000000000000000000000000000000000000000000110

As you can see, (1) is equal to Nikola output and (2) is equal to Henno output. It was a tricky exercise. Unfortunatelly, the answer is not provided.