1
$\begingroup$

I am currently working on a project which consist in the encryption of image using the GPU of a raspberry.

I would like to use LFSR to generate a stream cypher in each Core of the GPU. In the wikipedia article they recommend to use combination of several LFSR, we could use 2 LFSR, one could tell if we use the current output bit from the other one shrinking generator

It says: "Despite this simplicity, there are currently no known attacks better than exhaustive search when the feedback polynomials are secret"

Do you think it's a good choice ?

Working with image makes me working with large field of data, Kb files. I saw that if we select a good polynomial we can have a large period, so in theory if i have a 32 bits LFSR register and i use a polynomial from this page polynomial

Could I generate 2^32 pseudo random bits (not bytes) ?

Last question, is it okay to use the same polynomial and changes the seed (initial state of the register) for later use or should i change the polynomial each time i want fresh data ?

Improve this question
$\endgroup$
1
  • 2
    $\begingroup$ Why not use something that's more cryptographically secure while still being lightweight, like (for example) a stream cipher like Trivium or ChaCha20? Doing so, you would trade a lot of "uncertainty" with "confidence" when it comes to cryptographic strength. Compared to modern stream ciphers, combining LFSRs resides somewhere between "a bad idea" and "potentially very insecure"... depending how you actually implement things. Why take the risks that come with "creating your own" when there's practically no reason to do so? $\endgroup$
    – e-sushi
    Nov 25, 2016 at 17:42

1 Answer 1

Reset to default
0
$\begingroup$

I think Trivium, and ChaCha20 are excellent choices.

If you insist on using the shrinking generator or the self shrinking generator, you should use them without hiding the polynomials, which would be security by obscurity. I'd suggest that the SSG is probably stronger than the SG, for given keylength. But there are fast correlation and guess and determine attacks on both, so your real strength is only a fraction of the keylength. This would mean using at least 256 bit length LFSRs.

Finally they haven't been designed with modern Key/IV based operation. Key/IV based operation would help you achieve the goals you might have in mind for the question of whether you should change key and/or the secret polynomial.

Improve this answer
$\endgroup$
1
  • $\begingroup$ ChaCha20 is quite slow compared to Trivium. Perhaps you meant ChaCha8? $\endgroup$
    – forest ♦
    Jan 2, 2021 at 4:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.