What is the attack complexity when Grain-128 and Trivium are cascaded? Is it 2^(256 + 128) since internal state of Grain is 256 bits and assuming that IV is unknown before encryption?

  • 1
    $\begingroup$ That will depend on how keys for Grain-128 and Trivium are obtained. If that's from hashing a password.. Also, the internal 256-bit state of Grain-128 can not make attack more costly than implied by the key size. $\endgroup$ – fgrieu Apr 27 '18 at 16:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.