In Trivium cipher, an 80-bit key and 80-bit IV (initialization vector) are used initially to set up the initial state. I would like to know,

  1. Role of IV in stream cipher?
  2. Can we make IV a secret parameter? and
  3. How IV values are chosen/updated in Trivium?
  1. Role of IV in stream cipher?

Like in block ciphers; it helps to achieve randomized encryption. Also, using different IV under the same key prevents the crib-dragging attack like in all stream ciphers. This enables us to reuse a key without causing the crib-dragging attack ( that works on two or many-times pad) by using different IVs.

If the IV repeats under the same key, the keystream will be repeated and an attacker will x-or the two or more encrypted messages to the x-or of the messages

$$C_1 = M_1 \oplus keystream$$ $$C_2 = M_2 \oplus keystream$$ then

$$M_1 \oplus M_2 = C_1 \oplus C_2$$ and a passive attacker has the access $C_1 \oplus C_2$ since they are listening the channel. Now, they need to execute crib-dragging and that can be automated.

It should also be noted that the IVs of such (synchronous) stream ciphers play an important role as a means of resynchronization, e.g. on a per-message basis.

  1. Can we make IV a secret parameter? and

IV's are public values and never intended to be secured, otherwise, we can call them as the part of the key. Remember the Kerckhoffs's principles; only the key is the secret.

  1. How IV values are chosen/updated in Trivium?

The Trivium specifications doesn't mention about generating the IV values. We, however, can use the common knowledge about it.

Since the repeat of the IV under the same key can cause catastrophic failures as in all stream cipher that confidentiality is failed. One must guarantee that is is not repeating.

  • Random IV: Since Trivium uses 80-bit IV, after $2^{40}$ random IV generation it is expected that the IV will be repeating with 50% probability due to the birthday attack. Actually, one must stop way earlier to use the current encryption key and generate/exchange a new one.

  • Counter/LFSR based IV: Counter/LFSR bases solutions are fine except that on the system failures where the last value of counter/LFSR may not be stored correctly that cause repeats. To mitigate this either generate/exchange a new key or see the next solution.

  • Random combined with counter/LFSR: This time the randomized part can help to eliminate the system failure even the last values of counter/LFSR are repeating after the system recovery.

$$\text{IV} = \text{[40-bit random]} \mathbin\| \text{[40-bit counter/LFSR value]}$$

Some Nice crib-dragging answers for more details;

  1. Taking advantage of one-time pad key reuse?
  2. How does one attack a two-time pad (i.e. one-time pad with key reuse)?
  3. Little problem with Vernam Cipher
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.