# Number of keystreams generated in Kreyvium for a single key/IV pair

Kreyvium employs 128-bit key and 128-bit IV. By a single initialization procedure using a key/IV pair, how many keystreams can be generated?

Trivium is designed as an 80-bit key and 80-bit $$\operatorname{IV}$$. Noted in Algorithms, key size and parameters report 2014. Technical report, ENISA - European Union Agency for Network and Information Security, 2014. increasing the key size was not an easy task.

Kreyvium is defined in Stream ciphers: A Practical Solution for Efficient Homomorphic-Ciphertext Compression by Canteaut et al. as 128-bit IV and 128-bit key variant of Trivium. Actually they consider a solution to this problem.

In typical applications of homomorphic encryption, the first step consists for Alice to encrypt some plaintext m under Bob’s public key pk and to send the ciphertext $$c = \operatorname{HE}_{pk}(m)$$ to some third-party evaluator Charlie. This paper specifically considers that first step, i.e. the problem of transmitting $$c$$ as efficiently as possible from Alice to Charlie.

They gave the maximum length as

Our first aim is to offer a variant of Trivium with 128-bit key and $$\operatorname{IV}$$, without increasing the multiplicative depth of the corresponding circuit. Besides a higher security level, another advantage of this variant is that the number of possible $$\operatorname{IVs}$$, and then the maximal length of data which can be encrypted under the same key, increases from $$2^{80}N_{trivium}(d)$$ to $$2^{128}N_{kreyvium}(d)$$.

Bolds are mine

What is the Kreyvium

A picture can tell a thousand words. From the article;

They added the 256-bit IV and key bits into 288-bit internal state. Full defitinion can be found on the 8th page of the article.

• Interesting that those are just circulating registers as far as I can see. Don't have time to go into the details now. – kodlu Jul 18 at 0:29