We know stream cipher Chacha has practical application. Do you know any practical application of Stream cipher Trivium?

  • 3
    $\begingroup$ Update: I don't know any practical application. I know it's in ISO/IEC 29192-3:2012 (preview), and I haven't heard of an attack on the full cipher. My main caveat is the key size, which makes brute force a possible concern for high-value targets (and a reason to use diversified device keys), and means there's not much headroom is case a more educated attack emerges. People have been working towards it, e.g. this, claiming an improvement of this. $\endgroup$ – fgrieu Jun 5 at 8:54
  • $\begingroup$ @fgrieu, that's an interesting paper [the first one in your comment] which basically states that an attack exists in 2 pages and has a 79 page listing of the superpoly used to mount the cube attack. $\endgroup$ – kodlu Jun 5 at 14:21
  • $\begingroup$ @fgrieu: From the paper: Therefore, we can get the value of this superpoly by summing up all $2^{78}$ possible values in the cube. Since the value of K[2] can be deduced directly from the other secret bits by using this superpoly, we can recover the whole 80-bit key by doing $2^{79}$ exhaustive searches. The overall complexity is lower than $2^{80}$. I am not an expert in cube attacks but how can $2^{79}$ exhaustive searches give $2^{80}$ overall complexity? Is each brute force search of complexity $2$? . $\endgroup$ – kodlu Jun 5 at 14:24
  • 2
    $\begingroup$ @kodlu: another, even more important issue with the "attack" is that it is not on the full trivium, which does 1152 initialization rounds, where the paper is for 843. My limited understanding is this 843 is the highest the attack can touch while remaining less costly than brute force key search by some measure. That's one reason for my "working towards". $\endgroup$ – fgrieu Jun 5 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.