Questions tagged [stream-cipher]

A stream cipher is an encryption algorithm which encrypts arbitrary length plaintext, using a key. Some stream ciphers generate a keystream from only the key, which is then XOR-combined with the plain text, others feed back plaintext or ciphertext into the algorithm to create the keystream.

52 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
7
votes
0answers
120 views

Does the bias in RC4 drop asymptotically further in the keystream?

It's well-known that the RC4 keystream has significant biases that become less prominent later in the keystream. The most severe bias is in the second byte, which has a 128-1 bias towards zero. Other ...
7
votes
2answers
154 views

Why is Vigenère Autokey self-synchronizing?

According to the Wikipedia, and to several of our school study materials, Vigenère autokey ciphers are considered to be self-synchronizing stream ciphers. If I understand it correctly, the main idea ...
5
votes
0answers
139 views

Why does chacha20 not use bitwise not?

Right now chacha20 and blake use constants in order to eliminate fixpoints. As far as I know however inserting a bitwise not every $n$ rounds should eliminate this ...
4
votes
0answers
261 views

Why is this Trivium implementation working bytewise instead of bitwise?

I am currently looking into a Trivium implementation available in the FELICS framework. Parameters of the Trivium stream cipher: Key size: 80 bit IV size: 80 bit State size: 288 bit The Trivium ...
4
votes
0answers
185 views

Safely using ciphers that take small key sizes

Is it feasible to use triple encryption for block ciphers with the maximum keysize being the only significant security issue? I mean $C = E_{k_1}(E_{k_2}(E_{k_3}(P)))$ and $P = D_{k_1}(D_{k_2}(D_{k_3}(...
4
votes
0answers
224 views

How secure is $\operatorname{AES256}_{\operatorname{ECB}}(\operatorname{ChaCha20}(\text{plaintext}))$?

Suppose I encrypt a bytestream using ChaCha20, and then encrypt the resulting ciphertext using AES in ECB mode. How secure is the combination?
4
votes
0answers
126 views

A confusion about linear span of modified de Bruijn sequence

Recently i'm reading "Cryptographically Strong de Bruijn Sequences with Large Periods" . In the section 2 2.1 Basic Definitions and Properties , property 1 says ...
3
votes
0answers
80 views

Does varying ChaCha rounds add any security?

This paper introduces 'Freestyle' a randomized, and variable round version of the ChaCha cipher. It uses the concept of hash based halting condition, where a decryption attempt with an incorrect key ...
3
votes
0answers
151 views

Brute force attack multiple stream cipher

Assume that a scheme used to secure a specific system $Π=(Gen,Enc,Dec)$ which is thought have indistinguishable multiple encryption in the presence of an eavesdropper. For any adversary $A$ that can ...
3
votes
0answers
86 views

How to generate initial vectors during DPA attack on stream cipher in real life?

I was trying to understand the procedure of the DPA attack on Stream cipher (like Mickey-128). I learned that, the attacker need to build hypothetical power consumption matrix with different initial ...
2
votes
0answers
43 views

Linear approximattion of $(x+y) \bmod 2^n$ in FSM of SNOW 2.0 where $x,y$ in $F_{2}^n$

I would like to understand the linear approximation of $(x+y) \bmod 2^n$ by linear masking method in the paper refereed ""Improved Linear Distinguis'hers for SNOW 2.0" by Kaisa Nyberg and Johan Wall´...
2
votes
0answers
56 views

Design of SIMD-implemented cipher

Design of efficient of block ciphers needs consideration of many factors such as register size. i found that some ciphers can be SIMD implemented such as TWINE , SM4 , chacha20 ,SPIX ,and others. ...
2
votes
0answers
24 views

What happens in the MonkeyWrap-Algorithm of KetjeV2 if the input is a single block?

I am currently implementing KetjeV2 in VHDL. I have a question concerning the MonkeyWrap-Algorithm that is used in KetjeV2. The function $wrap(A, B, l)$ is supposed to work as shown below, where $A$ ...
2
votes
0answers
129 views

Known Plaintext Attack A5/2

I am trying to understand the non-optimized known plaintext attack on A5/2 from Barkan, Bikan and Keller. I don't understand the construction of the equation system: $$S_{R4_1} * S_1 = k$$ Where $S$ ...
1
vote
1answer
47 views

Discrepancy $δ$ in the Berlekamp-Massey Algorithm

I have a question regarding to the Berlekamp–Massey algorithm. Can someone guide me to understand the idea/intuition of this algorithm? According to the explanation in Wikepedia, in each iteration, ...
1
vote
0answers
62 views

Serious Cryptography by Jean-Philippe Aumasson - Chapter 5 Stream Ciphers - Attacking Salsa20/8 - Page 100 Last Paragraph

I'm currently reading "Serious Cryptography - A Practical Introduction to Modern Encryption" written by "Jean-Philippe Aumasson" published by NoStarch in 2018. In "Chapter 5 ...
1
vote
0answers
73 views

How does a pseudorandom generator produce a similar distribution to $U_{n}$?

According to Wikipedia, a function ${\displaystyle G:\{0,1\}^{\ell }\to \{0,1\}^{n}}$ with ${\displaystyle \ell < n}$ is a pseudorandom generator against $\mathcal {A}$ with bias $\epsilon$ if, ...
1
vote
0answers
55 views

Usage of block and stream ciphers

I see that in many applications stream ciphers are common than block cipher - whether is Salsa20, AES-GCM, etc. In which cases would a stream cipher be preferred over a block cipher and vice versa? ...
1
vote
0answers
143 views

How to increase Poly1305 performance?

I was analysing the Chacha20 algorithm and the Poly1305 MAC generation from RFC 7539. It seems that the Chacha20 is quite faster compared to AES on CPUs without hardware support like AES-NI. But ...
1
vote
2answers
177 views

Text cipher option that can decrypt the same ciphertext to two DIFFERENT and DESIRED outputs given DIFFERENT keys (and/or alphabet)

I have a pen pal that I discuss with. In our latest discussion it was proposed to write a short message that is ciphered and have the other one find what it is, given some clues. I would like to ask ...
1
vote
0answers
47 views

Should you pad messages encrypted with stream ciphers?

Should you pad messages encrypted with stream ciphers? The obvious answer seems to be yes, right? It obviously leaks the exact length of the plaintext. Consider a situation where an adversary knows a ...
1
vote
0answers
48 views

Can Trivium ciphertext be decrypted by an adversary if the key is known, but the IV is not?

Suppose that the adversary is able to recover the key of Trivium cipher. But the associated IV is unknown to him. Will he be able to decrypt the ciphertexts without any complexity?
1
vote
0answers
44 views

Are there any state of the art crypanalysis tools for stream cipher

I am new to cryptanalysis and interested in knowing cryptanalysis tools (black boxing or white boxing) for (not any specific) stream ciphers in general sense. Scenario: I am given an assignment to ...
1
vote
0answers
34 views

Can we use the same frame counter in A5/2

Let we have three encoded messages with length $3*456$ bits in A5/2 encryption. Can we use the same frame counter in the encryption process or we must use different? (E.g. this because in the below ...
1
vote
0answers
59 views

Circular Security - Encrypting the key with the key

I know this isn't the best practice, but what if I took a cheap/fast 128-bit stream cipher (assuming both the key and the stream blocks are 128 bits) and mixed in the plainkey with the plaintext (let'...
1
vote
0answers
94 views

Perfect Forward Secrecy Stream Cipher based on Block Cipher

I'm thinking about ways to encrypt an endless stream of data (e.g. a video or audio feed) in a way, where a compromise of the current internal state of the encryption (e.g. a RAM dump) does not ...
1
vote
0answers
51 views

MULalpha and DIValpha operations in SNOW 3G

I'm not able to appreciate the importance of mul alpha and div alpha operations in feedback polynomial of LFSR in SNOW 3G. What problems or weakness do they help in mitigating and how ?
1
vote
0answers
416 views

berlekamp massey feedback polynomial

I have a couple of polynomials to find. Can anybody guide me with the steps to find the feedback polynomial using berlekamp massey's algorithm. Example: Key fragment: 10100100001001101001011 seed: ...
1
vote
0answers
171 views

Why does the Content Scrambling System have two different length LFSRs

CSS uses two LFSRs of length 17 and 25. If we have two periodic functions $f(t)$ and $g(t)$ and consider the function $h(t) = (f(t), g(t))$, then $h$ will have period $pq/\gcd(p, q)$ where $p$ and $q$...
1
vote
0answers
81 views

What is the attack complexity if two stream ciphers are connected in cascade?

What is the attack complexity when Grain-128 and Trivium are cascaded? Is it 2^(256 + 128) since internal state of Grain is 256 bits and assuming that IV is unknown before encryption?
1
vote
0answers
115 views

How does the Chop Chop attack effect TKIP?

I know that chop chop attack is because of WEP's insecure checksum mechanism that is CRC32. As TKIP uses MIC along with CRC32 which just makes an attacker to wait for 60 sec upon two mismatch MIC ...
1
vote
0answers
95 views

How can we efficiently resync a stream cipher

If we have a stream cipher and the key but have lost a significant part of the beginning of the cipher stream of unknown length. Obviously we can add syncing information outside but I was wondering ...
1
vote
0answers
734 views

Find the initial state of LFSR with n non-consecutive output bits

Let's say I have (e.g.) $32$ output bits of an $128$ bit LFSR whose period length is $2^{128} - 1$. Those output bits are chosen arbitrarily, so I do not have any consecutive bits. Let us call the ...
1
vote
0answers
72 views

How to provide mathematical proof of the security of a stream cipher against known attacks?

Suppose a person has invented a stream cipher and he/she wants to get it published. I have a few questions: In addition to providing detailed description of the algorithm, how would he/she give ...
1
vote
0answers
102 views

Reykeyed AES in CTR mode as a stream cipher

Suppose one uses AES in CTR mode to generate a keystream, but every $l$ bytes the $n$ bits that would follow are used as a new AES key. Assuming that AES is a secure PRP: Is this a secure stream ...
1
vote
0answers
52 views

Symmetric stream cipher, is it known?

I am thinking on a simple symmetric stream cipher. My first idea is the following: The key is a set of array of random bytes ($\underline{k}_1$ ... $\underline{k}_n$), whose length is $l_1$, $l_2$, .....
1
vote
0answers
278 views

Resynchronizing brute-force attack against stream ciphers

There is a stream cipher without any known cryptographic weaknesses. The attacker knows parts of the key so she can reduce the key-space to a size that can be practically brute-forced. However the ...
0
votes
0answers
30 views

Finding initial key of Fibonacci LFSR knowing only polynomial and output stream-cipher

I need to know whether it is possible to find the initial key of a Fibonacci LFSR knowing only length and taps and output stream-cipher bit sequence? Plaintext is not ASCII, nor some other sort of ...
0
votes
0answers
34 views

Practical application of Stream cipher Trivium

We know stream cipher Chacha has practical application. Do you know any practical application of Stream cipher Trivium?
0
votes
0answers
36 views

Equivalent keys in Hash Functions

Let's suppose I want to use a (keyed) hash function as a stream cipher, I provide a key and a message to be hashed as a counter (like a nonce), and so, XOR each hashed output block on the plaintext. ...
0
votes
0answers
71 views

Is multiple encryption with stream ciphers vulnerable to meet-in-the-middle attacks?

Let's suppose I encrypt something with a stream cipher (CSPRNG) two times using two 256-bit keys and different IVs. Will I get 512-bit encryption strength?
0
votes
0answers
47 views

Recreate RC4 Stream cipher

I'm trying to learn how to go about cracking RC4 ciphers (nothing illegal, its an old, i.e., not active challenge for a job application, so no cheating). I have nine md5 hashes with their own ciphers. ...
0
votes
0answers
26 views

Strange for loop in salsa20_word_specification function

This is wrt to implementation of the salsa20_word_specification function at https://cr.yp.to/salsa20.html The 2nd for loop goes like this ...
0
votes
0answers
79 views

Would a key recovery attack on ChaCha's keystream would be made more secure with an AONT?

To be clear I'm well aware that ChaCha doesn't need to be "improved". Also, I have no intentions or misguided ideas about trying to "improve" it. My question is hypothetical, and ...
0
votes
0answers
39 views

Approach used with XOR cipher in black box scenery

What's the approach used in cryptanalysis to make an decrypter for a simple xor stream cipher in a Black Box scenery with only the output?
0
votes
0answers
219 views

Most used stream ciphers?

I am writing my Bachelor thesis on topic "Current state of stream ciphers". So my questions is: Which stream ciphers are used the most. So far I have A5 family, RC4, E0 (Bluetooth), Snow 3G and ZUC (...
0
votes
0answers
39 views

Best method for storing cryptographic secret key and generation of IV in Trivium?

How the secret key for Trivium cipher is stored and managed in an embedded system (IoT sensor node)? How the IV is generated in a Trivium? How to justify the fact that storing a fixed value (for ...
0
votes
0answers
54 views

Meaning of direction in EPS

In EEA (EPS Encryption Algorithm) and EIA (EPS Integrity Algorithm), what exactly does the direction (uplink/downlink) indicate? It's confusing because for both encryption and decryption of a given ...
0
votes
0answers
103 views

A5/1 Formula Question's

So before I start I'm learning how this algorithm still works so my first question is for the x,y, and z steps (of getting the keystream I believe). The formula is t = y 20 XOR y 21 for y. There is ...
0
votes
0answers
144 views

Combining stream cipher with block cipher for disk encryption

You take something like chacha20 and use the disk block # to seek it, xor it with the data block and then encrypt it with a block cipher in ECB mode. Would this be secure? Edit: To avoid getting ...