对288轮Trivium算法的线性分析

此前对288轮Trivium算法线性分析的文章中,均将密钥视为随机且变化的值,这样对算法进行分析是存在问题的,攻击者实际上无法将得到的线性偏差用于对算法实施攻击.本文在选择IV(Initialization Vector)攻击条件下,重新对288轮Trivium算法进行了线性分析.由于将密钥比特作为未知的定值,因而由密钥比特组成的非线性项是定值,不会产生线性偏差,在选取10个特殊IV后,得到一个线性偏差为1.9E-6的线性逼近式.

Linear Cryptanalysis of 288-Round Trivium

In the previous linear cryptanalysis of 288-round Trivium,it is problematic to treat the key as a random and changing value in the process of analysis.In this way the attackers actually cannot attack the cipher with the inaccurate linear bias.For the problem above,we present the linear cryptanalysis of 288-round Trivium afresh under chosen initialization vector (IV) condition.Because the key bits are fixed,the nonlinear term which consists of key bits should be constant and does not produce a linear bias,and we find a linear approximation with the linear bias of 1.9E-6 on the condition that 10 bits of the IV are fixed.