BASED ON ITERATIVE ERROR-CORRECTION

Transcription

1 A COHPARISO OF CRYPTAALYTIC PRICIPLES BASED O ITERATIVE ERROR-CORRECTIO Miodrag J. MihaljeviC ad Jova Dj. GoliC Istitute of Applied Mathematics ad Electroics. Belgrade School of Electrical Egieerig. Uiversity of Belgrade Bulevar Revolucije Beograd. Yugoslavia ABSTRACT: A cryptaalytic problem of a liear feedback shift register iitial state recostructio usig a oisy output sequece is cosidered. The mai uderlyig priciples of three recetly proposed cryptaalytic procedures based o the iterative error-correctio are poited out ad compared. I. ITRODUCTIO A weakess of a class of ruig key geerators for stream ciphers is demostrated i [l]. ad fast algorithms for the cryptaalysis are proposed i [2]-[7] havig origis i [S]. I this paper the mai uderlyig priciples for the algorithms [2]-[S] are aalyzed. The followig three priciples are cosidered: P.l: Error-correctio is based o the umber of satisfied parity-checks. P.2: Error-correctio is based o the estimatio of the relevat posterior probabilities obtaied by usig the average posterior probability estimated probability i the curret iteratio. i the previous iteratio as the prior P.3: Error-correctio is based o the estimatio of the relevat posterior probabilities obtaied by usig the posterior probabilities estimated i the previous iteratio as the prior probabilities i the curret iteratio. 11. ALGORITHHS I this sectio three algorithms correspodig to the priciples P.l-P.3 are specified. Algorithm P.l is the algorithm proposed i [3]. Algorithm P.2 coald be regarded as a simplificatio of the Algorithm [4]. Algorithm P.3 could be see as a simplificatio/modificatio of the Algorithm B [2]. Deote by {XI=l a output segmet of a liear feedback shift register (LFSR) of legth L with w feedback tapes. I a statisti- cal model, a biary oise sequece ie)= 1 is assumed to be a D.W. Davies (Ed.): Advaces i Cryptology - EUROCRYPT '91, LCS 547, pp , Spriger-Verlag Berli Heidelberg 199 1

2 528 realizatio of a sequece of i.i.d. biary variables {E},l such that Pr(E=l) = p, z Let be a oisy versio of {x}zl defied by z = x 81 e, =1.2,.... (1) The problem uder cosideratio is a recostructio of the LFSR iitial state based o the priciples P. 1-P.3 assumig that the segmet {q=1, the LFSR characteristic polyomial. ad the parameter p are kow. For the compariso purposes we assume that all the algorithms are based o the parity-checks defied as follows. Defiitio: = {~~()}~ is a set of orthogoal parity-checks related to the -th bit that are geerated accordig to the characteristic polyomial multiples as i [2]-[3]. =1.2,.... Let ck() = Xmod2 ze. k=1.2...i I, = (2) EETk() where I] deotes the cardiality of. Assume that ck() is a realizatio of a biary radom variable Ck(). k=1.2,...ll, ll = Let Pr(E. (Ck()}k=l ) be the joit probability of the variables ad Ck(), k= , ldl, ad let Pr(El {Ck()}k,l ) be the correspodig posterior probability, = I I E The followig steps are idetical for all the algorithms: Iitializatio: i=o, I=cost, p(o)=p. 1: Set i+i+l. If i ) I go to the last step. 2: Calculate ck(), k=1,2...i I, =1, ALGORITHM P.l [3]: I I 3: Calculate t = ll - 2 1" ck(), = : If t ( 0, set z + z 81 1, = Go to 1. 5: Stop the procedure. k= 1

3 529 5: Calculate p(i) = (I/) z pli) = 1. GO to I. 6: Stop the procedure ALGORITHM P.3: where ad C () = 1 - c (), p,() = [I - (1-2 P, )I 1 2 I (6) e e W tmj)j,l parity-check,() W j=1 j deotes the set of idices of the bits ivolved i the, for ay 4: If P(i) ) 0.5, set z : Set e=1,2,.... ll, =l.2,..... p (i) + pli), = ,. GO to 1. 6: Stop the procedure. pi ) + I-P(~), = , EXPERIHETAL RESULTS The experimets are realized usig a LFSR of legth 47 with 2 feedback tapes o the stages 5 ad 47. whe the observed sequece is of legth =105. The followig self-explaatory table presets the experimetal results. Accordig to the experimetal ivestigatios. all the algorithms could work whe the oise is uder a limit which is a fuctio of the observed sequece legth. For higher oise. Algorithm P.l is the first to fail, ad Algorithm P3 is the last oe to fail.

4 530 Table: The umber of residual errors as a fuctio of the iteratio step for Algorithms P.l-P.3 ad the oise pl=0.400, p2=0.425 ad p3= P = p1.p2.p3 where iteratio # of residual errors i Algorithm P.l Algorithm P.2 Algorithm P IV. COCLUSIOS A cryptaalytic problem of a LFSR iitial state recostructio usig the oisy output sequece is cosidered. The mai uderlyig

5 531 priciples of the cryptaalytic algorithms based o the iterative error-correctio, recetly proposed i [2]-[6]. are compared. The three correspodig algorithms, amed Algorithms P.l-P.3. are specified ad aalyzed. Let a iteratio cost be a equivalet of the iteratio cycle complexity ad a recostructio cost be a product of the iteratio cost ad the umber of iteratios eeded for the recostructio. The mai complexity differece betwee the algorithms is i the third step. ote that, for a give I!, the probability (3) depeds oly o s ='k=l I I c (). istead of the idividual parity-checks ck(). k Acco- rdigly. it ca be show that the complexity of Algorithm P.3 is co- siderably greater tha the complexities of both Algorithms P.l or P.2. Accordig to the experimetal results ad the complexity aalysis, we have the followig heuristic coclusios: - Whe the oise is lower tha the limit below which all the algorithms work, Algorithm P.l yields the miimum recostructio cost. - I the case of higher oise whe Algorithm P.l fails ad both Algorithms P.2 ad P.3 work, it is better to use Algorithm P.2 because of the lower recostructio cost. - Fially, whe Algorithm P.3 works ad Algorithms P.l ad P.2 both fail, i order to miimize the recostructio cost the followig procedure could be used: make the iitial error-rate reductio usig Algorithm P.3. ad after the certai poits chage the ruig algorithm by Algorithms P.2 ad P.l. respectively. REFERECES 111 c [71 C81 T.Siegethaler, "Decryptig a Class of Stream Ciphers Usig Ciphertext Oly". IEEE Tras. Comput.. vol. C-34. Ja. 1985, pp W.Meier. 0.Staffelbach. "Fast Correlatio Attacks o Certai Stream Ciphers". Joural of Cryptology. vol pp K.Zeg. M.Huag. "O the Liear Sydrome Method i Cryptaalysis". Lecture otes i Computer Sciece. Advaces i Cryptology - CRYPTO '88. ~ pp Spriger-Verlag M.MihaljeviC. J.GoliC. "A Fast Iterative Algorthm for a Shift Register Iitial State Recostructio Give the oisy Output Sequece". Lecture otes i Computer Sciece, Advaces i Cryptology - AUSCRYPT '90. ~ pp Spriger-Verlag K.Zeg. C.H.Yag, T.R..Rao. "A Improved Liear Sydrome Algorithm i Cryptaalysis with Applicatios", to appear i Lecture otes i Computer Sciece, Advaces i Cryptology - CRYPTO '90. V.Chepyzhov, B.Smeets. "O a Fast Correlatio Attack o Stream Ciphers", EUROCRYPT "91. M. ZivkoviC, "A Aalysis of Liear Recurret Sequeces over the Field GF(2)". Ph.D. thesis. Uiversity of Belgrade, R.G.Gallager. "Low-Desity Parity-Check Codes". IRE Tras. Iform. Theory, vol. IT-8, Ja pp