类Espresso流密码的广义NLFSR变换算法及密码分析
Generalized NLFSR Transformation Algorithms and Cryptanalysis of the Class of Espresso-like Stream Ciphers
摘要：
轻量级流密码在物联网应用中有很高的需求。为了优化硬件性能，提出了一类新的流密码算法。其基本思想是使用一个具有最大周期的Galois NLFSR来构造密码。Espresso作为这类流密码的代表性设计，基于由128位密钥初始化的256位Galois NLFSR。因为伽罗瓦NLFSR是从最大长度LFSR变换而来的，所以确保了$2^{256}-1$最大周期。然而，我们提出了一个伽罗瓦到斐波那契变换算法，并成功地将伽罗瓦NLFSR转换成一个非线性输出函数的斐波那契LFSR。变换后的密码分别被复杂度为$\mathcal{O}(2^{68.44})$和$\mathcal{O}(2^{66.86})$的标准代数攻击和Rønjom-Helleseth攻击破解。该变换算法是从本文提出的一种新的Fibonacci-to-Galois变换算法中推导出来的。与现有的算法相比，所提出的算法更有效，覆盖更一般的用例。此外，转换结果表明，任何Espresso类流密码中使用的Galois NLFSR可以很容易地转换回原始的Fibonacci LFSR。因此，今后应避免这种设计。
英文摘要：
Lightweight stream ciphers are highly demanded in IoT applications. In order to optimize the hardware performance, a new class of stream cipher has been proposed. The basic idea is to employ a single Galois NLFSR with maximum period to construct the cipher. As a representative design of this kind of stream ciphers, Espresso is based on a 256-bit Galois NLFSR initialized by a 128-bit key. The $2^{256}-1$ maximum period is assured because the Galois NLFSR is transformed from a maximum length LFSR. However, we propose a Galois-to-Fibonacci transformation algorithm and successfully transform the Galois NLFSR into a Fibonacci LFSR with a nonlinear output function. The transformed cipher is broken by the standard algebraic attack and the Rønjom-Helleseth attack with complexity $\mathcal{O}(2^{68.44})$ and $\mathcal{O}(2^{66.86})$ respectively. The transformation algorithm is derived from a new Fibonacci-to-Galois transformation algorithm we propose in this paper. Compare to existing algorithms, proposed algorithms are more efficient and cover more general use cases. Moreover, the transformation result shows that the Galois NLFSR used in any Espresso-like stream ciphers can be easily transformed back into the original Fibonacci LFSR. Therefore, this kind of design should be avoided in the future.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
