Download presentation

Presentation is loading. Please wait.

Published byAryan Elias Modified about 1 year ago

1
LINEAR FEEDBACK SHIFT REGISTERS, GALOIS FIELDS, AND STREAM CIPHERS Mike Thomsen Cryptography II May 14 th, 2012

2
Outline Linear Feedback Shift Registers (LFSR) Interesting properties of LFSR Stream ciphers with LFSR – correlation attacks A5/1 and it’s weaknesses Looking forward

3
Linear Feedback Shift Registers (LFSR) Very basic example, 3 bit register XOR 123 Output Bit

4
Linear Feedback Shift Registers (LFSR)

5

6
Properties of LFSR Maximal vs. non-maximal length Cyclic Non-maximal governed by front two bits

7
Properties of LFSR Columns are exact rotations of each other. If we look at it as a matrix, different “initializations” or start states yield a rotation of the entire matrix

8
Properties of LFSR Columns are exact rotations of each other. If we look at it as a matrix, different “initializations” or start states yield a rotation of the entire matrix

9
LFSR and Galois Fields

10

11

12
Can reverse the tap positions to get another, identical set of LFSR states. If the original feedback set is [m, A, B, C], the reversed feedback set is described by [m, m-C, m-B, m-A]. Easy to find another irreducible polynomial.

13
LFSR and Galois Fields

14
LFSR and Stream Ciphers LFSR can be used as a stream cipher. Remember that stream ciphers are similar to PRNG in that they output a single bit at a time, and data is encrypted bit by bit until the whole plaintext has been encrypted. A single LFSR as a cipher is vulnerable to due it’s cyclic nature, so we combine multiple LFSR to achieve this.

15
LFSR and Stream Ciphers First, we define a boolean function. For example, consider the following diagram.

16
LFSR and Stream Ciphers

17
LFSR and Stream Ciphers – Correlation Attacks Since registers are private, they are not independent beings to an attacker, so the whole system must be broken. Idea: Try to correlate one register to the boolean function, improving a brute force attack. If it is correlated, it can be broken separately (independent of the system), vastly improving complexity. More likely than it seems, with enough registers, due to the linear nature of LFSR, some patterns and correlations will appear – linear recursive equations.

18
LFSR and Stream Ciphers – Correlation Attacks

19
LFSR and Stream Ciphers – A5/1

20
Use the following LFSR’s of length 19, 21, and 22. R1 has taps 13,16,17,18 R2 has taps 20, 21 R3 has taps 7, 20, 21, 22

21
LFSR and Stream Ciphers – A5/1

22
Attacks on A5/1 – Known Plaintext

23
Attacks on A5/1 – Active Attacks Barkhan, Biham, and Keller developed the most serious weakness – an active attack with A5/2 – if the phone supports it. They also published another paper in 2006, furthering their attacks and fully breaking A5/1. A5/3 or KASUMI

24
Future Algorithms like RC4/5/6 have been developed and avoid the use of LFSR – have their own set of problems. LFSR are interesting and are good for ‘random’ hardware testing, and if constructed correctly, can be useful in some cryptographic applications. Note that A5/1’s weaknesses are less about the structure of LFSR and more about the structure of GSM.

25
References Elad Barkan, Eli Biham, Nathan Keller, Instant Ciphertext- Only Cryptanalysis of GSM Encrypted Communication, 2003/2006 Patrik Edhal, On LFSR-based Stream Ciphers (PhD), 2003 Alex Biryukov, Adi Shamir, David Wagner, Real Time Cryptanalysis of A5/1 on a PC, _sequence_linear_feedback_shift_register_lfsr.htm _sequence_linear_feedback_shift_register_lfsr.htm Thomas Johansson, Fredrik Jonsson, Improved Fast Correlation Attacks on Stream Ciphers via Convolutional Codes, 1999

Similar presentations

© 2017 SlidePlayer.com Inc.

All rights reserved.

Ads by Google