Trivium序列密码的线性性质和代数性质  

Analysis on Linear and Algebraic Property of Trivium Stream Cipher

作　　者：申兵[1] 霍家佳[1] 

机构地区：[1]保密通信重点实验室,四川成都610041

出　　处：《信息安全与通信保密》2013年第12期113-116,共4页Information Security and Communications Privacy

摘　　要：Trivium是C.De Canniere和B.Preneel在2005年为欧洲eSTREAM项目设计的序列密码,Trivium被选为最终的7个算法之一。Trivium的内部状态为288比特,密钥长度为80比特。文中给出Trivium的分组密码迭代模型,在这个模型下,利用计算程序得出了Trivium各轮输出关于内部状态的线性逼近及其线性逼近概率,当初始化轮数超过246时,其输出关于输入的线性逼近概率不大于1/2+2^(-41)。利用计算机搜索程序,给出Trivium在轮的代数方程规模,利用1 152个输出比特,得到的二次方程组包含6788个变量、11 232个方程,从实验上证明了Trivium算法能抗线性攻击和代数攻击。Trivium is a stream cipher designed by C. De Canni^re and B. Preneel for the European project eSTREAM in 2005. Trivium, selected as one of the final seven stream ciphers,has an internal state size of 288 bits and a key length of 80 bits. In this paper,a block cipher based iterative model for Trivium is proposed. Based on this model,the linear approximation probability for output bits and internal states of each round are computed. When the iterative rounds exceed 246, this probability is less than 1/2＋2 41. Meanwhile, the scale of algebraic equations for each round of Trivium is estimated by a search program. With 1 152 output bits, the quadratic equation system containing 6 788 variants and 11 232 equations is obtained. Experimental results indicate that Trivium can successfully resist Linear attack and alge- braic attack.

关 键 词：Trivium序列密码 线性攻击 代数攻击 

分 类 号：TN918.1[电子电信—通信与信息系统]