祖冲之序列密码的线性区分攻击分析  

Linear distinguishing attack analysis on ZUC stream cipher

作　　者：汤永利[1] 韩娣[1] 闫玺玺[1] 叶青[1] 李子臣[2] 

机构地区：[1]河南理工大学计算机科学与技术学院,河南焦作454003 [2]北京印刷学院信息工程学院,北京102600

出　　处：《南京理工大学学报》2016年第4期450-454,共5页Journal of Nanjing University of Science and Technology

基　　金：国家自然科学基金(61370188;61300216);河南省科技厅国际科技合作计划(152102410048);河南省基础与前沿技术研究(142300410147);河南省教育厅自然科学项目(12A520021);河南理工大学博士基金(B2013-043;B2014-044)

摘　　要：为了探讨祖冲之算法(ZUC)的安全性,该文对ZUC算法进行了线性区分攻击分析。文中对ZUC算法中两轮非线性函数F最优化线性逼近,得到线性逼近方程式,计算线性逼近的偏差为2-22.6。利用线性逼近方程式构造仅包含输出密钥流的区分器,并寻找最优掩码使区分器的偏差最大,在最优线性掩码的基础上计算得到区分器的区分偏差为2-65.5。该攻击需要约O(2131比特)密钥流,就能把随机序列与密钥流序列区分开,从理论上证明了ZUC算法的安全性。最后通过与已有的安全性分析结果对比发现,该文的线性区分攻击结果有一定的优越性。In order to probe into the security of the ZUC algorithm, linear distinguishing attack on the ZUC algorithm is proposed. In this paper, we first consider the linear approximation of 2-round nonlinear function F and get linear approximation equation, and the best advantage of the linear approximation equation is 2^-22.6. By combining those linear approximations, we establish a distinguisher only depending on the keystream. In order to get the best advantage of distinguisher, we search the best linear masking and the best advantage of the distinguisher is about 2^-65. 5. The result shows that the key stream generated by ZUC is distinguishable from a random sequence after observing approximately O（ 2^131） bits, and it proves that the ZUC algorithm is safel By comparison, the result of the linear distinguishing attack is superior to other attacks.

关 键 词：祖冲之算法 线性区分攻击 线性逼近 区分器 线性掩码 

分 类 号：TP309.7[自动化与计算机技术—计算机系统结构]