对288轮Trivium算法的线性分析  

Linear Cryptanalysis of 288-Round Trivium

作　　者：魏长河[1] 李俊志[1] 张少武[1] 

机构地区：[1]解放军信息工程大学,河南郑州450001

出　　处：《电子学报》2017年第6期1456-1461,共6页Acta Electronica Sinica

基　　金：国家自然科学基金(No.61272041)

摘　　要：此前对288轮Trivium算法线性分析的文章中,均将密钥视为随机且变化的值,这样对算法进行分析是存在问题的,攻击者实际上无法将得到的线性偏差用于对算法实施攻击.本文在选择IV(Initialization Vector)攻击条件下,重新对288轮Trivium算法进行了线性分析.由于将密钥比特作为未知的定值,因而由密钥比特组成的非线性项是定值,不会产生线性偏差,在选取10个特殊IV后,得到一个线性偏差为1.9E-6的线性逼近式.In the previous linear cryptanalysis of 288-round Trivium, it is problematic to treat the key as a random and changing value in the process of analysis. In this way the attackers actually cannot attack the cipher with the inaccurate linear bias. For the problem above, we present the linear cryptanalysis of 288-round Trivium afresh under chosen initialization vector （IV） condition. Because the key bits are fixed, the nonlinear term which consists of key bits should be constant and does not produce a linear bias, and we find a linear approximation with the linear bias of 1.9E -6 on the condition that 10 bits of the IV are fixed.

关 键 词：密码分析 线性分析 Trivium算法 线性偏差 

分 类 号：TN918.1[电子电信—通信与信息系统]