论文部分内容阅读
Espresso算法是由E.Dubrova和M.Hell两人设计的面向5G通信需求的序列密码算法,算法采用256级的非线性反馈移位寄存器(NFSR)作为驱动部件,密钥长度为128比特,初始化向量为96比特,过滤输出函数为6次布尔函数.由于驱动部件为NFSR,因此Espresso算法可以较好地抵抗标准代数攻击以及相关攻击等分析方法.然而本文将证明无论参数如何选择,只要是利用E.Dubrova和M.Hell所提方法构造出来的NFSR,其任意寄存器上的输出序列均可由同级数的线性反馈移位寄存器(LFSR)通过选取适当的过滤函数生成,即等于某个LFSR的前馈序列.特别的,这些LFSR是相同且过滤函数可显式地表达出来.利用这一结果,我们证明了Espresso算法的输出序列为某个256级LFSR的前馈过滤,对应的过滤函数为12次布尔函数.针对该等价模型,我们可以成功地实施代数攻击,其时间复杂度为O(2~(66.86)).我们指出,要想抵抗等价模型下的代数攻击,Espresso算法中的输出函数至少应为8次布尔函数.最后我们还讨论了等价模型下输出函数的其他漏洞.
Espresso algorithm is a sequence cipher designed by E. Dubrova and M.Hell for 5G communication requirements. The algorithm uses a 256-level nonlinear feedback shift register (NFSR) as the driving component, and the key length is 128 bits. Initialization The vector is 96 bits and the filter output function is Boolean function 6. Since the driving part is NFSR, Espresso algorithm can better resist the analysis of standard algebraic attacks and related attacks, etc. However, this paper will prove that no matter how the parameters are chosen, NFSR constructed by methods proposed by E. Dubrova and M. Hell, whose output sequence on any register can be generated by a linear feedback shift register (LFSR) of the same level by selecting an appropriate filter function, that is, equal to a LFSR In particular, these LFSRs are the same and the filter function can be explicitly expressed. Using this result, we prove that the output sequence of the Espresso algorithm is feedforward filtering of a 256-level LFSR with a corresponding filtering function of For the equivalence model, we can successfully implement algebraic attacks with O (2 ~ (66.86)) time complexity. We point out that if we want to resist the equivalence model Algebraic attacks, the output function Espresso algorithm should be at least 8 times a Boolean function. Finally, we also discussed other vulnerabilities output function under the equivalent model.