Improved differential fault attack on MICKEY 2.0

Abstract

In this paper we describe several ideas related to differential fault attack (DFA) on MICKEY 2.0, a stream cipher from eStream hardware profile. Using the standard assumptions for fault attacks, we first show that if the adversary can induce random single bit faults in the internal state of the cipher, then by injecting around $2^{16.7}$ faults and performing $2^{32.5}$ computations on an average, it is possible to recover the entire internal state of MICKEY at the beginning of the key-stream generation phase. We further consider the scenario where the fault may affect more than one (at most three) neighboring bits and in that case we require around $2^{18.4}$ faults on an average to mount the DFA. We further show that if the attacker can solve multivariate equations (say, using SAT solvers) then the attack can be carried out using around $2^{14.7}$ faults in the single-bit fault model and $2^{16.06}$ faults for the multiple-bit scenario

Appendices

Appendix A: Proofs for Theorem 1B-F

• B. Since $\theta _1$ is a function of $r_0,r_{67},s_{34},r_{99},s_{99}$ only, for any $\phi \in [1,99]{\setminus } \{67,99\}$ we have

  $$\begin{aligned} \theta _1(R_{t,\Delta r_\phi }(t), S_{t,\Delta r_\phi }(t)) = \theta _1(R_t,S_t). \end{aligned}$$

  Therefore $z_{t+1} + z_{t+1,\Delta r_\phi }(t)$ equals

  $$\begin{aligned}&\theta _1(R_t,S_t)+ \theta _1(R_{t,\Delta r_\phi }(t), S_{t,\Delta r_\phi }(t))\\&\quad = 0, \ \forall \phi \in [1,99]{\setminus }\{67,99\}, \ \forall R_t,S_t \in \{0,1\}^{100}. \end{aligned}$$

  So, $\Psi _{r_\phi }^1[1]=1$ for all $\phi \in [1,99]{\setminus }\{67,99\}$.

• C. We have $z_{t+1} + z_{t+1,\Delta r_{99}}(t)$ equals

  $$\begin{aligned}&\theta _1(R_t,S_t)+ \theta _1(R_{t,\Delta r_{99}}(t), S_{t,\Delta r_{99}}(t))\\&\quad = (r_0^t \cdot r_{67}^t + r_0^t \cdot s_{34}^t + r_{99}^t + s_{99}^t) \\&\quad +\,(r_0^t \cdot r_{67}^t + r_0^t \cdot s_{34}^t + 1+ r_{99}^t + s_{99}^t)\\&\quad = 1, \ \forall R_t,S_t \in \{0,1\}^{100}. \end{aligned}$$

  So, $\Psi _{r_{99}}^2[1]=1$. Also $z_{t+1} + z_{t+1,\Delta r_{67}}(t)$ equals

  $$\begin{aligned}&\theta _1(R_t,S_t)+ \theta _1(R_{t,\Delta r_{67}}(t), S_{t,\Delta r_{67}}(t))\\&\quad = (r_0^t \cdot r_{67}^t + r_0^t \cdot s_{34}^t + r_{99}^t + s_{99}^t)\\&\quad +\,(r_0^t \cdot (1+r_{67}^t) + r_0^t \cdot s_{34}^t + r_{99}^t + s_{99}^t)\\&\quad = r_0^t \ne 0 \text{ or } 1, \ \forall R_t,S_t \in \{0,1\}^{100}. \end{aligned}$$

  So, $\Psi _{r_{67}}^2[1]=0$.

• D. We have

  $$\begin{aligned} z_t + z_{t,\Delta s_0}(t)&= \theta _0(R_t,S_t)+ \theta _0(R_{t,\Delta s_0}(t), S_{t,\Delta s_0}(t))\\&= (r_0^t+s_0^t)+(r_0^t+1+s_0^t) \\&= ~1, \ \forall R_t,S_t \in \{0,1\}^{100}. \end{aligned}$$

  So, $\Psi _{s_0}^2[0]=1$. Also $\theta _0$ is not a function of any $r_i,s_i$ for $i \in [1,99]$ and so

  $$\begin{aligned} \theta _0(R_{t,\Delta s_\phi }(t), S_{t,\Delta s_\phi }(t)) = \theta _0(R_t,S_t) \end{aligned}$$

  for all $\phi \in [1,99]$ and so we have

  $$\begin{aligned} z_t + z_{t,\Delta s_\phi }(t)&= \theta _0(R_t,S_t)+ \theta _0(R_{t,\Delta s_\phi }(t), S_{t,\Delta s_\phi }(t))\\&= 0 , \ \forall \phi \in [1,99], \ \forall R_t,S_t \in \{0,1\}^{100}. \end{aligned}$$

  So, $\Psi _{s_\phi }^1[0]=1$ for all $\phi \in [1,99]$.

• E. Since $\theta _1$ is a function of $r_0,r_{67},s_{34},r_{99},s_{99}$ only, for any $\phi \in [1,99]{\setminus } \{34,99\}$ we have

  $$\begin{aligned}\theta _1(R_{t,\Delta s_\phi }(t), S_{t,\Delta s_\phi }(t)) = \theta _1(R_t,S_t). \end{aligned}$$

  Therefore $z_{t+1} + z_{t+1,\Delta s_\phi }(t)$ equals

  $$\begin{aligned}&\theta _1(R_t,S_t)+ \theta _1(R_{t,\Delta s_\phi }(t), S_{t,\Delta s_\phi }(t))\\&\quad = 0, \ \forall \phi \in [1,99]{\setminus }\{34,99\}, \ \forall R_t,S_t \in \{0,1\}^{100}. \end{aligned}$$

  So, $\Psi _{s_\phi }^1[1]=1$ for all $\phi \in [1,99]{\setminus }\{34,99\}$.

• F. We have $z_{t+1} + z_{t+1,\Delta s_{99}}(t)$ equals

  $$\begin{aligned}&\theta _1(R_t,S_t)+ \theta _1(R_{t,\Delta s_{99}}(t), S_{t,\Delta s_{99}}(t))\\&\quad = (r_0^t \cdot r_{67}^t + r_0^t \cdot s_{34}^t + r_{99}^t + s_{99}^t)\\&\quad \quad +\,(r_0^t \cdot r_{67}^t + r_0^t \cdot s_{34}^t + r_{99}^t + 1+s_{99}^t)\\&\quad = 1, \ \forall R_t,S_t \in \{0,1\}^{100}. \end{aligned}$$

  So, $\Psi _{s_{99}}^2[1]=1$. Also $z_{t+1} + z_{t+1,\Delta s_{34}}(t)$ equals

  $$\begin{aligned}&\theta _1(R_t,S_t)+ \theta _1(R_{t,\Delta s_{34}}(t), S_{t,\Delta s_{34}}(t))\\&\quad =(r_0^t \cdot r_{67}^t + r_0^t \cdot s_{34}^t + r_{99}^t + s_{99}^t) \\&\quad \quad +\, (r_0^t \cdot r_{67}^t + r_0^t \cdot (1+s_{34}^t) + r_{99}^t + s_{99}^t)\\&\quad =r_0^t \ne 0 \text{ or } 1, \ \forall R_t,S_t \in \{0,1\}^{100}. \end{aligned}$$

  So, $\Psi _{s_{34}}^2[1]=0$.

Appendix B: 187.25 faults are sufficient to deduce $r_0^t=1$ and find ${ CR}^t$

From Sect. 5.2, we know that we have a total of 297 different faulty streams. To deduce that $r_0^t=1$ and find $CR^t$, by injecting random faults, we want to obtain 4 different streams out of a set of 9 specific streams and 1 out of a set of 3 other streams. To find the expected number of faults to achieve this target, we will use the following proposition.

Proposition 7

Consider five real numbers $a_1, \ldots , a_5$ in $(0,1)$. Then, we have the following identities

• 1. $\displaystyle \sum _{r_1=0}^{\infty } \cdots \sum _{r_5=0}^{\infty } ~\left[ \prod _{i=1}^5 a_i^{r_i}\right] = \prod _{i=1}^5 \frac{1}{ (1-a_i)}$

• 2. $\displaystyle \sum _{\begin{array}{c} r_1=0\\ \vdots \\ r_5=0 \end{array}}^{\infty } ~\left[ \sum _{i=1}^5 r_i \cdot \prod _{i=1}^5 a_i^{r_i}\right] =\sum _{i=1}^5 \frac{a_i}{(1-a_i)^2} \prod _{\begin{array}{c} j=1\\ j \ne i \end{array}}^5 \frac{1}{ (1-a_j)}$

Suppose, we first obtain the 4 streams of the set of 9 in $r_1+1, r_1+r_2+2, r_1+r_2+r_3+3$ and $r_1+r_2+r_3+r_4+4$ attempts respectively. Thereafter, we obtain the remaining streams from the set of 3 after another $r_5+1$ trials, i.e., we require $r_1+r_2+r_3+r_4+r_5+5$ faults in total. We call this event $\mathcal {E}_{r_1,\ldots , r_5}$. Then $\mathsf{Pr}(\mathcal {E}_{r_1,\ldots , r_5})=$

$$\begin{aligned}&\!a_1^{r_1} \frac{9}{297} \cdot a_2^{r_2} \cdot \frac{8}{297} \cdot a_3^{r_3} \cdot \frac{7}{297} \cdot a_4^{r_4} \cdot \frac{6}{297} \cdot a_5^{r_5} \cdot \frac{3}{297}\\&~=a_1^{r_1} a_2^{r_2} a_3^{r_3} a_4^{r_4} a_5^{r_5} \cdot \frac{9{,}072}{297^5}, \end{aligned}$$

where $a_1= \frac{285}{297},a_2=\frac{286}{297}, a_3=\frac{287}{297}, a_4=\frac{288}{297}, a_5=\frac{294}{297}$. Here $a_i$’s denote the failure probabilities, i.e., $a_i$ denotes the probability that, after obtaining $i-1$ required streams, a random fault produces no stream of interest.

We may also fulfill our target by some other “ordering” of events. For example, we first obtain 3 streams from the set of 9, then the single stream from the other set of 3 and finally the remaining stream from the first set. There are 5 orderings in total. Denote by $b_i,c_i,d_i,e_i$ the failure probabilities, in each of the other orderings.

It is easy to see that, $b_1= c_1= d_1=e_1=a_1, \ b_2=c_2=d_2=a_2, b_3=c_3=a_3, \ b_4=a_4, \ b_5=c_5= d_5= e_5 = \frac{291}{297}, \ c_4=d_4=e_4=\frac{290}{297}, \ d_3= e_3= \frac{289}{297}, \ e_2=\frac{288}{297}.$

Considering all cases, the required expected value is

$$\begin{aligned} E = \displaystyle \sum _{\begin{array}{c} r_1=0\\ \cdot \\ \cdot \\ r_5=0 \end{array}}^{\infty } \left( 5+\sum _{i=0}^5 r_i\right) \bigg (\prod _{i=1}^5 a_i^{r_i} +\cdots + \prod _{i=1}^5 e_i^{r_i} \bigg )\cdot \frac{9072}{297^5} \end{aligned}$$

Now using Proposition 7, we get $E= 187.25$.

Appendix C: The functions $\rho _i$ $\forall i \in [0,99]$

$i$	$\rho _i$
$0$	$r_{0}\cdot r_{67} + r_{0}\cdot s_{34} + r_{99}$
$1$	$r_{0} + r_{1}\cdot r_{67} + r_{1}\cdot s_{34} + r_{99}$
$2$	$r_{1} + r_{2}\cdot r_{67} + r_{2}\cdot s_{34}$
$3$	$r_{2} + r_{3}\cdot r_{67} + r_{3}\cdot s_{34} + r_{99}$
$4$	$r_{3} + r_{4}\cdot r_{67} + r_{4}\cdot s_{34} + r_{99}$
$5$	$r_{4} + r_{5}\cdot r_{67} + r_{5}\cdot s_{34} + r_{99}$
$6$	$r_{5} + r_{6}\cdot r_{67} + r_{6}\cdot s_{34} + r_{99}$
$7$	$r_{6} + r_{7}\cdot r_{67} + r_{7}\cdot s_{34}$
$8$	$r_{7} + r_{8}\cdot r_{67} + r_{8}\cdot s_{34}$
$9$	$r_{8} + r_{9}\cdot r_{67} + r_{9}\cdot s_{34} + r_{99}$
$10$	$r_{9} + r_{10}\cdot r_{67} + r_{10}\cdot s_{34}$
$11$	$r_{10} + r_{11}\cdot r_{67} + r_{11}\cdot s_{34}$
$12$	$r_{11} + r_{12}\cdot r_{67} + r_{12}\cdot s_{34} + r_{99}$
$13$	$r_{12} + r_{13}\cdot r_{67} + r_{13}\cdot s_{34} + r_{99}$
$14$	$r_{13} + r_{14}\cdot r_{67} + r_{14}\cdot s_{34}$
$15$	$r_{14} + r_{15}\cdot r_{67} + r_{15}\cdot s_{34}$
$16$	$r_{15} + r_{16}\cdot r_{67} + r_{16}\cdot s_{34} + r_{99}$
$17$	$r_{16} + r_{17}\cdot r_{67} + r_{17}\cdot s_{34}$
$18$	$r_{17} + r_{18}\cdot r_{67} + r_{18}\cdot s_{34}$
$19$	$r_{18} + r_{19}\cdot r_{67} + r_{19}\cdot s_{34} + r_{99}$
$20$	$r_{19} + r_{20}\cdot r_{67} + r_{20}\cdot s_{34} + r_{99}$
$21$	$r_{20} + r_{21}\cdot r_{67} + r_{21}\cdot s_{34} + r_{99}$
$22$	$r_{21} + r_{22}\cdot r_{67} + r_{22}\cdot s_{34} + r_{99}$
$23$	$r_{22} + r_{23}\cdot r_{67} + r_{23}\cdot s_{34}$
$24$	$r_{23} + r_{24}\cdot r_{67} + r_{24}\cdot s_{34}$
$25$	$r_{24} + r_{25}\cdot r_{67} + r_{25}\cdot s_{34} + r_{99}$
$26$	$r_{25} + r_{26}\cdot r_{67} + r_{26}\cdot s_{34}$
$27$	$r_{26} + r_{27}\cdot r_{67} + r_{27}\cdot s_{34}$
$28$	$r_{27} + r_{28}\cdot r_{67} + r_{28}\cdot s_{34} + r_{99}$
$29$	$r_{28} + r_{29}\cdot r_{67} + r_{29}\cdot s_{34}$
$30$	$r_{29} + r_{30}\cdot r_{67} + r_{30}\cdot s_{34}$
$31$	$r_{30} + r_{31}\cdot r_{67} + r_{31}\cdot s_{34}$
$32$	$r_{31} + r_{32}\cdot r_{67} + r_{32}\cdot s_{34}$
$33$	$r_{32} + r_{33}\cdot r_{67} + r_{33}\cdot s_{34}$
$34$	$r_{33} + r_{34}\cdot r_{67} + r_{34}\cdot s_{34}$
$35$	$r_{34} + r_{35}\cdot r_{67} + r_{35}\cdot s_{34}$
$36$	$r_{35} + r_{36}\cdot r_{67} + r_{36}\cdot s_{34}$
$37$	$r_{36} + r_{37}\cdot r_{67} + r_{37}\cdot s_{34} + r_{99}$
$38$	$r_{37} + r_{38}\cdot r_{67} + r_{38}\cdot s_{34} + r_{99}$
$39$	$r_{38} + r_{39}\cdot r_{67} + r_{39}\cdot s_{34}$
$40$	$r_{39} + r_{40}\cdot r_{67} + r_{40}\cdot s_{34}$
$41$	$r_{40} + r_{41}\cdot r_{67} + r_{41}\cdot s_{34} + r_{99}$
$42$	$r_{41} + r_{42}\cdot r_{67} + r_{42}\cdot s_{34} + r_{99}$
$43$	$r_{42} + r_{43}\cdot r_{67} + r_{43}\cdot s_{34}$
$44$	$r_{43} + r_{44}\cdot r_{67} + r_{44}\cdot s_{34}$
$45$	$r_{44} + r_{45}\cdot r_{67} + r_{45}\cdot s_{34} + r_{99}$
$46$	$r_{45} + r_{46}\cdot r_{67} + r_{46}\cdot s_{34} + r_{99}$
$47$	$r_{46} + r_{47}\cdot r_{67} + r_{47}\cdot s_{34}$
$48$	$r_{47} + r_{48}\cdot r_{67} + r_{48}\cdot s_{34}$
$49$	$r_{48} + r_{49}\cdot r_{67} + r_{49}\cdot s_{34}$
$50$	$r_{49} + r_{50}\cdot r_{67} + r_{50}\cdot s_{34} + r_{99}$
$51$	$r_{50} + r_{51}\cdot r_{67} + r_{51}\cdot s_{34}$
$52$	$r_{51} + r_{52}\cdot r_{67} + r_{52}\cdot s_{34} + r_{99}$
$53$	$r_{52} + r_{53}\cdot r_{67} + r_{53}\cdot s_{34}$
$54$	$r_{53} + r_{54}\cdot r_{67} + r_{54}\cdot s_{34} + r_{99}$
$55$	$r_{54} + r_{55}\cdot r_{67} + r_{55}\cdot s_{34}$
$56$	$r_{55} + r_{56}\cdot r_{67} + r_{56}\cdot s_{34} + r_{99}$
$57$	$r_{56} + r_{57}\cdot r_{67} + r_{57}\cdot s_{34}$
$58$	$r_{57} + r_{58}\cdot r_{67} + r_{58}\cdot s_{34} + r_{99}$
$59$	$r_{58} + r_{59}\cdot r_{67} + r_{59}\cdot s_{34}$
$60$	$r_{59} + r_{60}\cdot r_{67} + r_{60}\cdot s_{34} + r_{99}$
$61$	$r_{60} + r_{61}\cdot r_{67} + r_{61}\cdot s_{34} + r_{99}$
$62$	$r_{61} + r_{62}\cdot r_{67} + r_{62}\cdot s_{34}$
$63$	$r_{62} + r_{63}\cdot r_{67} + r_{63}\cdot s_{34} + r_{99}$
$64$	$r_{63} + r_{64}\cdot r_{67} + r_{64}\cdot s_{34} + r_{99}$
$65$	$r_{64} + r_{65}\cdot r_{67} + r_{65}\cdot s_{34} + r_{99}$
$66$	$r_{65} + r_{66}\cdot r_{67} + r_{66}\cdot s_{34} + r_{99}$
$67$	$r_{66} + r_{67}\cdot s_{34} + r_{67} + r_{99}$
$68$	$r_{67}\cdot r_{68} + r_{67} + r_{68}\cdot s_{34}$
$69$	$r_{67}\cdot r_{69} + r_{68} + r_{69}\cdot s_{34}$
$70$	$r_{67}\cdot r_{70} + r_{69} + r_{70}\cdot s_{34}$
$71$	$r_{67}\cdot r_{71} + r_{70} + r_{71}\cdot s_{34} + r_{99}$
$72$	$r_{67}\cdot r_{72} + r_{71} + r_{72}\cdot s_{34} + r_{99}$
$73$	$r_{67}\cdot r_{73} + r_{72} + r_{73}\cdot s_{34}$
$74$	$r_{67}\cdot r_{74} + r_{73} + r_{74}\cdot s_{34}$
$75$	$r_{67}\cdot r_{75} + r_{74} + r_{75}\cdot s_{34}$
$76$	$r_{67}\cdot r_{76} + r_{75} + r_{76}\cdot s_{34}$
$77$	$r_{67}\cdot r_{77} + r_{76} + r_{77}\cdot s_{34}$
$78$	$r_{67}\cdot r_{78} + r_{77} + r_{78}\cdot s_{34}$
$79$	$r_{67}\cdot r_{79} + r_{78} + r_{79}\cdot s_{34} + r_{99}$
$80$	$r_{67}\cdot r_{80} + r_{79} + r_{80}\cdot s_{34} + r_{99}$
$81$	$r_{67}\cdot r_{81} + r_{80} + r_{81}\cdot s_{34} + r_{99}$
$82$	$r_{67}\cdot r_{82} + r_{81} + r_{82}\cdot s_{34} + r_{99}$
$83$	$r_{67}\cdot r_{83} + r_{82} + r_{83}\cdot s_{34}$
$84$	$r_{67}\cdot r_{84} + r_{83} + r_{84}\cdot s_{34}$
$85$	$r_{67}\cdot r_{85} + r_{84} + r_{85}\cdot s_{34}$
$86$	$r_{67}\cdot r_{86} + r_{85} + r_{86}\cdot s_{34}$
$87$	$r_{67}\cdot r_{87} + r_{86} + r_{87}\cdot s_{34} + r_{99}$
$88$	$r_{67}\cdot r_{88} + r_{87} + r_{88}\cdot s_{34} + r_{99}$
$89$	$r_{67}\cdot r_{89} + r_{88} + r_{89}\cdot s_{34} + r_{99}$
$90$	$r_{67}\cdot r_{90} + r_{89} + r_{90}\cdot s_{34} + r_{99}$
$91$	$r_{67}\cdot r_{91} + r_{90} + r_{91}\cdot s_{34} + r_{99}$
$92$	$r_{67}\cdot r_{92} + r_{91} + r_{92}\cdot s_{34} + r_{99}$
$93$	$r_{67}\cdot r_{93} + r_{92} + r_{93}\cdot s_{34}$
$94$	$r_{67}\cdot r_{94} + r_{93} + r_{94}\cdot s_{34} + r_{99}$
$95$	$r_{67}\cdot r_{95} + r_{94} + r_{95}\cdot s_{34} + r_{99}$
$96$	$r_{67}\cdot r_{96} + r_{95} + r_{96}\cdot s_{34} + r_{99}$
$97$	$r_{67}\cdot r_{97} + r_{96} + r_{97}\cdot s_{34} + r_{99}$
$98$	$r_{67}\cdot r_{98} + r_{97} + r_{98}\cdot s_{34}$
$99$	$r_{67}\cdot r_{99} + r_{98} + r_{99}\cdot s_{34}$

The functions $\beta _i\,\forall i \in [0,99]$

$0$	$s_{99}$
$1$	$s_{0} + s_{1}\cdot s_{2} + s_{1} + s_{99}$
$2$	$s_{1} + s_{2}\cdot s_{3} + s_{99}$
$3$	$r_{33}\cdot s_{99} + s_{2} + s_{3}\cdot s_{4} + s_{3} + s_{67}\cdot s_{99} + s_{99}$
$4$	$r_{33}\cdot s_{99} + s_{3} + s_{4}\cdot s_{5} + s_{4} + s_{5} + s_{67}\cdot s_{99} + 1$
$5$	$s_{4} + s_{5}\cdot s_{6} + s_{6} + s_{99}$
$6$	$r_{33}\cdot s_{99} + s_{5} + s_{6}\cdot s_{7} + s_{67}\cdot s_{99}$
$7$	$r_{33}\cdot s_{99} + s_{6} + s_{7}\cdot s_{8} + s_{7} + s_{67}\cdot s_{99} + s_{99}$
$8$	$r_{33}\cdot s_{99} + s_{7} + s_{8}\cdot s_{9} + s_{67}\cdot s_{99} + s_{99}$
$9$	$r_{33}\cdot s_{99} + s_{8} + s_{9}\cdot s_{10} + s_{9} + s_{10} + s_{67}\cdot s_{99} + s_{99} + 1 ~~~$
$10$	$r_{33}\cdot s_{99} + s_{9} + s_{10}\cdot s_{11} + s_{10} + s_{67}\cdot s_{99} + s_{99}$
$11$	$s_{10} + s_{11}\cdot s_{12} + s_{11} + s_{12} + s_{99} + 1$
$12$	$s_{11} + s_{12}\cdot s_{13} + s_{12} + s_{13} + s_{99} + 1$
$13$	$s_{12} + s_{13}\cdot s_{14} + s_{14} + s_{99}$
$14$	$r_{33}\cdot s_{99} + s_{13} + s_{14}\cdot s_{15} + s_{15} + s_{67}\cdot s_{99} + s_{99}$
$15$	$r_{33}\cdot s_{99} + s_{14} + s_{15}\cdot s_{16} + s_{15} + s_{67}\cdot s_{99}$
$16$	$s_{15} + s_{16}\cdot s_{17} + s_{17}$
$17$	$r_{33}\cdot s_{99} + s_{16} + s_{17}\cdot s_{18} + s_{17} + s_{67}\cdot s_{99} + s_{99}$
$18$	$r_{33}\cdot s_{99} + s_{17} + s_{18}\cdot s_{19} + s_{67}\cdot s_{99}$
$19$	$s_{18} + s_{19}\cdot s_{20} + s_{20} + s_{99}$
$20$	$r_{33}\cdot s_{99} + s_{19} + s_{20}\cdot s_{21} + s_{67}\cdot s_{99} + s_{99}$
$21$	$r_{33}\cdot s_{99} + s_{20} + s_{21}\cdot s_{22} + s_{21} + s_{22} + s_{67}\cdot s_{99} + s_{99} + 1$
$22$	$r_{33}\cdot s_{99} + s_{21} + s_{22}\cdot s_{23} + s_{22} + s_{67}\cdot s_{99} + s_{99}$
$23$	$s_{22} + s_{23}\cdot s_{24} + s_{24} + s_{99}$
$24$	$r_{33}\cdot s_{99} + s_{23} + s_{24}\cdot s_{25} + s_{24} + s_{67}\cdot s_{99} + s_{99}$
$25$	$r_{33}\cdot s_{99} + s_{24} + s_{25}\cdot s_{26} + s_{26} + s_{67}\cdot s_{99} + s_{99}$
$26$	$s_{25} + s_{26}\cdot s_{27} + s_{26} + s_{99}$
$27$	$s_{26} + s_{27}\cdot s_{28} + s_{27} + s_{28} + s_{99} + 1$
$28$	$r_{33}\cdot s_{99} + s_{27} + s_{28}\cdot s_{29} + s_{28} + s_{67}\cdot s_{99} + s_{99}$
$29$	$s_{28} + s_{29}\cdot s_{30} + s_{30}$
$30$	$r_{33}\cdot s_{99} + s_{29} + s_{30}\cdot s_{31} + s_{30} + s_{31} + s_{67}\cdot s_{99} + 1$
$31$	$r_{33}\cdot s_{99} + s_{30} + s_{31}\cdot s_{32} + s_{31} + s_{67}\cdot s_{99} + s_{99}$
$32$	$s_{31} + s_{32}\cdot s_{33} + s_{32} + s_{33} + s_{99} + 1$
$33$	$r_{33}\cdot s_{99} + s_{32} + s_{33}\cdot s_{34} + s_{33} + s_{67}\cdot s_{99}$
$34$	$s_{33} + s_{34}\cdot s_{35}$
$35$	$s_{34} + s_{35}\cdot s_{36} + s_{36}$
$36$	$s_{35} + s_{36}\cdot s_{37}$
$37$	$r_{33}\cdot s_{99} + s_{36} + s_{37}\cdot s_{38} + s_{37} + s_{67}\cdot s_{99}$
$38$	$r_{33}\cdot s_{99} + s_{37} + s_{38}\cdot s_{39} + s_{38} + s_{67}\cdot s_{99}$
$39$	$r_{33}\cdot s_{99} + s_{38} + s_{39}\cdot s_{40} + s_{67}\cdot s_{99} + s_{99}$
$40$	$r_{33}\cdot s_{99} + s_{39} + s_{40}\cdot s_{41} + s_{40} + s_{67}\cdot s_{99} + s_{99}$
$41$	$r_{33}\cdot s_{99} + s_{40} + s_{41}\cdot s_{42} + s_{67}\cdot s_{99} + s_{99}$
$42$	$s_{41} + s_{42}\cdot s_{43} + s_{42}$
$43$	$s_{42} + s_{43}\cdot s_{44} + s_{43} + s_{44} + 1$
$44$	$s_{43} + s_{44}\cdot s_{45} + s_{44} + s_{99}$
$45$	$r_{33}\cdot s_{99} + s_{44} + s_{45}\cdot s_{46} + s_{46} + s_{67}\cdot s_{99}$
$46$	$s_{45} + s_{46}\cdot s_{47}$
$47$	$s_{46} + s_{47}\cdot s_{48} + s_{48} + s_{99}$
$48$	$r_{33}\cdot s_{99} + s_{47} + s_{48}\cdot s_{49} + s_{67}\cdot s_{99}$
$49$	$r_{33}\cdot s_{99} + s_{48} + s_{49}\cdot s_{50} + s_{49} + s_{50} + s_{67}\cdot s_{99} + s_{99} + 1$
$50$	$s_{49} + s_{50}\cdot s_{51}$
$51$	$r_{33}\cdot s_{99} + s_{50} + s_{51}\cdot s_{52} + s_{67}\cdot s_{99} + s_{99}$
$52$	$r_{33}\cdot s_{99} + s_{51} + s_{52}\cdot s_{53} + s_{67}\cdot s_{99}$
$53$	$s_{52} + s_{53}\cdot s_{54} + s_{53}$
$54$	$r_{33}\cdot s_{99} + s_{53} + s_{54}\cdot s_{55} + s_{55} + s_{67}\cdot s_{99} + s_{99}$
$55$	$s_{54} + s_{55}\cdot s_{56} + s_{55}$
$56$	$s_{55} + s_{56}\cdot s_{57} + s_{56} + s_{57} + s_{99} + 1$
$57$	$r_{33}\cdot s_{99} + s_{56} + s_{57}\cdot s_{58} + s_{57} + s_{67}\cdot s_{99} + s_{99}$
$58$	$r_{33}\cdot s_{99} + s_{57} + s_{58}\cdot s_{59} + s_{67}\cdot s_{99} + s_{99}$
$59$	$s_{58} + s_{59}\cdot s_{60} + s_{60} + s_{99}$
$60$	$s_{59} + s_{60}\cdot s_{61} + s_{61}$
$61$	$r_{33}\cdot s_{99} + s_{60} + s_{61}\cdot s_{62} + s_{61} + s_{62} + s_{67}\cdot s_{99} + s_{99} + 1$
$62$	$r_{33}\cdot s_{99} + s_{61} + s_{62}\cdot s_{63} + s_{62} + s_{63} + s_{67}\cdot s_{99} + 1$
$63$	$r_{33}\cdot s_{99} + s_{62} + s_{63}\cdot s_{64} + s_{63} + s_{67}\cdot s_{99} + s_{99}$
$64$	$r_{33}\cdot s_{99} + s_{63} + s_{64}\cdot s_{65} + s_{64} + s_{67}\cdot s_{99}$
$65$	$s_{64} + s_{65}\cdot s_{66} + s_{65} + s_{66} + s_{99} + 1$
$66$	$s_{65} + s_{66}\cdot s_{67} + s_{66}$
$67$	$r_{33}\cdot s_{99} + s_{66} + s_{67}\cdot s_{68} + s_{67}\cdot s_{99} + s_{68}$
$68$	$s_{67} + s_{68}\cdot s_{69} + s_{68}$
$69$	$r_{33}\cdot s_{99} + s_{67}\cdot s_{99} + s_{68} + s_{69}\cdot s_{70} + s_{70}$
$70$	$s_{69} + s_{70}\cdot s_{71} + s_{70} + s_{71} + 1$
$71$	$s_{70} + s_{71}\cdot s_{72} + s_{71} + s_{72} + 1$
$72$	$r_{33}\cdot s_{99} + s_{67}\cdot s_{99} + s_{71} + s_{72}\cdot s_{73} + s_{72} + s_{73} + 1$
$73$	$s_{72} + s_{73}\cdot s_{74} + s_{74}$
$74$	$r_{33}\cdot s_{99} + s_{67}\cdot s_{99} + s_{73} + s_{74}\cdot s_{75} + s_{74} + s_{75} + 1$
$75$	$r_{33}\cdot s_{99} + s_{67}\cdot s_{99} + s_{74} + s_{75}\cdot s_{76} + s_{75} + s_{76} + s_{99} + 1$
$76$	$r_{33}\cdot s_{99} + s_{67}\cdot s_{99} + s_{75} + s_{76}\cdot s_{77} + s_{76} + s_{77} + s_{99} + 1$
$77$	$s_{76} + s_{77}\cdot s_{78} + s_{77} + s_{78} + 1$
$78$	$s_{77} + s_{78}\cdot s_{79} + s_{99}$
$79$	$r_{33}\cdot s_{99} + s_{67}\cdot s_{99} + s_{78} + s_{79}\cdot s_{80} + s_{80}$
$80$	$r_{33}\cdot s_{99} + s_{67}\cdot s_{99} + s_{79} + s_{80}\cdot s_{81}$
$81$	$r_{33}\cdot s_{99} + s_{67}\cdot s_{99} + s_{80} + s_{81}\cdot s_{82} + s_{81} + s_{82} + 1$
$82$	$r_{33}\cdot s_{99} + s_{67}\cdot s_{99} + s_{81} + s_{82}\cdot s_{83} + s_{83} + s_{99}$
$83$	$s_{82} + s_{83}\cdot s_{84} + s_{84} + s_{99}$
$84$	$r_{33}\cdot s_{99} + s_{67}\cdot s_{99} + s_{83} + s_{84}\cdot s_{85} + s_{85}$
$85$	$s_{84} + s_{85}\cdot s_{86} + s_{86} + s_{99}$
$86$	$s_{85} + s_{86}\cdot s_{87} + s_{86} + s_{87} + s_{99} + 1$
$87$	$s_{86} + s_{87}\cdot s_{88} + s_{87} + s_{99}$
$88$	$s_{87} + s_{88}\cdot s_{89} + s_{88} + s_{89} + 1$
$89$	$s_{88} + s_{89}\cdot s_{90}$
$90$	$r_{33}\cdot s_{99} + s_{67}\cdot s_{99} + s_{89} + s_{90}\cdot s_{91} + s_{91} + s_{99}$
$91$	$r_{33}\cdot s_{99} + s_{67}\cdot s_{99} + s_{90} + s_{91}\cdot s_{92} + s_{99}$
$92$	$r_{33}\cdot s_{99} + s_{67}\cdot s_{99} + s_{91} + s_{92}\cdot s_{93} + s_{92} + s_{99}$
$93$	$s_{92} + s_{93}\cdot s_{94}$
$94$	$r_{33}\cdot s_{99} + s_{67}\cdot s_{99} + s_{93} + s_{94}\cdot s_{95}$
$95$	$r_{33}\cdot s_{99} + s_{67}\cdot s_{99} + s_{94} + s_{95}\cdot s_{96} + s_{95} + s_{99}$
$96$	$r_{33}\cdot s_{99} + s_{67}\cdot s_{99} + s_{95} + s_{96}\cdot s_{97} + s_{96} + s_{99}$
$97$	$s_{96} + s_{97}\cdot s_{98} + s_{98}$
$98$	$s_{97} + s_{98}\cdot s_{99} + s_{99}$
$99$	$r_{33}\cdot s_{99} + s_{67}\cdot s_{99} + s_{98}$