A New Attack on the LEX Stream Cipher

  • Orr Dunkelman
  • Nathan Keller
Part of the Lecture Notes in Computer Science book series (LNCS, volume 5350)


In [6], Biryukov presented a new methodology of stream cipher design, called leak extraction. The stream cipher LEX, based on this methodology and on the AES block cipher, was selected to phase 3 of the eSTREAM competition. The suggested methodology seemed promising, and LEX, due to its elegance, simplicity and performance was expected to be selected to the eSTREAM portfolio.

In this paper we present a key recovery attack on LEX. The attack requires about 236.3 bytes of key-stream produced by the same key (possibly under many different IVs), and retrieves the secret key in time of 2112 simple operations. Following a preliminary version of our attack, LEX was discarded from the final portfolio of eSTREAM.


LEX AES stream cipher design 


  1. 1.
    Babbage, S.H., Dodd, M.: Specification of the Stream Cipher Mickey 2.0, submitted to eSTREAM (2006), http://www.ecrypt.eu.org/stream/p3ciphers/mickey/mickey_p3.pdf
  2. 2.
    Babbage, S.H: Improved “exhaustive search” attacks on stream ciphers. In: IEE European Convention on Security and Detection, IEE Conference publication, vol. 408, pp. 161–165. IEE (1995)Google Scholar
  3. 3.
    Bernstein, D.J.: Personal communication (2008)Google Scholar
  4. 4.
    Biham, E., Shamir, A.: Differential Cryptanalysis of the Data Encryption Standard. Springer, Heidelberg (1993)CrossRefMATHGoogle Scholar
  5. 5.
    Biham, E., Shamir, A.: Differential Fault Analysis of Secret Key Cryptosystems. In: Kaliski Jr., B.S. (ed.) CRYPTO 1997. LNCS, vol. 1294, pp. 513–525. Springer, Heidelberg (1997)CrossRefGoogle Scholar
  6. 6.
    Biryukov, A.: The Design of a Stream Cipher LEX. In: Biham, E., Youssef, A.M. (eds.) SAC 2006. LNCS, vol. 4356, pp. 67–75. Springer, Heidelberg (2007)CrossRefGoogle Scholar
  7. 7.
    Biryukov, A.: A New 128-bit Key Stream Cipher LEX, ECRYPT stream cipher project report 2005/013, http://www.ecrypt.eu.org/stream
  8. 8.
    Biryukov, A.: The Tweak for LEX-128, LEX-192, LEX-256, ECRYPT stream cipher project report 2006/037, http://www.ecrypt.eu.org/stream
  9. 9.
    Biryukov, A., Mukhopadhyay, S., Sarkar, P.: Improved Time-Memory Tradeoffs with Multiple Data. In: Preneel, B., Tavares, S. (eds.) SAC 2005. LNCS, vol. 3897, pp. 245–260. Springer, Heidelberg (2006)CrossRefGoogle Scholar
  10. 10.
    Biryukov, A., Shamir, A.: Cryptanalytic Time/Memory/Data Tradeoffs for Stream Ciphers. In: Okamoto, T. (ed.) ASIACRYPT 2000. LNCS, vol. 1976, pp. 1–13. Springer, Heidelberg (2000)CrossRefGoogle Scholar
  11. 11.
    Blum, M., Micali, S.: How to Generate Cryptographically Strong Sequences of Pseudo-Random Bits. SIAM Journal of Computation 13(4), 850–864 (1984)CrossRefMATHGoogle Scholar
  12. 12.
    Boneh, D., DeMillo, R.A., Lipton, R.J.: On the Importance of Checking Cryptographic Protocols for Faults (Extended Abstract). In: Fumy, W. (ed.) EUROCRYPT 1997. LNCS, vol. 1233, pp. 37–51. Springer, Heidelberg (1997)CrossRefGoogle Scholar
  13. 13.
    Daemen, J., Rijmen, V.: AES Proposal: Rijndael, NIST AES proposal (1998)Google Scholar
  14. 14.
    Daemen, J., Rijmen, V.: The design of Rijndael: AES — the Advanced Encryption Standard. Springer, Heidelberg (2002)CrossRefMATHGoogle Scholar
  15. 15.
    Dunkelman, O., Keller, N.: Treatment of the Initial Value in Time-Memory-Data Tradeoff Attacks on Stream Ciphers. Information Processing Letters 107(5), 133–137 (2008)MathSciNetCrossRefMATHGoogle Scholar
  16. 16.
    ECRYPT, Call for Stream Cipher Primitives, version 1.3 (April 12, 2005), http://www.ecrypt.eu.org/stream/call/
  17. 17.
    Englund, H., Hell, M., Johansson, T.: A Note on Distinguishing Attacks. In: Preproceedings of State of the Art of Stream Ciphers workshop (SASC 2007), Bochum, Germany, pp. 73–78 (2007)Google Scholar
  18. 18.
    Ferguson, N., Kelsey, J., Lucks, S., Schneier, B., Stay, M., Wagner, D., Whiting, D.: Improved Cryptanalysis of Rijndael. In: Schneier, B. (ed.) FSE 2000. LNCS, vol. 1978, pp. 213–230. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  19. 19.
    Goldreich, O., Levin, L.A.: A Hard-Core Predicate for all One-Way Functions. In: Proceedings of 21st STOC, pp. 25–32. ACM, New York (1989)Google Scholar
  20. 20.
    Golic, J.D.: Cryptanalysis of Alleged A5 Stream Cipher. In: Fumy, W. (ed.) EUROCRYPT 1997. LNCS, vol. 1233, pp. 239–255. Springer, Heidelberg (1997)CrossRefGoogle Scholar
  21. 21.
    Håstad, J., Näslund, M.: BMGL: Synchronous Key-stream Generator with Provable Security. NESSIE project (submitted, 2000), http://www.nessie.eu.org
  22. 22.
    National Institute of Standards and Technology, Advanced Encryption Standard, Federal Information Processing Standards Publications No. 197 (2001)Google Scholar
  23. 23.
    Wu, H., Preneel, B.: Attacking the IV Setup of Stream Cipher LEX, ECRYPT stream cipher project report 2005/059, http://www.ecrypt.eu.org/stream

Copyright information

© Springer-Verlag Berlin Heidelberg 2008

Authors and Affiliations

  • Orr Dunkelman
    • 1
  • Nathan Keller
    • 2
  1. 1.École Normale SupérieureDépartement d’Informatique, CNRS, INRIAParisFrance
  2. 2.Einstein Institute of MathematicsHebrew UniversityJerusalemIsrael

Personalised recommendations