Cryptanalysis of Rabbit
The stream cipher Rabbit is one candidate to the ECRYPT Stream Cipher Project (eSTREAM) on the third evaluation phase. It has a 128-bit key, 64-bit IV and 513-bit internal state. Currently, only one paper  studied it besides a series of white papers by the authors of Rabbit. In , the bias of the keystream sub-blocks was studied and a distinguishing attack with the estimated complexity 2247 was proposed based on the largest bias computed.
In this paper, we first computed the exact bias of the keystream sub-blocks by Fast Fourier Transform (FFT). Our result leads to the best distinguishing attack with the complexity 2158 so far, in comparison to 2247 in . Meanwhile, our result also indicates that the approximation assumption used in  is critical for estimation of the bias and cannot be ignored. Secondly, our distinguishing attack is extended to a multi-frame key-recovery attack, assuming that the relation between part of the internal states of all frames is known. Our attack uses 251.5 frames and the first three keystream blocks of each frame. It takes memory O(232), precomputation O(232) and time O(297.5) to recover the keys for all frames. This is the first known key-recovery attack on Rabbit, though the attack assumption is unusually strong. Lastly, as an independent result, we introduced the property of Almost-Right-Distributivity of the bit-wise rotation over the modular addition for our algebraic analysis.This allows to solve the nonlinear yet symmetric equation system more efficiently for our problem.
KeywordsRabbit ECRYPT stream cipher keystream bias distinguishing attack
Unable to display preview. Download preview PDF.
- 1.Aumasson, J.-P.: On a bias of Rabbit (January 2007), http://eprint.iacr.org/2007/033
- 2.Baignères, T., Junod, P., Vaudenay, S.: How far can we go beyond linear cryptanalysis? In: Lee, P.J. (ed.) ASIACRYPT 2004. LNCS, vol. 3329, pp. 432–450. Springer, Heidelberg (2004)Google Scholar
- 3.Biham, E., Dunkelman, O.: Differential cryptanalysis in stream ciphers(2007), http://eprint.iacr.org/2007/218
- 4.Boesgaard, M., Vesterager, M., Pedersen, T., Christiansen, J., Scavenius, O.: Rabbit: A new high-performance stream cipher. In: Johansson, T. (ed.) FSE 2003. LNCS, vol. 2887, pp. 307–329. Springer, Heidelberg (2003)Google Scholar
- 5.Boesgaard, M., Vesterager, M., Christensen, T., Zenner, E.: The stream cipher Rabbit, the ECRYPT stream cipher project - eSTREAM Report 2005/024 (2005), http://www.ecrypt.eu.org/stream/
- 7.Cryptico A/S, Algebraic analysis of rabbit, 2003. White paper.Google Scholar
- 8.Cryptico A/S, Analysis of the key setup function in rabbit, White paper (2003)Google Scholar
- 9.Cryptico A/S, Hamming weights of the g-function, White paper (2003)Google Scholar
- 10.Cryptico A/S, Periodic properties of rabbit, White paper (2003)Google Scholar
- 11.Cryptico A/S, Second degree approximations of the g-function, White paper (2003)Google Scholar
- 12.Cryptico A/S, Security analysis of the IV-setup for rabbit, White paper (2003)Google Scholar
- 13.Matsui, M.: Linear cryptanalysis method for DES cipher, EUROCRYPT 1993. In: Helleseth, T. (ed.) EUROCRYPT 1993. LNCS, vol. 765, pp. 386–397. Springer, Heidelberg (1994)Google Scholar