Differential Cryptanalysis of the Stream Ciphers Py, Py6 and Pypy

This paper shows that Py and Pypy are practically insecure. If one key is used with about 216 IVs with special differences, with high probability two identical keystreams will appear. This can be exploited in a key recovery attack. For example, for a 16-bye key and a 16-byte IV, 223 chosen IVs can reduce the effective key size to 3 bytes. For a 32-bye key and a 32-byte IV, the effective key size is reduced to 3 bytes with 224 chosen IVs. Py6, a variant of Py, is more vulnerable to these attacks. Keywords. Differential Cryptanalysis, Stream Cipher, Py, Py6, Pypy.

• Type: Conference
• Year: 2007
• Where: EUROCRYPT
• Authors: Hongjun Wu, Bart Preneel
• Keywords: 16-bye Key, Cryptology, Effective Key Size, EUROCRYPT 2007, Key Recovery Attack