Cryptanalysis of Grain

Abstract. Grain [11] is a lightweight stream cipher submitted by M. Hell, T. Johansson, and W. Meier to the eSTREAM call for stream cipher proposals of the European project ECRYPT [5]. Its 160-bit internal state is divided into a LFSR and an NLFSR of length 80 bits each. A filtering boolean function is used to derive each keystream bit from the internal state. By combining linear approximations of the feedback function of the NLFSR and of the filtering function, it is possible to derive linear approximation equations involving the keystream and the LFSR initial state. We present a key recovery attack against Grain which requires 243 computations and 238 keystream bits to determine the 80-bit key.

• Type: Conference
• Year: 2006
• Where: FSE
• Authors: Côme Berbain, Henri Gilbert, Alexander Maximov
• Keywords: Cryptology, FSE 2006, Internal State, Lightweight Stream Cipher, Stream Cipher