Analysis and Improvements of the Full Spritz Stream Cipher

• BANIK Subhadeep

  Temasek Labs, Nanyang Technological University

• ISOBE Takanori

  Graduate School of Applied Informatics, University of Hyogo

• MORII Masakatu

  Graduate School of Engineering, Kobe University

Abstract

Spritz is a stream cipher proposed by Rivest and Schuldt at the rump session of CRYPTO 2014. It is intended to be a replacement of the popular RC4 stream cipher. In this paper we propose distinguishing attacks on the full Spritz, based on a short-term bias in the first two bytes of a keystream and a long-term bias in the first two bytes of every cycle of N keystream bytes, where N is the size of the internal permutation. Our attacks are able to distinguish a keystream of the full Spritz from a random sequence with samples of first two bytes produced by 2^44.8 multiple key-IV pairs or 2^60.8 keystream bytes produced by a single key-IV pair. These biases are also useful in the event of plaintext recovery in a broadcast attack. In the second part of the paper, we look at a state recovery attack on Spritz, in a special situation when the cipher enters a class of weak states. We determine the probability of encountering such a state, and demonstrate a state recovery algorithm that betters the 2¹⁴⁰⁰ step algorithm of Ankele et al. at Latincrypt 2015. Finally we propose a simple fix that removes the bias in the first two keystream bytes. The countermeasure requires only one additional memory access and hence does not diminish software performance substantially, and in fact the loss in software speed is only around 1.5%.

Journal

• IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences

  IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences E100.A (6), 1296-1305, 2017

  The Institute of Electronics, Information and Communication Engineers

Keywords

• RC4
• Spritz
• stream cipher
• short-term bias
• long-term bias
• distinguishing attack
• plaintext recovery attack
• state recovery attack

Details

• CRID: 1390282681288296320
• NII Article ID: 130005685897
• DOI: 10.1587/transfun.e100.a.1296
• ISSN: 17451337
• ISSN: 09168508
• Web Site: https://www.jstage.jst.go.jp/article/transfun/E100.A/6/E100.A_1296/_pdf
• Text Lang: en
• Data Source:
  • JaLC
  • Crossref
  • CiNii Articles
  • KAKEN
• Abstract License Flag: Disallowed