Oliver Kniffler

Differential power analysis of stream ciphers

Side-channel attacks on block ciphers and public key algorithms have been discussed extensively. However, there is only sparse literature about side-cannel attacks on stream ciphers. The few existing references mainly treat timing [8] and template attacks [10], or provide a theoretical analysis [6], [7] of weaknesses of stream cipher constructions. In this paper we present attacks on two focus candidates, Trivium and Grain, of the eSTREAM stream cipher project. The attacks exploit the resynchronization phase of ciphers. A novel concept for choosing initial value vectors is introduced, which totally eliminates the algorithmic noise of the device, leaving only the pure side-channel signal. This attack allows to recover the secret key with a small number of samples and without building templates. To prove the concept we apply the attack to hardware implementations of the ciphers. For both stream ciphers we are able to reveal the complete key.

An NLFSR-based stream cipher

We propose a hardware oriented 80-bit-key binary additive stream cipher. The keystream generator consists of ten nonlinear feedback shift registers whose output sequences are combined by a Boolean function of algebraic degree four. The design size of the keystream generator is about 2200 GE. In 130nm CMOS-technology, a throughput of more than 1 Gbps can be achieved. The length of the initial value used for resynchronization can be any multiple of eight between zero and eighty. The maximum amount of keystream that can be used between two resynchronization steps is 268 bits. A parallel implementation of the stream cipher produces one byte of keystream per clock cycle