Analysis of Grain's Initialization Algorithm

In this paper, we analyze the initialization algorithm of Grain, one of the eSTREAM candidates which made it to the third phase of the project. We point out the existence of a sliding property in the initialization algorithm of the Grain family, and show that it can be used to reduce by half the cost of exhaustive key search (currently the most efficient attack on both Grain v1 and Grain-128). In the second part of the paper, we analyze the differential properties of the initialization, and mount several attacks, including a differential attack on Grain v1 which recovers one out of 29 keys using two related keys and 255 chosen IV pairs.

• Type: Conference
• Year: 2008
• Where: AFRICACRYPT
• Authors: Christophe De Cannière, Özgül Küçük, Bart Preneel
• Keywords: AFRICACRYPT 2008, Cryptology, ESTREAM Candidates, Exhaustive Key Search, Initialization Algorithm