    # Stream/block ciphers, difference equations and algebraic attacks

In this paper we model a class of stream and block ciphers as systems of (ordinary) explicit difference equations over a finite field. We call this class "difference ciphers" and we show that ciphers of application interest, as for example systems of LFSRs with a combiner, Trivium and Keeloq, belong to the class. By using Difference Algebra, that is, the formal theory of difference equations, we can properly define and study important properties of these ciphers, such as their invertibility and periodicity. We describe then general cryptanalytic methods for difference ciphers that follow from these properties and are useful to assess the security. We illustrate such algebraic attacks in practice by means of the ciphers Bivium and Keeloq.

## Authors

##### This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

## 1. Introduction

Stream and block ciphers are generally defined by recursive rules determining the evolution of a vector, which is called the state or register of the cipher, with entries in a finite field. The evolution runs along a discrete time corresponding to computer clocks and the key of the cipher is usually contained in the initial state.

In many important ciphers like Trivium and KeeLoq [3, 6], such recursion is defined by a state transition function which is the one corresponding to a system of (ordinary) explicit difference equations. Such systems are fundamental notion, for instance, in the theory of discrete dynamical system (see, among others, ) where the state vectors have usually real or complex coordinates.

If the difference equations are algebraic ones, which is always the case over a finite field, the theory of difference algebras (see [4, 20, 27]) provides important insights about the structure and the solutions of a system of them. In particular, by mimicking the theory of commutative algebras, one has the notion of difference ideal and corresponding difference variety. Note that a system of explicit difference equations is easier to study than the implicit case because the state transition function provides a straightforward existence and uniqueness theorem for solutions (see Theorem 2.3).

The simplest application of these ideas to ciphers (or pseudorandom number generators) are systems of Linear Feedback Shift Registers (briefly LFSRs). In this case, all difference equations defining the evolution of the cipher state are linear ones and the keystream (or pseudorandom binary sequence) is obtained by means of a combining (or filtering) function which is usually a non-linear polynomial. Note that the complete cipher can be treated as a special system of explicit difference equations where all equations except that one are linear. Another similar stream cipher is Trivium where one has three quadratic difference equations and a linear combining polynomial.

If the state transition function is invertible, one has a possible flaw for the corresponding stream cipher. In fact, by using the inverse of the difference system governing the state, some opponent may recover the initial state containing the key by attacking any internal state. This technique has been used, for instance, to attack Trivium cipher and its simplified version Bivium (see [12, 14] and Section 5 and 6).

On the other hand, if an invertible difference system contains a subsystem that can be used to evolve separately a key which is a part of the initial state of the complete system, then this flaw becomes a resource for defining a block cipher. In this case, in fact, the plaintext is defined as the complement of the key in the initial state and the corresponding ciphertext is contained in a final state. The inverse system provides hence decryption. These ideas appear, for instance, in the definition of the block cipher KeeLoq. As it happens with KeeLoq, note that a possible weackness of such a cipher may arise from having a small period for the key subsystem (see [5, 15] and Section 5 and 7).

The present paper is organized as follows. In Section 2 we introduce basic notions and results about system of (algebraic ordinary) explicit difference equations over any base field. In particular, we introduce state transition endomorphisms and difference Gröbner bases, relating such notions by means of Theorem 2.12. In Section 3, we provide a Gröbner basis method to check for invertibility of a difference system and compute its inverse system. We also introduce the concept of reducible system. Periodic systems are defined in Section 4 where we recall the method to maximize the period of a system of LFSRs over the prime field .

In Section 5, we introduce the notion of difference stream and block ciphers as ciphers that are defined by explicit difference systems over a finite field. We then discuss general methods to perform algebraic attacks on such ciphers. These attacks are experimented in details in Section 6 and 7 for Bivium and KeeLoq. Finally, in Section 8 we conclude and propose some suggestions for further developments of the theory of difference ciphers.

## 2. Explicit difference system

Let be any field and fix an integer . Consider a set of variables , for any . Put and denote by the polynomial algebra in the infinite set of variables . Moreover, consider the injective algebra endomorphism such that for all and . We call the shift map of . The algebra , endowed with the map , is called the algebra of (ordinary) difference polynomials. If we consider the subalgebra , it is clear that defines by restriction an algebra isomorphism . We also need the following notations. For any integers and , we define the subset

 X(t)r1,…,rn={x1(t),…,x1(t+r1−1),…,xn(t),…,xn(t+rn−1)}⊂X

and the subalgebra . The shift map also defines an isomorphism and we put .

###### Definition 2.1.

Let be integers and consider some polynomials . A system of (algebraic ordinary) explicit difference equations is by definition an infinite system of polynomial equations of the kind

 ⎧⎪ ⎪⎨⎪ ⎪⎩x1(r1+t)=σt(f1),⋮xn(rn+t)=σt(fn).(t≥0)

Such a system is denoted briefly as

 (1) ⎧⎪ ⎪⎨⎪ ⎪⎩x1(r1)=f1,⋮xn(rn)=fn.

A -solution of the system is clearly an -tuple of functions where . For any , the element is called the value of the function at the clock .

###### Definition 2.2.

Consider an explicit difference system . For any , we define the algebra endomorphism such that, for any

 xi(t)↦xi(t+1),…,xi(t+ri−2)↦xi(t+ri−1),xi(t+ri−1)↦σt(fi).

By abuse of notation, we have that and we put . If , we denote by the polynomial map corresponding to . For any polynomial and for each vector , one has that

 (2) T(f)(v)=f(^T(v)).

If is a -solution of and , we call the vector

 v(t)=(a1(t),…,a1(t+r1−1),…,an(t),…,an(t+rn−1))∈Kr

the state of at the clock . In particular, is the initial state of . Then, the function maps the -state into the -state , for all clocks . We call the state transition endomorphism and the state transition map of the explicit difference system (1).

We have the following existence and uniqueness theorem for the solutions of an explicit system.

###### Theorem 2.3.

Denote by the set of all -solutions of the explicit difference system . We have a bijective map such that

 (a1,…,an)↦(a1(0),…,a1(r1−1),…,an(0),…,an(rn−1)).

In other words, the system has a unique -solution once fixed its initial state. Moreover, the maps are both polynomial ones.

###### Proof.

Consider the state transition map of (1) which is a polynomial map. Observe that all powers () are also polynomial maps. If

 v(t)=(a1(t),…,a1(t+r1−1),…,an(t),…,an(t+rn−1))

denotes the -state of a -solution , the inverse map

 ι−1:v(0)↦(a1,…,an)

is obtained in the following way. The value is the first coordinate of the vector , is its -th coordinate and so on. Since projections and are polynomial maps, we conclude that is also such a map. ∎

Consider the state transition endomorphism of the system (1). Note that all powers () are also endomorphisms whose corresponding polynomial maps are the functions . For all and , we define the polynomial

 fi,t=Tt(xi(0))∈Rr1,…,rn.

By the argument of Theorem 2.3 and the identity (2), it follows that , for all -solutions .

We introduce now the notion of difference Gröbner basis which provides very often an alternative way to compute the polynomial .

###### Definition 2.4.

Let be an ideal of the algebra . We call a difference ideal if . Denote and let be a subset of . Then, we define . We call a difference basis of a difference ideal if is a basis of as an ideal of . In other words, all elements are such that where and . In this case, we denote .

Consider an explicit difference system (1) and define the subset

 G={x1(r1)−f1,…,xn(rn)−fn}⊂R.

If , we have that is a -solution of the system (1) if and only if this is a simultaneous -solution of all polynomials . Then, we also say that is a -solution of the difference ideal and we put . For defining Gröbner bases, one needs to introduce monomial orderings on .

###### Definition 2.5.

Let be a total ordering on the set of all monomials of . We call a monomial ordering of if the following properties hold:

• is a multiplicatively compatible ordering, that is, if then , for all ;

• is a well-ordering, that is, every non-empty subset of has a minimal element.

In this case, it follows immediately that

• , for all .

Even though the variables set is infinite, by Higman’s Lemma  the polynomial algebra can be always endowed with a monomial ordering. For the following version of this key result, see for instance  Corollary 2.3 and remarks at the beginning of page 5175.

###### Proposition 2.6.

Let be a total ordering on which verifies the properties of Definition 2.5. If the restriction of to the variables set is a well-ordering then is also a well-ordering on , that is, it is a monomial ordering of .

To introduce difference Gröbner bases, we need monomial orderings that are compatible with the shift map.

###### Definition 2.7.

Let be a monomial ordering of . We call a difference monomial ordering of if implies that , for all .

Note that if is a difference monomial ordering, we have immediately that , for all . An important class of difference monomial orderings can be defined in the following way. Recall that all polynomial algebras () are in fact isomorphic by means of the shift map. Then, let us consider a same monomial ordering for all such algebras. Since , we can define on the product monomial ordering such that . For any choice of a monomial ordering on , this is clearly a difference monomial ordering of that we call clock-based.

From now on, we assume that is endowed with a difference monomial ordering. Let with and . If , we put and . Since is a difference ordering, one has that and hence . If , we denote and we put . Let be an ideal of . A polynomial is called normal modulo if , for all . One proves (see for instance ) that for any there is a unique normal polynomial such that . We call the normal form of modulo .

###### Proposition 2.8.

Let . Then . In particular, if is a difference ideal of then is also a difference ideal.

###### Proof.

Since is endowed with a difference monomial ordering, one has that , for any . Then, and therefore is a difference ideal. ∎

###### Definition 2.9.

Let be a difference ideal and . We call a difference Gröbner basis of if is a difference basis of . In other words, is a basis of , that is, is a Gröbner basis of as an ideal of .

For an optimized version of the Buchberger procedure for difference Gröbner bases, we refer to [9, 19].

###### Proposition 2.10.

Consider an explicit difference system and assume that is endowed with a difference monomial ordering such that , for all . Then, the set is a difference Gröbner basis.

###### Proof.

From the assumption on the monomial ordering it follows that , for any . By the linearity of such distinct leading monomials, we conclude that is a difference Gröbner basis. ∎

From now on, we assume that , for any . If is the difference ideal generated by the set , the above result implies that . In other words, the set of normal polynomials modulo is exactly the subalgebra where by definition .

###### Proposition 2.11.

The map is an algebra homomorphism. In other words, one has the algebra isomorphism such that .

###### Proof.

By definition, we have that is a surjective -linear map and . Then, it is sufficient to show that , for all monomials . This holds because is an ideal which is generated by variables. ∎

###### Theorem 2.12.

Let be the state transition endomorphism of the system and consider the algebra endomorphism such that . Then, one has that . In particular, for each polynomial and for all , we have that .

###### Proof.

Consider a polynomial , that is, . The polynomial is obtained from the polynomial simply by applying the identities (). Because , we conclude that . ∎

Observe finally that the above result implies that .

## 3. Invertible systems

An important class of explicit difference systems are the ones such that a -state can be obtained from a -state also for .

###### Definition 3.1.

For an explicit difference system , consider the state transition endomorphism and the corresponding state transition map . We call the system invertible if is an automorphism. In this case, is also a bijective map.

We recall now an effective invertibility criterion for endomorphisms of polynomial algebras. For a complete reference see . Recall that a Gröbner basis is called (completely) reduced if the polynomial is normal modulo the ideal generated by , for all .

###### Theorem 3.2.

Let be two disjoint variable sets and define the polynomial algebras and . Consider an algebra endomorphism such that and the corresponding ideal which is generated by the set . Moreover, we endow the polynomial algebra by a product monomial ordering such that . Then, the map is an automorphism of if and only if the reduced Gröbner basis of is of the kind where , for all . In this case, if is the algebra endomorphism such that and is the isomorphism , we have that .

###### Proposition 3.3.

Let be the state transition automorphism corresponding to an invertible system , namely

 xi(0)↦xi(1),…,xi(ri−2)↦xi(ri−1),xi(ri−1)↦fi.

Denote where

 X′r1,…,rn={x′1(0),…,x′1(r1−1),…,x′n(0),…,x′n(rn−1)}

and put . Consider the ideal that is generated by the following polynomials, for any

 x′i(0)−xi(1),…,x′i(ri−2)−xi(ri−1),x′i(ri−1)−fi.

With respect to a product monomial ordering of the algebra such that , the reduced Gröbner basis of has the following form

 xi(1)−x′i(0),…,xi(ri−1)−x′i(ri−2),xi(0)−f′i.

where , for all .

###### Proof.

By applying Theorem 3.2, it is sufficient to observe that the set

 G=⋃i{xi(1)−x′i(0),…,xi(ri−1)−x′i(ri−2)}⊂J

is the reduced Gröbner basis for the ideal of that is generated by it. ∎

By the above result, we obtain a sufficient condition to invertibility which is immediate to verify.

###### Corollary 3.4.

Consider an explicit difference system and assume that where and the polynomial has all variables in the set , for all . Then, the system is invertible.

###### Proof.

With the same notations and assumptions of Proposition 3.3, consider the set

 G=⋃i{xi(1)−x′i(0),…,xi(ri−1)−x′i(ri−2)}⊂J

Since the variables of are in , the normal form modulo the ideal generated by is clearly a polynomial with variables in the set

 X′r1,…,rn∖{x′1(r1−1),…,x′n(rn−1)}.

Then, the reduced Gröbner basis of the ideal is given by the following polynomials, for any

 xi(1)−x′i(0),…,xi(ri−1)−x′i(ri−2),xki(0)−x′i(ri−1)−g′i.

###### Definition 3.5.

For an explicit difference system , consider the ideal which is generated by the following polynomials, for each

 x′i(0)−xi(1),…,x′i(ri−2)−xi(ri−1),x′i(ri−1)−fi.

We call the state transition ideal of the system (1).

From now on, we assume that is endowed with a product monomial ordering such that .

###### Definition 3.6.

Consider an invertible system and the corresponding state transition ideal . If the set

 G=⋃i{xi(1)−x′i(0),…,xi(ri−1)−x′i(ri−2),xi(0)−f′i}

is the reduced Gröbner basis of , we denote by the image of under the algebra isomorphism such that, for any

 x′i(0)↦xi(ri−1),x′i(1)↦xi(ri−2),…x′i(ri−1)↦xi(0).

The inverse of an invertible system is by definition the following explicit difference system

 (3) ⎧⎪ ⎪⎨⎪ ⎪⎩x1(r1)=g1,⋮xn(rn)=gn.

Let be the state transition endomorphisms of an invertible system (1) and its inverse system (3), respectively. Denote by the algebra automorphism such that

 xi(0)↦xi(ri−1),xi(1)↦xi(ri−2),↦xi(ri−1)↦xi(0).

By Theorem 3.2 and Proposition 3.3, we have clearly that .

###### Proposition 3.7.

Let be the inverse system of an invertible system . If is a -solution of , consider its -state

 v=(a1(t),…,a1(t+r1−1),…,an(t),…,an(t+rn−1)).

Denote by the -solution of whose initial state is

 v′=(a1(t+r1−1),…,a1(t),…,an(t+rn−1),…,an(t)).

If the -state of is

 u′=(b1(t),…,b1(t+r1−1),…,bn(t),…,bn(t+rn−1)),

then the initial state of is

 u=(b1(t+r1−1),…,b1(t),…,bn(t+rn−1),…,bn(t)).
###### Proof.

Denote by () the state transition maps of the systems (1),(3), respectively. By definition, we have that . Since , we conclude that . ∎

Another useful notion is the following one.

###### Definition 3.8.

An explicit difference system is called reducible if there is an integer such that we have a subsystem

 (4) ⎧⎪ ⎪⎨⎪ ⎪⎩x1(r1)=f1,⋮xm(rm)=fm.

In other words, one has that where . In this case, the state transition endomorphism and map of are just the restrictions of the corresponding functions of to the subring and the subspace , respectively.

One obtains immediately the following result.

###### Proposition 3.9.

Let be a reducible invertible system. Then, its subsystem is also invertible. Moreover, the inverse system of is also reducible with a subsystem which is the inverse system of .

## 4. Periodic systems

###### Definition 4.1.

For an invertible system , consider the state transition map . We call the system periodic if there is an integer such that . In this case, the period of the map is called the period of the system .

###### Proposition 4.2.

Consider a periodic system with period . If is a -solution of , then all functions are periodic, that is, for all clocks .

###### Proof.

If is the initial state of , by the argument of Theorem 2.3 we have that is the first coordinate of the vector . Since , one has that and therefore . In a similar way, we also prove that (). ∎

Note that if is a finite field, the symmetric group has finite order and therefore all invertible systems are in fact periodic. We also observe that if is an infinite field, then the state transition endomorphism is bijective if and only if the state transition map is bijective. Moreover, we have that is periodic if and only if is periodic and in this case these maps have the same period. Such facts are consequences of the following general result (see for instance [21, 23]).

###### Proposition 4.3.

Consider a polynomial algebra and an algebra endomorphism such that . Denote by the corresponding polynomial map, that is, for any

 (α1,…,αr)↦(g1(α1,…,αr),…,gr(α1,…,αr)).

The map is an homomorphism from the monoid of the algebra endomorphism of to the monoid of polynomial maps . If is an infinite field, such monoid homomorphism is bijective. Otherwise, if then the map induces a monoid isomorphism from the monoid of algebra endomorphisms of the quotient algebra , where . Note that and are the coordinate algebras of the affine space for the case that is an infinite or finite field, respectively.

An important and difficult task is to compute, or at least bound, the period of a periodic explicit difference system. As usual, the task becomes easy in the linear case.

###### Definition 4.4.

An explicit difference system is called linear if all polynomials are homogeneous linear ones. In other words, the state transition map is a -linear endomorphism of the vector space .

Restating the Rational (or Frobenius) Canonical Form of a square matrix (see, for instance, ) in terms of -linear endomorphisms, one has the following result.

###### Proposition 4.5.

Let be any -linear endomorphism. Then, there is a -linear automorphism such that can be decomposed as a direct sum where is a -linear endomorphism such that, for any