54
V. Mikhalev et al.
3. The counter is used in the state update in order to avoid situations where shifted
keys result in shifted keystreams
The design of Plantlet actually builds on Sprout but included some changes to fix
several weaknesses [50, 203, 355, 387]. The main differences between Plantlet and
Sprout are the following:
1. Plantlet has a larger internal state size compared to Sprout. The difference was
introduced in order to increase the period of the output sequences and to increase
resistance against guess-and-determine attacks
2. In both ciphers, the round key function cyclically steps through the key bits,
which is well aligned with the performance of different types of NVM as
mentioned before. However, in Sprout the key bits are only included in the NFSR
update with a probability of 0.5, i.e., only if the linear combination of several
state bits is equal to 1. This has been exploited by several attacks so in Plantlet
the next key bit is added unconditionally at every clock-cycle.
3. Plantlet uses a so-called double-layer LFSR which allows for high period and at
the same time avoids the LFSR being initialized with all-zeroes
For full specifications we refer the reader to [27, 422].
Implementation Results We used the Cadence RTL Compiler 1 for synthesis and
simulation, and the technology library UMCL18G212T3 (UMC 0.18 µm process).
The clock frequency was set to 100 kHz. For different memory types Sprout requires
from 692 to 813 GEs, whereas Plantlet needs from 807 to 928 GEs. Note that the
smallest KSG which follows the classical design approach needs at least 1162 GEs
if the same tools are used for implementation [421].
Security As already mentioned, several serious weaknesses [50, 203, 355, 387]
were shown to exist in Sprout, whereas Plantlet, to the best of our knowledge,
remains secure for the moment.
3.3 A Generic Attack Against Certain Keystream
Generators with Keyed Update Functions
In this section, we describe a generic attack against the following type of Keystream
Generators with a Keyed Update Function (Definition 1):
Definition 3 (KSG with Boolean Keyed Feedback Function) Consider a KSG
with a KUF as in Definition 1. Let Upd i denote the Boolean component functions
of the update function Upd, that is Upd(k, st) = (Upd i (k, st)) i . We call this a KSG
with a Boolean KFF (Keyed Feedback Function) if only one component function
depends on the secret key. That is, there is an index i ∗ such that all other component
1 See http://www.cadence.com/products/ld/rtl_compiler/pages/default.aspx.
V. Mikhalev et al.
3. The counter is used in the state update in order to avoid situations where shifted
keys result in shifted keystreams
The design of Plantlet actually builds on Sprout but included some changes to fix
several weaknesses [50, 203, 355, 387]. The main differences between Plantlet and
Sprout are the following:
1. Plantlet has a larger internal state size compared to Sprout. The difference was
introduced in order to increase the period of the output sequences and to increase
resistance against guess-and-determine attacks
2. In both ciphers, the round key function cyclically steps through the key bits,
which is well aligned with the performance of different types of NVM as
mentioned before. However, in Sprout the key bits are only included in the NFSR
update with a probability of 0.5, i.e., only if the linear combination of several
state bits is equal to 1. This has been exploited by several attacks so in Plantlet
the next key bit is added unconditionally at every clock-cycle.
3. Plantlet uses a so-called double-layer LFSR which allows for high period and at
the same time avoids the LFSR being initialized with all-zeroes
For full specifications we refer the reader to [27, 422].
Implementation Results We used the Cadence RTL Compiler 1 for synthesis and
simulation, and the technology library UMCL18G212T3 (UMC 0.18 µm process).
The clock frequency was set to 100 kHz. For different memory types Sprout requires
from 692 to 813 GEs, whereas Plantlet needs from 807 to 928 GEs. Note that the
smallest KSG which follows the classical design approach needs at least 1162 GEs
if the same tools are used for implementation [421].
Security As already mentioned, several serious weaknesses [50, 203, 355, 387]
were shown to exist in Sprout, whereas Plantlet, to the best of our knowledge,
remains secure for the moment.
3.3 A Generic Attack Against Certain Keystream
Generators with Keyed Update Functions
In this section, we describe a generic attack against the following type of Keystream
Generators with a Keyed Update Function (Definition 1):
Definition 3 (KSG with Boolean Keyed Feedback Function) Consider a KSG
with a KUF as in Definition 1. Let Upd i denote the Boolean component functions
of the update function Upd, that is Upd(k, st) = (Upd i (k, st)) i . We call this a KSG
with a Boolean KFF (Keyed Feedback Function) if only one component function
depends on the secret key. That is, there is an index i ∗ such that all other component
1 See http://www.cadence.com/products/ld/rtl_compiler/pages/default.aspx.