Amin Ghafari Vahid, Hu Honggang
Key Laboratory of Electromagnetic Space Information, Chinese Academy of Sciences, School of Information Science and Technology, University of Science and Technology of China, Hefei 230026, China.
Entropy (Basel). 2018 Mar 8;20(3):180. doi: 10.3390/e20030180.
In Fast Software Encryption (FSE) 2015, while presenting a new idea (i.e., the design of stream ciphers with the small internal state by using a secret key, not only in the initialization but also in the keystream generation), Sprout was proposed. Sprout was insecure and an improved version of Sprout was presented in FSE 2017. We introduced Fruit stream cipher informally in 2016 on the web page of IACR (eprint) and few cryptanalysis were published on it. Fortunately, the main structure of Fruit was resistant. Now, Fruit-80 is presented as a final version which is easier to implement and is secure. The size of LFSR and NFSR in Fruit-80 is only 80 bits (for 80-bit security level), while for resistance to the classical time-memory-data tradeoff (TMDTO) attacks, the internal state size should be at least twice that of the security level. To satisfy this rule and to design a concrete cipher, we used some new design ideas. It seems that the bottleneck of designing an ultra-lightweight stream cipher is TMDTO distinguishing attacks. A countermeasure was suggested, and another countermeasure is proposed here. Fruit-80 is better than other small-state stream ciphers in terms of the initialization speed and area size in hardware. It is possible to redesign many of the stream ciphers and achieve significantly smaller area size by using the new idea.
在2015年的快速软件加密（FSE）会议上，在提出一个新想法（即通过使用密钥设计具有小内部状态的流密码，不仅在初始化阶段，而且在密钥流生成阶段）的同时，Sprout被提出来了。Sprout是不安全的，在2017年的FSE会议上提出了Sprout的改进版本。我们在2016年于国际密码研究协会（IACR）的网页（电子预印本）上非正式地介绍了Fruit流密码，并且很少有关于它的密码分析被发表。幸运的是，Fruit的主要结构具有抗性。现在，Fruit - 80作为最终版本被提出，它更易于实现且是安全的。Fruit - 80中线性反馈移位寄存器（LFSR）和非线性反馈移位寄存器（NFSR）的大小仅为80位（针对80位安全级别），而对于抵御经典的时间 - 内存 - 数据权衡（TMDTO）攻击，内部状态大小应至少是安全级别的两倍。为了满足这一规则并设计一种具体的密码，我们采用了一些新的设计理念。设计超轻量级流密码的瓶颈似乎是TMDTO区分攻击。有人提出了一种对策，这里再提出另一种对策。在硬件的初始化速度和面积大小方面，Fruit - 80比其他小状态流密码更好。通过使用新的理念，有可能重新设计许多流密码并显著减小面积大小。
