Related-Key Chosen IV Attacks on Grain-v1 and Grain-128

摘要

The slide resynchronization attack on Grain was proposed in [6]. This attack finds related keys and initialization vectors of Grain that generate the 1-bit shifted keystream sequence. In this paper, we extend the attack proposed in [6] and propose related-key chosen IV attacks on Grain-v1 and Grain-128. The attack on Grain-v1 recovers the secret key with 2~(22.59)chosen IVs, 2~(26.29)-bit keystream sequences and 2~(22.90) computational complexity. To recover the secret key of Grain-128, our attack requires 2~(26.59) chosen IVs, 2~(31.39)-bit keystream sequences and 2~(27.01) computational complexity. These works are the first known key recovery attacks on Grain-vl and Grain-128.