Cryptanalysis Techniques for Stream Cipher: A Survey <s> Distinguishing Attack <s> The alleged RC4 keystream generator is examined, and a method of explicitly computing digraph probabilities is given. Using this method, we demonstrate a method for distinguishing 8-bit RC4 from randomness. Our method requires less keystream output than currently published attacks, requiring only 230:6 bytes of output. In addition, we observe that an attacker can, on occasion, determine portions of the internal state with nontrivial probability. However, we are currently unable to extend this observation to a full attack. <s> BIB001 </s> Cryptanalysis Techniques for Stream Cipher: A Survey <s> Distinguishing Attack <s> We demonstrate that the existence of distinguishing attacks against stream ciphers is unrelated to their security in practical use, and in particular that the amount of data required to perform a distinguishing attack is unrelated to the key length of the cipher. The implication for the NESSIE Project is that no submitted symmetric cipher would be accepted under the unpublished rules for distinguishing attacks, not even the block ciphers in Counter Mode or Out- <s> BIB002 </s> Cryptanalysis Techniques for Stream Cipher: A Survey <s> Distinguishing Attack <s> In this paper, we consider the statistical decision processes behind a linear and a differential cryptanalysis. By applying techniques and concepts of statistical hypothesis testing, we describe precisely the shape of optimal linear and differential distinguishers and we improve known results of Vaudenay concerning their asymptotic behaviour. Furthermore, we formalize the concept of sequential distinguisher and we illustrate potential applications of such tools in various statistical attacks. <s> BIB003 </s> Cryptanalysis Techniques for Stream Cipher: A Survey <s> Distinguishing Attack <s> SNOW 2.0 was developed by Johansson and Ekdahl in 2002, as a modified version of SNOW 1.0. In this paper we present the application of linear (masking) attack to SNOW 2.0 stream cipher. Our attack requires 2225 output words (2230 bits) and 2225 steps of analysis to distinguish the output of SNOW 2.0 from a truly random bit sequence. <s> BIB004 </s> Cryptanalysis Techniques for Stream Cipher: A Survey <s> Distinguishing Attack <s> In this paper we present a distinguisher targeting towards irregularly clocked filter generators. The attack is applied on the irregularly clocked stream cipher called LILI-II. LILI-II is the successor of the cipher LILI-128 and its design was published in [1]. There have been no known attacks better than exhaustive key search on LILI-II. Our attack is the first of this kind that distinguishes the cipher output from a random source using 2103 bits of keystream using computational complexity of approximately 2103 operations. <s> BIB005 </s> Cryptanalysis Techniques for Stream Cipher: A Survey <s> Distinguishing Attack <s> The stream cipher Py designed by Biham and Seberry is a submission to the ECRYPT stream cipher competition. The cipher is based on two large arrays (one is 256 bytes and the other is 1040 bytes) and it is designed for high speed software applications (Py is more than 2.5 times faster than the RC4 on Pentium III). The paper shows a statistical bias in the distribution of its output-words at the 1st and 3rd rounds. Exploiting this weakness, a distinguisher with advantage greater than 50% is constructed that requires 2 84.7 randomly chosen key/IV's and the first. 24 output bytes for each key. The running time and the data required by the distinguisher are t ini 2 84,7 and 2 89.2 respectively (t ini denotes the running time of the key/IV setup). We further show that the data requirement can be reduced by a factor of about 3 with a distinguisher that considers outputs of later rounds. In such case the running time is reduced to t r .2 84.7 (t, denotes the time for a single round of Py). The Py specification allows a 256-bit key and a keystream of 2 64 bytes per key/IV. As an ideally secure stream cipher with the above specifications should be able to resist the attacks described before, our results constitute an academic break of Py. In addition we have identified several biases among pairs of bits; it seems possible to combine all the biases to build more efficient distinguishers. <s> BIB006 </s> Cryptanalysis Techniques for Stream Cipher: A Survey <s> Distinguishing Attack <s> Stream ciphers play an important role in symmetric cryptology because of their suitability in high speed applications where block ciphers fall short. A large number of fast stream ciphers or pseudorandom bit generators (PRBG's) can be found in the literature that are based on arrays and simple operations such as modular additions, rotations and memory accesses (e.g. RC4, RC4A, Py, Py6. ISAAC etc.). This paper investigates the security of array-based stream ciphers (or PRBG's) against certain types of distinguishing attacks in a unified way. We argue, counter-intuitively, that the most useful characteristic of an array, namely, the association of array-elements with unique indices, may turn out to be the origins of distinguishing attacks if adequate caution is not maintained. In short, an adversary may attack a cipher simply exploiting the dependence of array-elements on the corresponding indices. Most importantly, the weaknesses are not eliminated even if the indices and the array-elements are made to follow uniform distributions separately. Exploiting these weaknesses we build distinguishing attacks with reasonable advantage on five recent stream ciphers (or PRBG's), namely, Py6 (2005, Biham et al.), IA, ISAAC (1996, Jenkins Jr.), NGG, GGHN (2005, Gong et al.) with data complexities 2 68.61 , 2 32.59 , 2 16.89 , 2 32.89 and 2 32.89 respectively. In all the cases we worked under the assumption that the key-setup algorithms of the ciphers produced uniformly distributed internal states. We only investigated the mixing of bits in the keystream generation algorithms. In hindsight, we also observe that the previous attacks on the other array-based stream ciphers (e.g. Py, etc.), can also be explained in the general framework developed in this paper. We hope that our analyses will be useful in the evaluation of the security of stream ciphers based on arrays and modular addition. <s> BIB007
The most important criterion for a good stream cipher design is that keystream generation should be random. A distinguishing attack tries to identify that if a given keystream is a random sequence or a cipher or generator has created it. Distinguishing attack tries to identify the relations between internal state variables and output keystream. The internal structure of a cipher has to be analyzed extensively for distinguishing attack. Distinguishing attack is a known keystream attack. Fluhrer and McGrew introduced the idea of this attack on alleged RC4 key stream generator BIB001 . Some other works on this attack are Ekdahl and Johansson  53] ; Goli´c and Menicocci  ; Junod BIB003 ; Watan-abe et al. BIB004 ; Englund and Johansson BIB005 ; Paul et al. BIB006 ; Rose and Hawkes BIB002 and many more. In BIB007 Paul and Preneel unified distinguishing attacks into a single framework. Ciphers are required to use sufficiently long keystreams to avoid distinguishing attacks.