Cryptanalysis Techniques for Stream Cipher: A Survey <s> Linear Masking Attacks <s> We describe a cryptanalytical technique for distinguishing some stream ciphers from a truly random process. Roughly, the ciphers to which this method applies consist of a non-linear process (say, akin to a round function in block ciphers), and a linear process such as an LFSR (or even fixed tables). The output of the cipher can be the linear sum of both processes. To attack such ciphers, we look for any property of the non-linear process that can be distinguished from random. In addition, we look for a linear combination of the linear process that vanishes. We then consider the same linear combination applied to the cipher's output, and try to find traces of the distinguishing property. In this report we analyze two specific distinguishing properties. One is a linear approximation of the non-linear process, which we demonstrate on the stream cipher SNOW. This attack needs roughly 2 95 words of output, with work-load of about 2 100 . The other is a low-diffusion attack, that we apply to the cipher Scream-0. The latter attack needs only about 2 43 bytes of output, using roughly 2 50 space and 2 80 time. <s> BIB001 </s> Cryptanalysis Techniques for Stream Cipher: A Survey <s> Linear Masking Attacks <s> SNOW 2.0 was developed by Johansson and Ekdahl in 2002, as a modified version of SNOW 1.0. In this paper we present the application of linear (masking) attack to SNOW 2.0 stream cipher. Our attack requires 2225 output words (2230 bits) and 2225 steps of analysis to distinguish the output of SNOW 2.0 from a truly random bit sequence. <s> BIB002
Linear masking attacks can be applied to those ciphers where some non-linear process resembling block cipher design exist and in which linear masking is used to hide this process. In these attacks first of all a non-linear characteristic is distinguished that exhibits some bias. Then we look at linear process and get some missing linear combinations. The same linear combinations are applied to the cipher output and we try to find the traces of distinguishing property. Coppersmith et al. in BIB001 described a generic attack on stream ciphers using linear masking. Watanabe et al. proposed linear masking attack on SNOW BIB002 . It is a form of Guess and Determine attack.