Optimizing the Placement of Tap Positions

Abstract

Although there are many different approaches used in cryptanalysis of nonlinear filter generators, the selection of tap positions in connection to guess and determine cryptanalysis has not received enough attention yet. In a recent article [18], it was shown that the so-called filter state guessing attack (FSGA) introduced in [15], which applies to LFSR based schemes that use (vectorial) Boolean filtering functions, performs much better if the placement of tap positions is taken into account. In this article, for a given LFSR of length L, we analyze the problem of selecting n (where $n \ll L$) tap positions of the driving LFSR (used as binary inputs to a filtering function) optimally so that the complexity of FSGA like attacks is maximized. An algorithm which provides a suboptimal solution to this problem is developed and it can be used for real-life applications when the choice of tap positions is to be made.

Appendix

In Table 5 we give several instances for determining suboptimal tap positions of LFSRs of different length. The following parameters are used:

• L is the length of LFSR;

• n and m are parameters related to vectorial Boolean function $F:GF(2)^n\rightarrow GF(2)^m;$

• D is a set of differences between tap positions;

• c is the minimal number of observed outputs needed for an overdefined system

• R is the number of repeated equations for given c outputs;

• $\sigma$ is an optimal step of the GFSGA attack;

• $T_{Comp.}$ is the time complexity of GFSGA.

Table 5. Specifications of difference sets for LFSRs of different lengths.

Remark 7

From the difference sets D in Table 5 we easily obtain the tap positions.

Table 6. Time complexities for finding tap positions in Table 5.

Remark 8

Note that the time required to create some particular set of differences depends on the cardinality of parts. It means that the smaller cardinalities implies the lower time complexity, though such an approach may provide the solutions that are “far” from optimal. Table 6 presents the following:

• Cardinality of parts refers to the modified algorithm on Page 10, bottom. For instance, (6, 6, 4) means that we take $\#X=6$ elements and finding its optimal permutation requires 137 sec with our permutation algorithm. Then, we take another $\#Y_{p}=6$ elements and determine its best order which fits to the set X, which requires 198 seconds (modified algorithm). Finally, the same procedure is applied to the set $Y_{p}X$ by adding $Z_{p}=4$ elements using again our modified algorithm (requiring 8.5 sec). The resulting set of differences is given as $D=Z_{p}Y_{p}X.$

• Complexity refers to the complexity of the permutation algorithms Step B and its modification used to construct the set D.

• The constant K regards the procedure described in the permutation algorithm (Step B): creating the list, searching, etc.