Some Results on Sprout

Abstract

Sprout is a lightweight stream cipher proposed by Armknecht and Mikhalev at FSE 2015. It has a Grain-like structure with two state Registers of size 40 bits each, which is exactly half the state size of Grain v1. In spite of this, the cipher does not appear to lose in security against generic Time-Memory-Data Tradeoff attacks due to the novelty of its design. In this paper, we first present improved results on Key Recovery with partial knowledge of the internal state. We show that if 50 of the 80 bits of the internal state are guessed then the remaining bits along with the secret key can be found in a reasonable time using a SAT solver. Thereafter, we show that it is possible to perform a distinguishing attack on the full Sprout stream cipher in the multiple IV setting using around $2^{40}$ randomly chosen IVs on an average. The attack requires around $2^{48}$ bits of memory. Thereafter, we will show that for every secret key, there exist around $2^{30}$ IVs for which the LFSR used in Sprout enters the all zero state during the keystream generating phase. Using this observation, we will first show that it is possible to enumerate Key-IV pairs that produce keystream bits with period as small as 80. We will then outline a simple key recovery attack that takes time equivalent to $2^{66.7}$ encryptions with negligible memory requirement. This although is not the best attack reported against this cipher in terms of the time complexity, it is the best in terms of the memory required to perform the attack.

Appendix A: Cost of Executing One Round of Sprout [6]

To do an exhaustive search, first an initialization phase has to be run for 320 rounds, and then generate 80-bits of keystream to do a unique match. However, since each keystream bit generated matches the correct one with probability $\frac{1}{2}$, $2^{80}$ keys are tried for 1 clock and roughly half of them are eliminated, $2^{79}$ for 2 clocks and half of the remaining keys are eliminated, and so on. This means that in the process of brute force search, the probability that for any random key, $(i+1)$ Sprout keystream phase rounds need to be run, is $\frac{1}{2^i}$. Hence, the expected number of Sprout rounds per trial is

$$\begin{aligned} \sum _{i=0}^{79}\frac{(i+1)2^{80-i}}{2^{80}} = \sum _{i=0}^{79}(i+1)\frac{1}{2^i} \approx 4 \end{aligned}$$

Add to this the 320 rounds in the initialization phase, the average number of Sprout rounds per trial is 324. As a result, we will assume that clocking the registers once will cost roughly $\frac{1}{320+4} =2^{-8.34}$ encryptions.