vulcan-cryptanalysis

process the ciphertext, creating a single linear equation relating SRAM contents
to keystream bits for each bit of ciphertext. For each such equation, we update
our partially completed solution matrix until one of the following occurs: we
found an inconsistent solution, we ran out of ciphertext bits, or we completely
filled the solution matrix, which is now in row echelon form.
When we guess the CV shift register bits incorrectly, we will eventually
encounter an inconsistent equation (i.e. 0=1) and thus know that our guess
was incorrect. Should this happen, we simply move on to the next value in the
second lookup table, load that entry as the eight CV shift register bits, and
start processing ciphertext bits from the beginning once again.
When we guess the CV shift register bits correctly, our solution matrix
will eventually be completely filled and will also be in row echelon form. At
this point all we have to do is put the solution matrix in reduced row echelon
form and read the solved cryptovariable bits from the rightmost column. Our
final solution consists of our correct guess of the CV shift register bits and the
rightmost column of the consistently completed solution matrix.
The precise details of our procedure are evident in our commented source
code listing of Appendix D, but here we offer a few additional remarks to aid
understanding. From (1) of Section 3 we can compute a keystream bit from
delayed ciphertext bits and cryptovariable bits. This equation is central to our
cryptanalysis routine.
For each bit of ciphertext, our cryptanalysis routine forms a linear equation
based on (1) such that we have a linear (on GF (2)) combination of 64 unknown
variables (cryptovariable bits) equal to a single known value (the keystream bit).
We place this linear equation in our solution matrix and perform elementary
row operations on it to ensure that our solution matrix is in row echelon form
at all times.
As we continue to process ciphertext bits (assuming we have an adequate
supply), we will eventually reach one of two possible outcomes: a correct solution
or an inconsistent solution. An inconsistent solution occurs when, after
performing elementary row operations on a candidate equation, we obtain the
impossible result that 0=1. A correct solution occurs when we have completely
filled our solution matrix with 64 linearly independent equations, none of which
resulted in an inconsistency.
Once we have 64 linearly independent consistent equations in our solution
matrix, we again use elementary row operations to fully reduce the matrix into
reduced row echelon form. This simply places the 64 solved cryptovariable bits
in the rightmost column of the matrix, thus completing our solution.
Experimentally, we have found that approximately 100 ciphertext bits are
necessary to generate a complete solution for the Vulcan cryptovariable. If our
technique is expanded to allow all 138 bits of the Vulcan cryptovariable to be
independently specified — a situation not permitted by the DVP key loader
— then we can still solve for the 138 bits, but we require about an order of
magnitude (i.e. 1000 bits) more ciphertext to obtain a full solution. Either way,
our cryptanalysis routine runs in real time and does not require any significant
computational resources. We are fully confident in our ability to recover a DVP
24