Anais - Engenharia de Redes de Comunicação - UnB

• This configuration is only possible for a t−1
i−2 = 1.
Configuration 3.6
(
a
t−1
i−2
a t−1
i−1
a t−1
i
x a t i−1 x
)
=
(
a
t−1
i−2 0 1
x 1 x
)
• This configuration is only possible for a t−1
i−2 = 0.
Configuration 3.7
(
a
t−1
i−2
a t−1
i−1
a t−1
i
x a t i−1 x
)
=
(
a
t−1
i−2 1 1
x 0 x
)
• This configuration is only possible for a t−1
i−2 = 1.
Configuration 3.8
(
a
t−1
i−2
a t−1
i−1
a t−1
i
x a t i−1 x
)
=
(
a
t−1
i−2 1 1
x 1 x
)
• This configuration is only possible for a t−1
i−2 = 0.
3. Further Explanation on the Rule 30 Stream Cipher Fault Analysis
In this part, we explain in-depth why our fault attack on the rule 30 stream cipher works.
The main idea is simple and quite intuitive. We recall that the attacker knows a
sequence of n/2+1 cells, which are located on the central column of a matrix A. We also
recall equation 1.
a t i = a t−1
i−1 XOR ( a t−1
i
)
OR a t−1
i+1
In the first step of our attack, the cryptanalyst intends to discover the values a t−1
i−1
and a t−1
i+1, given the values that he/she knows, i.e., a t i and a t−1
i . However, he/she has two
variables and only a boolean equation (this initial configuration is displayed in figure 1).
Bits to be determined
t 1
a i 1
x
t
a 1 i
1
t1
a i
t
a i
t
1
a i
1
x
t 1
a i 1
Known cells
Figure 1. Initial configuration.
91