Attacks based on Conditional Correlations against the Nonlinear Filter Generator

Abstract. In this paper we extend the conditional correlation attack ([LCPP96]) against the nonlinear filter generator (NLFG) by introducing new conditions and generalisations and present two known-plaintext attacks, called hybrid correlation attack and concentration attack. The NLFG is a well known LFSR-based keystream generator which could be used as a basic building block in a synchronous stream cipher system. Both new attacks use methods from the conditional correlation attack and additional from fast correlation attacks to derive the unknown initial state of the LFSR of the NLFG. The basic principle of iteratively cumulating and updating conditional correlations for the NLFG was proposed in [Löh01] and for general combiners with memory in [GBM02]. With the hybrid correlation attack it is possible to successfully attack the NLFG by applying a fast correlation attack, even if the filter function f of the NLFG is highly nonlinear, e.g. the normalised nonlinearity pe,f is ≥ 0.45. The concentration attack maps all computed conditional correlations to D − B unknown LFSR bits, where D ≥ k and 1 ≤ B ≤ k are parameters which can be chosen by the attacker, and k is the length of the LFSR of the NLFG. Even with low values of conditional correlations, it is possible to mount the hybrid correlation attack and the concentration attack successfully. This is not the case for the originally version of the conditional correlation attack ([LCPP96]) in a time lower than a full search over all possible initial states. Key words: stream ciphers, keystream generator, nonlinear filter generator, NLFG, conditional correlation attack, fast correlation attacks