Modern Stream Ciphers

A linear-feedback shift register is a register of bits whose positions shift to the right
Usually comprised of flip-flops, the last bit represents the output

(Where the squares at the bottom are flip-flops)

If initialised to 000, nothing happens as 0\oplus0 = 0.
- Therefore, we have 2^n-1 states
- Statistical randomness
To add more randomness to the setup, we can add another (more) xor gate
- However, we have fewer states


s_m \equiv s_{m-1}p_{m-1} + ... + s_1p_1 + s_0p_0\space (mod \space 2)\\
s_{m+1} \equiv s_{m}p_{m-1} + ... + s_2p_1 + s_1p_0\space (mod \space 2)

We usually represent m-bit LFSRs using polynomials of degree m.
In general P(x)=x^m + p_{m-1}x^{m-1} + ... + p_1x + p_0
LFSRs that have primitive polynomials produce sequences of maximum length
There are many, and they are easily computed
- x^5 + x^2 + 1 has 31 states
- x^{10} + x^3 + 1 has 1023
- x^{85}+x^8+x^2+x+1 has 10^{26} states

Suppose an attacker knows 2m-1 plain text bits

Step 1 Calculate key bits

s_i \equiv y_i + x_i \space (mod\space 2), i=0,1,...2_{m-1}

Step 2 Reconstruct the LFSR

s_m \equiv s_{m-1}p_{m-1} + ... + s_1p_1 + s_0p_0

s_{m+1} \equiv s_{m}p_{m-1} + ... + s_2p_1 + s_1p_0

…

s_{2m+1} \equiv s_{2m-1}p_{m} + ... + s_mp_1 + s_{m-1}p_0

LFSRs are much more cryptographically secure if we combine more than one together in a non-linear way.

Trivium is 3 LFSRs in a row

ChaCha is a stream cipher written by Daniel Bernstein
A modification of a previous cipher, Salsa
Very lightweight, using only add, xor and rotate operations
One of two ciphers in TLS 1.3
Dashes represent bit length
Constants are not secret
The block number can skip to anywhere
- Suppose someone skips ahead on a video stream, the cipher can skip unlike other synchronous stream ciphers
Works well on low power devices, due to simplicity of encryption
Once the input and the mixed words are added together it is hard to know what the starting thing was
- e.g. what two numbers have I added to make 100

ChaCha performs 20 rounds