The ZUC Stream Cipher Algorithm

Abstract

Abstract: 祖冲之算法，简称ZUC，是一个面向字设计的序列密码算法，其在128b种子密钥和128b初始向量控制下输出32b的密钥字流.祖冲之算法于2011年9月被3GPP LTE采纳为国际加密标准(标准号为TS 35.221)，即第4代移动通信加密标准，2012年3月被发布为国家密码行业标准(标准号为GMT 0001—2012)，2016年10月被发布为国家标准(标准号为GBT 33133—2016).简单介绍了祖冲之算法，并总结了其设计思想和国内外对该算法安全性分析的主要进展.

Key words: 3GPP LTE, 4G mobile communication, confidentiality and integrity algorithm, stream cipher, ZUC

摘要： The ZUC algorithm is a word oriented stream cipher, which outputs a 32b key word stream under the control of a 128b seed key and a 128b initial vector. ZUC was adopted as the encryption standard(Grant TS 35.221) by 3GPP LTE in September 2011, i.e., the 4th mobile communication encryption standard, and issued as the national cipher industry standard(Grant GMT 0001—2012) in March 2012 and as the national standard(Grant GBT 33133—2016) in October 2016 respectively. In this paper the ZUC algorithm is recalled simply, and then the idea of its design and main progress on its security analysis are surveyed.Key words3GPP LTE; 4G mobile communication; confidentiality and integrity algorithm; stream cipher; ZUC

关键词: 3GPP LTE, 4G移动通信, 保密性和完整性算法, 序列密码, 祖冲之算法

冯秀涛. 祖冲之序列密码算法[J]. 信息安全研究, 2016, 2(11): 1028-1041.

References

［1］国家标准化委员会. GBT 33133—2016 祖冲之序列密码算法, 第1部分: 算法描述［S］. 北京: 中国标准出版社, 2016［2］国家密码管理局. GMT 0001.1—2012 祖冲之序列密码算法, 第1部分: 算法描述［S］. 北京: 中国标准出版社, 2012［3］ETSISAGE. TS 35.222 Specification of the 3GPP Confidentiality and Integrity Algorithms 128EEA3 & 128EIA3. Document 2: ZUC Specification［SOL］. 2011［20161014］. http:www.3gpp.orgDynaReport35series.htm［4］ETSISAGE. TR 35.921 Specification of the 3GPP Confidentiality and Integrity Algorithms 128EEA3 & 128EIA3. Document 4: Design and Evaluation Report［SOL］. 2011［20161014］. http:www.3gpp.orgDynaReport35series.htm［5］Zhu Xuanyong, Qi Wenfeng. On the distinctness of modular reductions of maximal length sequences modulo odd prime powers［J］. Mathematics of Computation, 2008, 77(263): 16231637［6］Chan A, Games R. On the linear span of binary sequences obtained from finite geometries［C］ Advances in Cryptology—Crypto. Berlin: Springer, 1987: 405417［7］Sun B, Tang X, Li C. Preliminary cryptanalysis results of ZUC［COL］ Proc of the 1st Int Workshop on ZUC Algorithm. 2010［20161014］. http:www.dacas.cnzuc10pdfzuc_06.pdf［8］Wu H, Huang T, Nguyen P, et al. Differential attacks against stream cipher ZUC［G］ LNCS 7658: Proc of Int Conf on the Theory and Application of Cryptology and Information Security. Berlin: Springer, 2012: 262277［9］Dai W, Biryukov A, Cannière C. A distinguishing attack of SNOW 2.0 with linear masking method［C］ Proc of Int Workshop on Selected Areas in Cryptography. Berlin: Springer, 2003: 2328［10］Coppersmith D, Halevi S, Jutla C. Cryptanalysis of stream ciphers with linear masking［G］ LNCS 2442: Proc of Crypto2002. Berlin: Springer, 2002: 515532［11］Nyberg K, Wallén J. Improved linear distinguishers for SNOW 2.0［C］ Proc of Int Workshop on FAST Software Encryption. Berlin: Springer, 2006: 144162［12］Courtois N, Meier W. Algebraic attacks on stream ciphers with linear feedback［G］ LNCS 2656: Advance in Cryptology—EUROCRYPT 2003. Berlin: Springer, 2003: 345359［13］Rnjom S, Helleseth T. Attacking the filter generator over GF (2m)［C］ Proc of Int Workshop on Arithmetic of Finite Fields. Berlin: Springer, 2007: 264275［14］Meier W, Pasalic E, Carlet C. Algebraic attacks and decomposition of Boolean functions［G］ LNCS 3027: Advances in Cryptology—EUROCRYPT, 2004. Berlin: Springer, 2004: 474491［15］Courtois N, Klimov A, Patarin J, et al. Efficient algorithms for solving overdefined systems of multivariate polynomial equations［C］ Advances in Cryptology—EUROCRYPT 2000. Berlin: Springer, 2000: 392407［16］Diem C. The XLalgorithm and a conjecture from commutative algebra［C］ Advances in Cryptology—ASIACRYPT 2004. Berlin: Springer, 2004: 323337［17］Hawkes P, Rose G. Guessanddetermine attacks on SNOW［G］ LNCS 2595: Selected Area of Cryptography—SAC2002. Berlin: Springer, 2002: 3746［18］Canniere C. Guess and determine attacks on SNOW［OL］ NESSIE Project. 2001［20161014］.http:link.springer.comcontentpdf10.10073540364927_4.pdf［19］Ahmadi H, Eghlidos T, Khazaei S, et al. Improved guess and determine attack on SOSEMANUK［OL］. Estream Project. 2005［20161014］. https:www.cosic.esat.kuleuven.beecryptstreampapersdir085.pdf［20］Babbage S H. Improved “exhaustive search” attacks on stream ciphers［C］ Proc of European Convention on Security and Detection. London: IET, 1995: 161166［21］关杰, 丁林, 刘树凯, 等. SNOW3G与ZUC流密码的猜测决定攻击［J］. 软件学报, 2013, 24(6): 13241333［22］Biryukov A, Shamir A. Cryptanalytic timememorydata tradeoffs for stream ciphers［C］ Advances in Cryptology—ASIACRYPT 2000. Berlin: Springer, 2000: 113［23］Hong J, Sarkar P. New Applications of time memory data tradeoffs［C］ Advances in Cryptology—ASIACRYPT 2005. Berlin: Springer, 2005: 353372［24］Jin H, Sarkar P, Sarkar P. Rediscovery of time memory tradeoffs［OL］. 2005［20161014］. http:eprint.iacr.org2005090.pdf［25］Dunkelman O, Keller N. Treatment of the initial value in timememorydata tradeoff attacks on stream ciphers［J］. Information Processing Letters, 2008, 107(5): 133137

[1]	. Security Authentication Protocol Based on Grain-v1 in National Military Standard [J]. Journal of Information Security Research, 2016, 2(6): 513-518.
[2]	. A New Fault Attack on Grain-128 [J]. Journal of Information Security Research, 2016, 2(3): 230-237.