Abstract: By analyzing the weakness in design of the stream cipher Grain128, a fault attack by targeting NFSR is presented. Firstly, by setting a large random number of key and IV, and using the difference of faultfree and faulty output, we obtain the fault location. By using the feedback equation of NFSR and output bit equation, and inducing 56 faults to NFSR, we can get the NFSR bit values. By using the output bit equation, and inducing 256 faults to NFSR, we can get the LFSR bit values. We can recover the key from the known full initial state by inverting internal states. The computational complexity of this attack is about O(221).

Key words: stream cipher, Grain-128, fault attack, NFSR, LFSR, key recovery

摘要： 通过分析序列密码Grain128，提出了一种针对非线性反馈移位寄存器NFSR的错误攻击.该攻击首先通过设置不同密钥K和初始密钥IV，运行引入错误后的算法和无错误的算法来确定错误位置.然后根据NFSR的状态更新函数式计算错误传播路径.利用好密钥流输出函数式和NFSR的状态更新函数式，并向NFSR中引入56个错误，来确定NFSR某一时刻的内部状态.根据密钥流输出函数式，向NFSR中引入256个错误，得到LFSR的内部状态.最后，对NFSR和LFSR的密钥流生成阶段的初态进行状态逆推，恢复密钥K.整个攻击过程的计算复杂度为O(221).

关键词: 密码, Grain-128, 错误攻击, 非线性移位寄存器, 线性移位寄存器, 恢复密钥