Cryptanalysis of Grain using Time / Memory / Data Tradeoffs

Grain is a hardware-oriented stream cipher designed by Hell et al., which has been selected as one of three hardware portfolio ciphers by eSTREAM, the ECRYPT Stream Cipher Project. Time / memory / data tradeoffs are a class of generic attacks used to invert general one-way functions. We show that Grain has a low resistance to so-called BSWsampling, leading to generic tradeoffs that in the active phase recover the internal state of Grain v1 with parameters such as O(2) time, O(2) memory, and O(2) bits of known keystream. While the practical significance of these attacks may be arguable, these attacks violate design assumptions made in the Grain v1 specification. A similar attack applies to Grain-128.