On a bias of Rabbit

This paper demonstrates the existence of a non-null bias in the keystream generated by the synchronous stream cipher Rabbit, a candidate to the eSTREAM project, from the observation that the core function is strongly unbalanced. The keystream bias is greater than 2−124.5 for certain bits, and this leads to a distinguisher requiring about 2 128-bit samples of keystream derived from random keys and random IV’s, which remains much higher than the cost of exhaustive key search. Rabbit is a candidate [10] to the eSTREAM project [1], first presented at FSE 2003 [11], targeting both hardware and software environments, having 128-bit key, 64-bit IV, and 513bit internal state. Its authors made the effort of a deep security analysis – in the reference article [10] and a series of white papers [4, 8, 6, 7, 5, 3], they presented convincing arguments in favor of their cipher’s resistance to the well-known algebraic, correlation, differential, guessand-determine, and statistical attacks – and until now no other publication tackled Rabbit. In this paper, after a brief presentation of the cipher in Section 1, we state in Section 2 some properties of the function Gn : x → x2 ⊕ (x2 À n) mod 2n, which is essential in the keystream generation algorithm. In particular, we observe that the images by G32, as bit words, have in average significantly less zeros than ones at each offset. From this property, we give a method to compute the bias of the keystream bits in Section 3, and illustrate it with the example of the least significant bit of certain keystream subblocks, which is null with probability greater than 1 2 +2 −124.5. This leads to a distinguisher requiring about 2247 128-bit samples of keystream derived from random keys and random IV’s.