Primitive Specification for SOBER-128 (Version 2.0)

Primitive Specification for SOBER-128

The Mundja Streaming MAC

Mundja is a MAC generation algorithm that has been designed for use together with a stream cipher. Mundja accumulates the message onto two independent registers: the first is a Cyclic Redundancy Checksum (CRC) that uses linear feedback; the second is a strengthened version of the SHA-256 register [5] that uses nonlinear feedback. Mundja is fast (asymptotically about 4 times the speed of HMAC-SH...

A MAC Forgery Attack on SOBER-128

SOBER-128 is a stream cipher designed by Rose and Hawkes in 2003. It can be also used for generating Message Authentication Codes (MACs) and an authenticated encryption. The developers claimed that it is difficult to forge MACs generated by both functions of SOBER128, though, the security assumption in the proposal paper is not realistic in some instances. In this paper, we examine the security...

A Key-Recovery Attack on SOBER-128

In this paper, we consider how an unknown constant within a state update function or output function a ects biases of linear approximations. This allows us to obtain information from an unknown constant within a T-function. We use this knowledge for mounting an attack against stream cipher SOBER-128 where we gain information from the key dependent secret constant using multiple linear approxima...

Distinguishing Attack on SOBER-128 with Linear Masking

We present a distinguishing attack against SOBER-128 with linear masking. We found a linear approximation which has a bias of 2−8.8 for the non-linear filter. The attack applies the observation made by Ekdahl and Johansson that there is a sequence of clocks for which the linear combination of some states vanishes. This linear dependency allows that the linear masking method can be applied. We a...