Cryptography Reference
In-Depth Information
Fig. 14.1
Trivium block diagram
Figure
14.1
provides a block diagram of the cipher. As depicted in Fig.
14.1
,the
output of the cipher is the result of the linear combination of three different values,
each obtained from a different internal register of the state. From now on, we will be
denoting the state bits by
s
1
...
s
288
.
A key feature of the feedback function, which will also be used to lead the fault
attacks, is the fact that the degree of the three feedbacks into the three registers is 2
(since there is a single AND gate in the feedback loop). Moreover, the two variables
involved in the second degree term of the feedback are contained in two consecutive
bits of the same register, while the third variable, employed in the feedback circuit
of the
i
th is taken from the
(
i
+
1
)
mod 3rd one in order to provide inter-register
diffusion.
In order to initialize the keystream generator, the algorithm requires an initializa-
tion vector and a key, both 80 bits long. These values are used to initialize the first
bytes from left to right of the first two registers: in particular, the key fills the state
bits from
s
1
to
s
80
and the initialization vector fills the state bits from
s
94
to
s
173
.
After this assignment phase, all the other bits of the internal state are set to 0, with
the exception of the last three bits of the third register (
s
286
,
s
287
and
s
288
), which are
set to 1. The initialization phase is completed through clocking the whole system a
total of 1,152 times (i.e. four times the width of the inner state), without outputting
anything. After this initialization, the bits contained in the inner state of the cipher
have strongly nonlinear dependence on the key and IV bits, which is the key security
feature of Trivium.
