SAT Solvers and their Limits with NFSR-based Stream Ciphers: an Example with Grain v1

Abstract

Many modern stream ciphers combine linear and nonlinear operations with a certain amount of initial clock steps without producing keystream bits for encryption. As a result of this behaviour, the resulting system of equations get more and more complex and difficult to solve. Due to the increasing number of monomials, as well as the increasing algebraic degree, the resulting system of equations get immune to a SAT-based cryptanalysis. A stream cipher realizing this principle is Grain v1. Grain is a stream cipher family, whose first version was submitted as a proposal to the eSTREAM project in the year 2004. Through a key recovery attack in the year 2006, a new revised version was published, referred as Grain Version 1. Within this paper, we examine the initialization phase of Grain v1 for SAT-based cryptanalysis. In the first step, the paper presents the necessary steps for establishing the Boolean system of equations. The second step describes the formulation of the SAT-Problem and the related possibilities and limitations.