Our society greatly depends on security of communications, financial transactions, telematic services, internet and mobile networks [1] which in turn present new challenges for protecting the information from unauthorized eavesdropping. Cryptography mainly uses two types of symmetric algorithms, block ciphers and stream ciphers. The block ciphers have become widely used technology. As an example AES is a secure block cipher that offers excellent performance on a variety of hardware and software environments. On the other hand, the stream ciphers are widely used in secure communication because of high throughput, less complex hardware circuitry and very little error propagation which has attracted much attention. An important class of stream ciphers is based on a mixture of linear feedback shift register (LFSR), nonlinear filter generators and also clock-controlled generators [2,3]. LILI-128 stream cipher is an example which is designed by Dawson, Clark, Golic, Millan, Penna and Simpson, which submitted to NESSIE (New European Schemes for Signatures, Integrity and Encryption) as a candidate cipher [3]. According to the final report, LILI- 128 stream cipher was rejected in the first round of NESSIE. In this work we will discuss basic structure and the attack of LILI-128 stream cipher. We particularly study the filter Boolean function of LILI-128 stream cipher generator.

The structure of the LILI-128 keystream generators is illustrated in Figure 1. It uses two binary LFSR_c and LFSR_d and two functions f_c and f_d to generate a pseudorandom binary keystream sequence. At initialization, 128 bit key provides the initial states of the LFSR_c and LFSR_d.

The generator can be divided into two subsystems based on the functions they perform: the clock control subsystem and data generation subsystem. The clock control subsystem produces an integer sequence that is used to control data generation subsystem. The feedback polynomial of the LFSR_c is chosen to be the primitive polynomial

Since is primitive, the LFSR_c produce a maximum-length sequence of period. The function f_c takes two bits as input and produced an integer c_k such that. The value of c_k is calculated as

The LFSR_d is clocked by c_k at least once and at most four times, which is given as fllows:

since is a primitive polynomial, a period of at maximum is guaranteed for LFSR_d output sequence. The contents of 10 different stages of LFSR_d are input to a nonlinear filter function f_d. The output z_k of nonlinear filter function f_d is the keystream sequence.

LILI-128 stream cipher are a long period around 2¹²⁸, high linear complexity which is conjectured to be at least 2⁶⁸, and good statistics regarding the distribution of zeroes and ones, so designers claim that the LILI-128 keystream generator can resist currently known styles of attack. Some methods [4-7] of breaking it have been proposed, since LILI-128 stream cipher was publicized in 2000. The methods have already been shown that some attack break the LILI-128 stream cipher more efficiently than an exhaustive search for its secret key. However, most of the attack methods consider only the complexity of time or memory for search for its secret key. For example, Time-Memory Tradeoff Attack [4] needs approximately 2⁴⁶ bits, and Correlation Attack [5] needs approximately about 2²³ bits. While algebraic Attack [6] needs approximately 2¹⁸ bits. Even a new attack method [7] requires a mere 2⁷ bits of keystream, but needs 2⁹⁹ − 1 computations. The above styles of attack are only quailtative analysis, without an actual example of the successful attack. In 2005, designers summarize recently published styles of attack on the LILI-128 stream cipher, and assert that LILI-128 remains unbroken [8]. They encourage further analysis of the LILI-128 stream cipher.

In Figure 1, designers do not publicize the expression of the nonlinear filter function f_d. Up to now, all attacks explain only that LILI-128 has lower complexity as designers claim, and do not get the expression of the nonlinear filter function f_d. The aim which we attack LILI- 128 is the expression of the nonlinear filter function f_d. The reference module of LILI-128 is got from the Information Security Institute’s webpage: http://www.isi.qut.

edu.au/resources/lili/. We implement the reference module on ASCII initial value “yyyy yyyyyyyyyyy y” and get the keystream sequence of LILI-128, and study the expression of the nonlinear filter function f_d. First, we determine the least keystream bit amount of expressing the nonlinear filter function f_d from the LILI-128 kystream sequence by means of measuring the complexity of the LILI-128 kystream sequence. The least keystream bit amount of expressing the nonlinear filter function f_d is not equal for differ initial state. The least keystream bit amount is approximately 2¹² - 2¹³ bits. We reconstruct the expression f_d from Shortest bit stream sequence by clusterig, nonlinear predictive and nonlinear synchronization, which has 46 items from liner items to nonlinear polynomials with 6 orders as follows:

If we describe LILI-128 keystream generator by MATLAB, the stages of LFSR_c be labeled s[1], s[2],∙∙∙, s[39] from left to right. At every time, we have the following formula to calculate the feedback bit:

where indicates the addition modulo 2. Let the LFSR_c shift left, and s[38] = w. Sequentially circulating, the LFSR_c will produce a linear pseudorandom sequence. The function f_c is given by

The stages of LFSR_d be labeled u[1], u[2], ∙∙∙, u[89] from left to right. At time k, the feedback bit is calculated by the following formula

where indicates the addition modulo 2. Let the LFSR_d shift left, and u[89] = w. According to above circulation, the LFSR_d will produce a linear pseudorandom sequence. We map the set: (1, 2, 3, 4, 5, 6, 7, 8, 9, 10) into the set: (1, 2, 4, 8, 13, 21, 31, 45, 66, 81), the f_d is given by:

We simulate the keystream sequence of LILI-128 in Figure 1 using (6) by 128 bits initial values which are ASCII “yyyyyyyyyyyyyyyy”. Compare simulating result with the result of implementing the reference module, and two methods produce the same synchronous keystream sequence under same initial state “yyyyyyyyyyyyyyyy”. We verify the nonlinear filter function f_d again by initial state “ggggggggggggggg” and “123456789abcdefg”, and obtain all the same synchronous keystream sequence, so that the validation work indicates we have successfully broken the nonlinear filter Boolean function of LILI-128 stream cipher generator.

In the design of LILI-128, Designers made an attempt to confuse the linear pseudorandom binary sequence with the long period P_c = 2⁸⁹ – 1 by the clock-control with the long period P_c = 2³⁹ – 1 and get high linear complexity of keystream sequence. The nonlinear sequence is generated through the nonlinear filter function f_d with 46 items and the most algebraic 6 orders to withstand all kinds of currently known attack. The LILI-128 keystream generator certainly resists currently known styles of attack, but it does not withstand our attack. The currently known styles of attack based on time complexity and memory complexity of arithmetic. The attacks do not consider the complexity of keystream sequence oneself. We get the least bit amount of the attack by measuring the complexity of the keystream sequence of LILI-128 and the nonlinear filter function f_d from the least keystream bit amount by the phase space reconstruction, Clustering, nonlinear prediction and nonlinear synchronization. In this paper, our research work has made a great breakthrough in stream cipher analysis, breaks the dream that stream cipher of LILI-128 is not attacked, and will bring the importance influence on stream cipher design. We only publish our research result and do not expatiate the specific theory and algorithm of attacking LILI-128 stream cipher because our attack method has important application in attacking military stream cipher. Reader verifies above f_d first of all. And then f_d is redesigned. The stream cipher sequence of LILI-128 output is obtained by simulating Figure 1 given an ASCII initial state. Reader sends the ASCII initial state and the stream cipher sequence whose length is 2¹³ bits to us. We will return f_d to him. The Boolean function f_d of nonlinear filter is got from known stream ciphers sequence, which belongs to research areas of blind signal processing.