#jsDisabledContent { display:none; } My Account | Register | Help

# Stream cipher attack

Article Id: WHEBN0001180461
Reproduction Date:

 Title: Stream cipher attack Author: World Heritage Encyclopedia Language: English Subject: Collection: Cryptographic Attacks Publisher: World Heritage Encyclopedia Publication Date:

### Stream cipher attack

Stream ciphers, where plaintext bits are combined with a cipher bit stream by an exclusive-or operation (xor), can be very secure if used properly. However they are vulnerable to attack if certain precautions are not followed:

• keys must never be used twice
• valid decryption should never be relied on to indicate authenticity

## Reused key attack

Stream ciphers are vulnerable to attack if the same key is used twice (depth of two) or more.

Say we send messages A and B of the same length, both encrypted using same key, K. The stream cipher produces a string of bits C(K) the same length as the messages. The encrypted versions of the messages then are:

E(A) = A xor C
E(B) = B xor C

where xor is performed bit by bit.

Say an adversary has intercepted E(A) and E(B). He can easily compute:

E(A) xor E(B)

However, xor is commutative and has the property that X xor X = 0 (self-inverse) so:

E(A) xor E(B) = (A xor C) xor (B xor C) = A xor B xor C xor C = A xor B

If one message is longer than the other, our adversary just truncates the longer message to the size of the shorter and his attack will only reveal that portion of the longer message. In other words, if anyone intercepts two messages encrypted with the same key, they can recover A xor B, which is a form of running key cipher. Even if neither message is known, as long as both messages are in a natural language, such a cipher can often be broken by paper-and-pencil methods. During World War II, British cryptanalyst John Tiltman accomplished this with the Lorenz cipher (dubbed "Tunny"). With an average personal computer, such ciphers can usually be broken in a matter of minutes. If one message is known, the solution is trivial.

Another situation where recovery is trivial is if traffic-flow security measures have each station sending a continuous stream of cipher bits, with null characters (e.g. LTRS in Baudot) being sent when there is no real traffic. This is common in military communications. In that case, and if the transmission channel is not fully loaded, there is a good likelihood that one of the ciphertext streams will be just nulls. The NSA goes to great lengths to prevent keys from being used twice. 1960s-era encryption systems often included a punched card reader for loading keys. The mechanism would automatically cut the card in half when the card was removed, preventing its reuse.

One way to avoid this problem is to use an initialization vector (IV), sent in the clear, that is combined with a secret master key to create a one-time key for the stream cipher. This is done in several common systems that use the popular stream cipher RC4, including Wired Equivalent Privacy (WEP), Wi-Fi Protected Access (WPA) and Ciphersaber. One of the many problems with WEP was that its IV was too short, 24 bits. This meant that there was a high likelihood that the same IV would be used twice if more than a few thousand packets were sent with the same master key (see birthday attack), subjecting the packets with duplicated IV to the key reuse attack. This problem was fixed in WPA by changing the "master" key frequently.

## Bit-flipping attack

Suppose an adversary knows the exact content of all or part of one of our messages. As a part of a man in the middle attack or replay attack, he can alter the content of the message without knowing the key, K. Say, for example, he knows a portion of the message, say an electronics fund transfer, contains the ASCII string "\$1000.00". He can change that to "\$9500.00" by XORing that portion of the ciphertext with the string: "\$1000.00" xor "\$9500.00". To see how this works, consider that the cipher text we send is just C(K) xor "\$1000.00". The new message the adversary is creating is:

(C(K) xor "\$1000.00") xor ("\$1000.00" xor "\$9500.00") = C(K) xor "\$1000.00" xor "\$1000.00" xor "\$9500.00" = C(K) xor "\$9500.00"

Recall that a string XORed with itself produces all zeros and that a string of zeros XORed with another string leaves that string intact. The result, C(K) xor "\$9500.00", is what our ciphertext would have been if \$9500 were the correct amount. See also: malleability (cryptography).

Bit-flipping attacks can be prevented by including message authentication code to increase the likelihood that tampering will be detected.

## References

• http://www.isaac.cs.berkeley.edu/isaac/wep-faq.html
This article was sourced from Creative Commons Attribution-ShareAlike License; additional terms may apply. World Heritage Encyclopedia content is assembled from numerous content providers, Open Access Publishing, and in compliance with The Fair Access to Science and Technology Research Act (FASTR), Wikimedia Foundation, Inc., Public Library of Science, The Encyclopedia of Life, Open Book Publishers (OBP), PubMed, U.S. National Library of Medicine, National Center for Biotechnology Information, U.S. National Library of Medicine, National Institutes of Health (NIH), U.S. Department of Health & Human Services, and USA.gov, which sources content from all federal, state, local, tribal, and territorial government publication portals (.gov, .mil, .edu). Funding for USA.gov and content contributors is made possible from the U.S. Congress, E-Government Act of 2002.

Crowd sourced content that is contributed to World Heritage Encyclopedia is peer reviewed and edited by our editorial staff to ensure quality scholarly research articles.