Paper 2015/312

Improving Key Recovery to 784 and 799 rounds of Trivium using Optimized Cube Attacks

Pierre-Alain Fouque and Thomas Vannet


Dinur and Shamir have described cube attacks at EUROCRYPT ’09 and they have shown how efficient they are on the stream cipher Trivium up to 767 rounds. These attacks have been extended to distinguishers but since this seminal work, no better results on the complexity of key recovery attacks on Trivium have been presented. It appears that the time complexity to compute cubes is expensive and the discovery of linear superpoly also requires the computation of many cubes. In this paper, we increase the number of attacked initialization rounds by improving the time complexity of computing cube and we show attacks that go beyond this bound. We were able to find linear superpoly up to 784 rounds, which leads to an attack requiring $2^{39}$ queries. Using quadratic superpoly, we were also able to provide another attack up to 799 rounds which complexity is $2^{40}$ queries and $2^{62}$ for the exhaustive search part. To achieve such results, we find a way to reduce the density of the polynomials, we look for quadratic relations and we extensively use the Moebius transform to speed up computations for various purposes.

Available format(s)
Secret-key cryptography
Publication info
A minor revision of an IACR publication in FSE 2013
cryptanalysisTriviumcube attacks
Contact author(s)
Pierre-Alain Fouque @ ens fr
2015-04-06: received
Short URL
Creative Commons Attribution


      author = {Pierre-Alain Fouque and Thomas Vannet},
      title = {Improving Key Recovery to 784 and 799 rounds of Trivium using Optimized Cube Attacks},
      howpublished = {Cryptology ePrint Archive, Paper 2015/312},
      year = {2015},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.