## Cryptology ePrint Archive: Report 2016/092

Cryptanalysis of the Full Spritz Stream Cipher

Abstract: Spritz is a stream cipher proposed by Rivest and Schuldt at the rump session of CRYPTO 2014. It is intended to be a replacement of the popular RC4 stream cipher. In this paper we propose distinguishing attacks on the full Spritz, based on {\it a short-term bias} in the first two bytes of a keystream and {\it a long-term bias} in the first two bytes of every cycle of $N$ keystream bytes, where $N$ is the size of the internal permutation. Our attacks are able to distinguish a keystream of the {\it full} Spritz from a random sequence with samples of first two bytes produced by $2^{44.8}$ multiple key-IV pairs or $2^{60.8}$ keystream bytes produced by a single key-IV pair. These biases are also useful in the event of plaintext recovery in a broadcast attack. In the second part of the paper, we look at a state recovery attack on Spritz, in a special situation when the cipher enters a class of weak states. We determine the probability of encountering such a state, and demonstrate a state recovery algorithm that betters the $2^{1400}$ step algorithm of Ankele et al. at Latincrypt 2015.

Category / Keywords: secret-key cryptography / RC4, Spritz, stream cipher, short-term bias, long-term bias, distinguishing attack, plaintext recovery attack, state recovery attack

Original Publication (with minor differences): IACR-FSE-2016

Date: received 2 Feb 2016, last revised 3 Feb 2016

Contact author: subb at dtu dk

Available format(s): PDF | BibTeX Citation

Short URL: ia.cr/2016/092

[ Cryptology ePrint archive ]