Cryptanalysis of the stream cipher DECIM

Abstract

DECIM is a hardware oriented stream cipher with an 80-bit key and a 64-bit IV. In this paper, we point out two serious flaws in DECIM. One flaw is in the initialization of DECIM. It allows to recover about half of the key bits bit-by-bit when one key is used with about 220 random IVs; only the first two bytes of each keystream are needed in the attack. The amount of computation required in the attack is negligible. Another flaw is in the keystream generation algorithm of DECIM. The keystream is heavily biased: any two adjacent keystream bits are equal with probability about 1/2 + 2-9. A message could be recovered from the ciphertext if that message is encrypted by DECIM for about 218 times. DECIM with an 80-bit key and an 80-bit IV is also vulnerable to these attacks. © International Association for Cryptologic Research 2006.