[Paper Review] SOSEMANUK: a fast software-oriented stream cipher

Côme Berbain, Olivier Billet+10 more|Oct 10, 2008

Cryptographic Implementations and Security2 references17 citations

TL;DR

Sosemanuk is a high-speed software-oriented stream cipher designed for 128–256-bit keys, combining principles from SNOW 2.0 and SERPENT to achieve both strong security and exceptional performance. It uses a reduced internal state, optimized data mappings, and a fast key/IV setup via a 24-round SERPENT variant, resulting in top-tier throughput on modern processors and low cache pressure, with 128-bit security claimed for all key lengths.

ABSTRACT

Sosemanuk is a new synchronous software-oriented stream cipher, corresponding to Profile 1 of the ECRYPT call for stream cipher primitives. Its key length is variable between 128 and 256 bits. It ac- commodates a 128-bit initial value. Any key length is claimed to achieve 128-bit security. The Sosemanuk cipher uses both some basic design principles from the stream cipher SNOW 2.0 and some transformations derived from the block cipher SERPENT. Sosemanuk aims at improv- ing SNOW 2.0 both from the security and from the efficiency points of view. Most notably, it uses a faster IV-setup procedure. It also requires a reduced amount of static data, yielding better performance on several architectures.

Motivation & Objective

• To design a fast, secure, and efficient software-oriented stream cipher suitable for modern processors.
• To improve upon SNOW 2.0 by eliminating potential structural weaknesses and reducing data cache pressure.
• To enhance key setup efficiency using a 24-round SERPENT variant for faster resynchronization.
• To achieve 128-bit security for all key lengths (128–256 bits) while maintaining high throughput.
• To optimize register usage and reduce static data to improve performance on RISC and other architectures.

Proposed method

• The cipher uses a 10-word LFSR over F_{2^32} with a primitive polynomial Q(X) = X^8 + X^7 + X^5 + X^3 + 1.
• It employs a nonlinear transformation function 'Trans' that combines XOR, rotation, and bitslice-based S-box operations for confusion and diffusion.
• The 'mux' operation is used to introduce nonlinearity and resist fast correlation and algebraic attacks.
• A 24-round SERPENT variant (Serpent24) is used for key and IV setup, providing strong diffusion with minimal overhead.
• Serpent1, a single S-box layer from SERPENT, is used in bitslice mode to provide efficient nonlinear mixing.
• The internal state is updated using a combination of LFSR feedback and nonlinear functions, with output generated via a 32-bit XOR operation.

Experimental results

Research questions

• RQ1 Can a stream cipher be designed to achieve both high performance and strong resistance to algebraic and correlation attacks?
• RQ2 How can key and IV setup be optimized for speed without compromising security?
• RQ3 Can reduced internal state size and static data improve performance on RISC architectures?
• RQ4 Does using bitslice-mode S-boxes from SERPENT enhance security and efficiency in a software stream cipher?
• RQ5 Can a cipher maintain 128-bit security across variable key lengths (128–256 bits) while being faster than existing alternatives?

Key findings

• Sosemanuk achieves 759.06 cycles per byte on an AMD Athlon 64 X2 4200+ at 2.20GHz, outperforming most competitors in its class.
• On the same platform, it requires only 692.71 cycles for IV setup, significantly faster than SNOW 2.0’s 489.35 cycles.
• On an Alpha EV6 at 500MHz, Sosemanuk uses 1301.09 cycles for key setup, which is competitive despite the older architecture.
• Hardware implementation on 0.13µm CMOS requires 18,819 gates and achieves a power-area-time product of 564.8 nJ-µm² at 10 Mbps, suitable for WLAN.
• The cipher demonstrates low data cache pressure due to reduced static data, improving performance on RISC processors.
• The use of Serpent1 in bitslice mode and the 'mux' function effectively resists algebraic and fast correlation attacks.