Grain 128a

Description of the cipher

Grain 128a consists of two large parts: Pre-output function and MAC. The pre-output function has an internal state size of 256 bits, consisting of two registers of size 128 bit: NLFSR and LFSR. The MAC supports variable tag lengths w such that 0 < w ≤ 32 . The cipher uses a 128 bit key.

The cipher supports two modes of operation: with or without authentication, which is configured via the supplied I V 0 such that if I V 0 = 1 then authentication of the message is enabled, and if I V 0 = 0 authentication of the message is disabled.

Pre-output function

The pre-output function consists of two registers of size 128 bit: NLFSR ( b ) and LFSR ( s ) along with 2 feedback polynomials f and g and a boolean function h .

f ( x ) = 1 + x 32 + x 47 + x 58 + x 90 + x 121 + x 128

g ( x ) = 1 + x 32 + x 37 + x 72 + x 102 + x 128 + x 44 x 60 + x 61 x 125 + x 63 x 67 x 69 x 101 + x 80 x 88 + x 110 x 111 + x 115 x 117 + x 46 x 50 x 58 + x 103 x 104 x 106 + x 33 x 35 x 36 x 40

h ( x ) = b i + 12 s i + 8 + s i + 13 s i + 20 + b i + 95 s i + 42 + s i + 60 s i + 79 + b i + 12 b i + 95 s i + 94

In addition to the feedback polynomials, the update functions for the NLFSR and the LFSR are:

b i + 128 = s i + b i + b i + 26 + b i + 56 + b i + 91 + b i + 96 + b i + 3 b i + 67 + b i + 11 b i + 13 + b i + 17 b i + 18 + b i + 27 b i + 59 + b i + 40 b i + 48 + b i + 61 b i + 65 + b i + 68 b i + 84 + b i + 88 b i + 92 b i + 93 b i + 95 + b i + 22 b i + 24 b i + 25 + b i + 70 b i + 78 b i + 82

s i + 128 = s i + s i + 7 + s i + 38 + s i + 70 + s i + 81 + s i + 96

The pre-output stream ( y ) is defined as:

y i = h ( x ) + s i + 93 + b i + 2 + b i + 12 + b i + 36 + b i + 45 + b i + 64 + b i + 73 + b i + 89

Initialisation

Upon initialisation we define an I V of 96 bit, where the I V 0 dictates the mode of operation.

The LFSR is initialised as:

s i = I V i for 0 ≤ i ≤ 95

s i = 1 for 96 ≤ i ≤ 126

s 127 = 0

The last 0 bit ensures that similar key-IV pairs do not produce shifted versions of each other.

The NLFSR is initialised by copying the entire 128 bit key ( k ) into the NLFSR:

b i = k i for 0 ≤ i ≤ 127

Start up clocking

Before the pre-output function can begin to output its pre-output stream it has to be clocked 256 times to warm up, during this stage the pre-output stream is fed into the feedback polynomials g and f .

Key stream

The key stream ( z ) and MAC functionality in Grain 128a both share the same pre-output stream ( y ). As authentication is optional our key stream definition depends upon the I V 0 .

When authentication is enabled, the MAC functionality uses the first 2 w bits (where w is the tag size) after the start up clocking to initialise. The key stream is then assigned every other bit due to the shared pre-output stream.

If authentication is enabled:

z i = y 2 w + 2 i

If authentication is disabled:

z i = y i

MAC

Grain 128a supports tags of size w up to 32 bit, to do this 2 registers of size w is used, a shift register( r ) and an accumulator( a ). To create a tag of a message m where L is the length of m + 1 as we have to set m L = 1 to ensure that i.e. m 1 = 1 and m 2 = 10 has different tags, and also making it impossible to generate a tag that completely ignores the input from the shift register after initialisation.

For each bit 0 ≤ j ≤ 31 in the accumulator we at time 0 ≤ i ≤ L we denounce a bit in the accumulator as a i j .

Initialisation

When authentication is enabled Grain 128a uses the first 2 w bits of the pre-output stream( y ) to initialise the shift register and the accumulator. This is done by:

Shift register:

r i = y i + 31 for 0 ≤ i ≤ 31

Accumulator:

a 0 j = y j for 0 ≤ j ≤ 31

Tag generation

Shift register:

The shift register is fed all the odd bits of the pre-output stream( y ):

r i + 31 = y 64 + 2 i + 1

Accumulator:

a i + 1 j = a i j + m i r i + j for 0 ≤ i ≤ L

Final tag

When the cipher has completed the L iterations the final tag( t ) is the content of the accumulator:

t i = a L + 1 i for 0 ≤ i ≤ 31