The Grain 128a stream cipher was first purposed at Symmetric Key Encryption Workshop (SKEW) in 2011 as an improvement of the predecessor Grain 128, which added security enhancements and optional message authentication using the Encrypt & MAC approach. One of the important features of the Grain family is that the throughput can be increased at the expense of additional hardware. Grain 128a is designed by Martin Ågren, Martin Hell, Thomas Johansson and Willi Meier.
Description of the cipher
Grain 128a consists of two large parts: Pre-output function and MAC. The pre-output function has an internal state size of 256 bits, consisting of two registers of size 128 bit: NLFSR and LFSR. The MAC supports variable tag lengths w such that 0 < w ≤ 32 {\displaystyle 0<w\leq 32} . The cipher uses a 128 bit key. The cipher supports two modes of operation: with or without authentication, which is configured via the supplied I V 0 {\displaystyle IV_{0}} such that if I V 0 = 1 {\displaystyle IV_{0}=1} then authentication of the message is enabled, and if I V 0 = 0 {\displaystyle IV_{0}=0} authentication of the message is disabled.
Pre-output function The pre-output function consists of two registers of size 128 bit: NLFSR ( b {\displaystyle b} ) and LFSR ( s {\displaystyle s} ) along with 2 feedback polynomials f {\displaystyle f} and g {\displaystyle g} and a boolean function h {\displaystyle h} .
f ( x ) = 1 + x 32 + x 47 + x 58 + x 90 + x 121 + x 128 {\displaystyle f(x)=1+x^{32}+x^{47}+x^{58}+x^{90}+x^{121}+x^{128}}
g ( x ) = 1 + x 32 + x 37 + x 72 + x 102 + x 128 + x 44 x 60 + x 61 x 125 + x 63 x 67 x 69 x 101 + x 80 x 88 + x 110 x 111 + x 115 x 117 + x 46 x 50 x 58 + x 103 x 104 x 106 + x 33 x 35 x 36 x 40 {\displaystyle g(x)=1+x^{32}+x^{37}+x^{72}+x^{102}+x^{128}+x^{44}x^{60}+x^{61}x^{125}+x^{63}x^{67}x^{69}x^{101}+x^{80}x^{88}+x^{110}x^{111}+x^{115}x^{117}+x^{46}x^{50}x^{58}+x^{103}x^{104}x^{106}+x^{33}x^{35}x^{36}x^{40}}
h ( x ) = b i + 12 s i + 8 + s i + 13 s i + 20 + b i + 95 s i + 42 + s i + 60 s i + 79 + b i + 12 b i + 95 s i + 94 {\displaystyle h(x)=b_{i+12}s_{i+8}+s_{i+13}s_{i+20}+b_{i+95}s_{i+42}+s_{i+60}s_{i+79}+b_{i+12}b_{i+95}s_{i+94}}
In addition to the feedback polynomials, the update functions for the NLFSR and the LFSR are:
… excerpt ends here. Continue reading the full article.



