Breaking grain-128 with dynamic cube attacks

Itai Dinur, Adi Shamir

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

127 Scopus citations


We present a new variant of cube attacks called a dynamic cube attack. Whereas standard cube attacks [4] find the key by solving a system of linear equations in the key bits, the new attack recovers the secret key by exploiting distinguishers obtained from cube testers. Dynamic cube attacks can create lower degree representations of the given cipher, which makes it possible to attack schemes that resist all previously known attacks. In this paper we concentrate on the well-known stream cipher Grain-128 [6], on which the best known key recovery attack [15] can recover only 2 key bits when the number of initialization rounds is decreased from 256 to 213. Our first attack runs in practical time complexity and recovers the full 128-bit key when the number of initialization rounds in Grain-128 is reduced to 207. Our second attack breaks a Grain-128 variant with 250 initialization rounds and is faster than exhaustive search by a factor of about 228. Finally, we present an attack on the full version of Grain-128 which can recover the full key but only when it belongs to a large subset of 2-10 of the possible keys. This attack is faster than exhaustive search over the 2118 possible keys by a factor of about 215. All of our key recovery attacks are the best known so far, and their correctness was experimentally verified rather than extrapolated from smaller variants of the cipher. This is the first time that a cube attack was shown to be effective against the full version of a well known cipher which resisted all previous attacks.

Original languageEnglish
Title of host publicationFast Software Encryption - 18th International Workshop, FSE 2011, Revised Selected Papers
Number of pages21
StatePublished - 11 Jul 2011
Externally publishedYes
Event18th International Workshop on Fast Software Encryption, FSE 2011 - Lyngby, Denmark
Duration: 13 Feb 201116 Feb 2011

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume6733 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349


Conference18th International Workshop on Fast Software Encryption, FSE 2011


  • Cryptanalysis
  • Grain-128
  • cube attacks
  • cube testers
  • dynamic cube attacks
  • stream ciphers

ASJC Scopus subject areas

  • Theoretical Computer Science
  • Computer Science (all)


Dive into the research topics of 'Breaking grain-128 with dynamic cube attacks'. Together they form a unique fingerprint.

Cite this