In recent years, the bitslice technique has been used several times to implement the A5/1 generator [1, 9]. However, these implementations were not used for the brute-force cryptanalysis, and the authors of the present work do not know about any attempts to combine Anderson’s attack with bitslice technique. The main points of implementing this combination will be described further.

As most of the contemporary computational platforms contain GPRs of width at least 32 bits, from now on assume *d* = 32. Thus, within the present section, if not specified otherwise, the variables with names in uppercase correspond to 32-bit words. Similarly, the operations with these variables are assumed to be bitwise. A computational device is assumed to be capable of performing bitwise variants of functions from the basis *B* = {∧, ∨, ¬, ⊕}.

The description of the details of bitslice implementation of A5/1 generator follows. Each generator’s cell with number *n*, *n* ∈ {1, …, 64} is associated with a corresponding word *W*_{n} ∈ {0, 1}^{32}:

$$\begin{array}{}{\displaystyle LFSR1:\phantom{\rule{1em}{0ex}}{W}_{1},\dots ,{W}_{19};}\\ LFSR2:\phantom{\rule{1em}{0ex}}{W}_{20},\dots ,{W}_{42};\\ LFSR3:\phantom{\rule{1em}{0ex}}{W}_{43},\dots ,{W}_{64}.\end{array}$$

From now on, assume that *W*′ is the value of the word *W* at the next time moment, for example after the LFSR was shifted or a keystream bit was produced. Then, in bitslice technique, the shifting of the LFSR register (LFSR1 in this example) will take the following form:

$$\begin{array}{}{\displaystyle {W}_{1}^{{}^{\prime}}={W}_{19}\oplus {W}_{18}\oplus {W}_{17}\oplus {W}_{14},}\\ {W}_{n}^{{}^{\prime}}={W}_{n-1},n\in \{2,\dots 19\},\end{array}$$

where ⊕ is the bitwise addition modulo 2 of 32-bit vectors. The calculation of the 32-bit word *W*_{out} ∈ {0, 1}^{32} containing corresponsing keystream bits will look as follows:

$$\begin{array}{}{\displaystyle {W}_{out}={W}_{19}\oplus {W}_{41}\oplus {W}_{64}.}\end{array}$$

The conditional clocking is somewhat more complicated to implement in bitslice technique. First, to know if the LFSRs should be shifted or not, one needs to calculate the corresponding shifting flags *F*_{1}, *F*_{2}, *F*_{3} using the majority function:

$$\begin{array}{}{\displaystyle {W}_{maj}=majority\phantom{\rule{thinmathspace}{0ex}}({W}_{9},{W}_{30},{W}_{52}),}\\ \phantom{\rule{1em}{0ex}}\phantom{\rule{thinmathspace}{0ex}}{F}_{1}={W}_{9}\oplus \mathrm{\neg}{W}_{maj},\\ \phantom{\rule{1em}{0ex}}\phantom{\rule{thinmathspace}{0ex}}{F}_{2}=\oplus \mathrm{\neg}{W}_{maj},\\ \phantom{\rule{1em}{0ex}}\phantom{\rule{thinmathspace}{0ex}}{F}_{3}=\oplus \mathrm{\neg}{W}_{maj}.\end{array}$$

If *majority* is not implemented as a single bitwise instruction, it can be represented via a superposition of bitwise instructions corresponding to that from *B*.

To implement the conditional shifting of an LFSR one can use the bitwise counterpart of the *bitselect* function of arity 3:

$$\begin{array}{}{\displaystyle bitselect(x,y,z)=\left\{\begin{array}{}y,x=1\\ z,x=0\end{array}\right.\phantom{\rule{1em}{0ex}},x,y,z,\in \{0,1\}.}\end{array}$$

If the computational architecture lacks the hardware implementation of this function, it can be emulated via standard bitwise functions corresponding to the matching functions from the basis *B*:

$$\begin{array}{}{\displaystyle bitselect(X,Y,Z)=(X\wedge Y)\vee (\mathrm{\neg}X\wedge Z).}\end{array}$$

Shifting LFSR1 using the bitwise version of *bitselect* and the corresponding shifting flag *F*_{1} looks the following way:

$$\begin{array}{}{\displaystyle {W}_{1}^{{}^{\prime}}=bitselect({F}_{1},({W}_{19}\oplus {W}_{18}\oplus {W}_{17}\oplus {W}_{14}),{W}_{1});}\\ {W}_{n}^{{}^{\prime}}=bitselect({F}_{1},{W}_{n-1},{W}_{n}),n\in \{2,\dots 19\},\end{array}$$

The shifting procedures for LFSR2-3 are conducted similarly. Now consider the Anderson’s attack in the context of bitslice technique.

## Comments (0)

General note:By using the comment function on degruyter.com you agree to our Privacy Statement. A respectful treatment of one another is important to us. Therefore we would like to draw your attention to our House Rules.