A Key-Recovery Attack on SOBER-128

Authors Kaisa Nyberg, Risto Hakala

Thumbnail PDF


  • Filesize: 254 kB
  • 11 pages

Document Identifiers

Author Details

Kaisa Nyberg
Risto Hakala

Cite AsGet BibTex

Kaisa Nyberg and Risto Hakala. A Key-Recovery Attack on SOBER-128. In Symmetric Cryptography. Dagstuhl Seminar Proceedings, Volume 7021, pp. 1-11, Schloss Dagstuhl – Leibniz-Zentrum für Informatik (2007)


In this talk we consider linear approximations of layered cipher constructions with secret key-dependent constants that are inserted between layers, and where the layers have strong interdependency. Then clearly, averaging over the constant would clearly be wrong as it will break the interdependencies, and the Piling Up-lemma cannot be used. We show how to use linear approximations to divide the constants into constant classes, not necessary determined by a linear relation. As an example, a nonlinear filter generator SOBER-128 is considered and we show how to extend Matsui's Algorithm I in this case. Also the possibility of using multiple linear approximations simultaneously is considered.
  • Linear approximations
  • correlation
  • linear cryptanalysis
  • key recovery attack
  • piling-up lemma
  • SOBER-128


  • Access Statistics
  • Total Accesses (updated on a weekly basis)
    PDF Downloads
Questions / Remarks / Feedback

Feedback for Dagstuhl Publishing

Thanks for your feedback!

Feedback submitted

Could not send message

Please try again later or send an E-mail