MUGI
Encyclopedia
In cryptography
, MUGI is a pseudorandom number generator
(PRNG) designed for use as a stream cipher
. It has been recommended for Japanese government use by the CRYPTREC
project.
MUGI takes a 128-bit secret key
and a 128-bit initial vector
(IV). After a key- and IV- setup process, MUGI outputs 64-bit output strings based on the internal state, while updating the internal state after each output block. MUGI has a 1216-bit internal state; there are three 64-bit registers (the "state") and 16 64-bit registers (the "buffer").
MUGI uses the non-linear S-box that was originally defined in Advanced Encryption Standard
(AES). A part of the linear transformation also reuses the MDS matrix
of AES. The basic design is influenced by that of Panama.
In the paper, "A weakness of the linear part of stream cipher MUGI", by GOLIC Jovan Dj, Roy Bimal and Meier Willi, the abstract claims: "The linearly updated component of the stream cipher MUGI, called the buffer, is analyzed theoretically by using the generating function method. In particular, it is proven that the intrinsic response of the buffer, without the feedback from the nonlinearly updated component, consists of binary linear recurring sequences with small linear complexity 32 and with extremely small period 48. It is then shown how this weakness can in principle be used to facilitate the linear cryptanalysis of MUGI with two main objectives: to reconstruct the secret key and to find linear statistical distinguishers."
In the paper, "Analysis of the Non-linear Part of Mugi" by Alex Biryukov
and Adi Shamir
, the abstract claims: "This paper presents the results of a preliminary analysis of the stream cipher Mugi. We study the nonlinear component of this cipher and identify several potential weaknesses in its design. While we can not break the full Mugi design, we show that it is extremely sensitive to small variations. For example, it is possible to recover the full 1216-bit state of the cipher and the original 128-bit secret key using just 56 words of known stream and in 214 steps of analysis if the cipher outputs any state word which is different than the one used in the actual design. If the linear part is eliminated from the design, then the secret non-linear 192-bit state can be recovered given only three output words and in just 232 steps. If it is kept in the design but in a simplified form, then the scheme can be broken by an attack which is slightly faster than exhaustive search."
Cryptography
Cryptography is the practice and study of techniques for secure communication in the presence of third parties...
, MUGI is a pseudorandom number generator
Pseudorandom number generator
A pseudorandom number generator , also known as a deterministic random bit generator , is an algorithm for generating a sequence of numbers that approximates the properties of random numbers...
(PRNG) designed for use as a stream cipher
Stream cipher
In cryptography, a stream cipher is a symmetric key cipher where plaintext digits are combined with a pseudorandom cipher digit stream . In a stream cipher the plaintext digits are encrypted one at a time, and the transformation of successive digits varies during the encryption...
. It has been recommended for Japanese government use by the CRYPTREC
CRYPTREC
CRYPTREC is the Cryptography Research and Evaluation Committees set up by the Japanese Government to evaluate and recommend cryptographic techniques for government and industrial use...
project.
MUGI takes a 128-bit secret key
Key (cryptography)
In cryptography, a key is a piece of information that determines the functional output of a cryptographic algorithm or cipher. Without a key, the algorithm would produce no useful result. In encryption, a key specifies the particular transformation of plaintext into ciphertext, or vice versa...
and a 128-bit initial vector
Initialization vector
In cryptography, an initialization vector is a fixed-size input to a cryptographic primitive that is typically required to be random or pseudorandom...
(IV). After a key- and IV- setup process, MUGI outputs 64-bit output strings based on the internal state, while updating the internal state after each output block. MUGI has a 1216-bit internal state; there are three 64-bit registers (the "state") and 16 64-bit registers (the "buffer").
MUGI uses the non-linear S-box that was originally defined in Advanced Encryption Standard
Advanced Encryption Standard
Advanced Encryption Standard is a specification for the encryption of electronic data. It has been adopted by the U.S. government and is now used worldwide. It supersedes DES...
(AES). A part of the linear transformation also reuses the MDS matrix
MDS matrix
An MDS matrix is a matrix representing a function with certain diffusion properties that have useful applications in cryptography...
of AES. The basic design is influenced by that of Panama.
Security
As of September 2006, there are no known attacks against MUGI that are faster than serial brute-force of the key space or of the internal state.In the paper, "A weakness of the linear part of stream cipher MUGI", by GOLIC Jovan Dj, Roy Bimal and Meier Willi, the abstract claims: "The linearly updated component of the stream cipher MUGI, called the buffer, is analyzed theoretically by using the generating function method. In particular, it is proven that the intrinsic response of the buffer, without the feedback from the nonlinearly updated component, consists of binary linear recurring sequences with small linear complexity 32 and with extremely small period 48. It is then shown how this weakness can in principle be used to facilitate the linear cryptanalysis of MUGI with two main objectives: to reconstruct the secret key and to find linear statistical distinguishers."
In the paper, "Analysis of the Non-linear Part of Mugi" by Alex Biryukov
Alex Biryukov
Alex Biryukov is a cryptographer, currently an assistant professor at the University of Luxembourg. His notable work includes the design of the stream cipher LEX, as well as the cryptanalysis of numerous cryptographic primitives. In 1998, he developed impossible differential cryptanalysis together...
and Adi Shamir
Adi Shamir
Adi Shamir is an Israeli cryptographer. He is a co-inventor of the RSA algorithm , a co-inventor of the Feige–Fiat–Shamir identification scheme , one of the inventors of differential cryptanalysis and has made numerous contributions to the fields of cryptography and computer...
, the abstract claims: "This paper presents the results of a preliminary analysis of the stream cipher Mugi. We study the nonlinear component of this cipher and identify several potential weaknesses in its design. While we can not break the full Mugi design, we show that it is extremely sensitive to small variations. For example, it is possible to recover the full 1216-bit state of the cipher and the original 128-bit secret key using just 56 words of known stream and in 214 steps of analysis if the cipher outputs any state word which is different than the one used in the actual design. If the linear part is eliminated from the design, then the secret non-linear 192-bit state can be recovered given only three output words and in just 232 steps. If it is kept in the design but in a simplified form, then the scheme can be broken by an attack which is slightly faster than exhaustive search."