Rabbit (cipher)

Rabbit is a high-speed stream cipher first presented^[1] in February 2003 at the 10th FSE workshop. In May 2005, it was submitted to the eSTREAM project of the ECRYPT network.

Rabbit was designed by Martin Boesgaard, Mette Vesterager, Thomas Pedersen, Jesper Christiansen and Ove Scavenius.

Rabbit uses a 128-bit key and a 64-bit initialization vector. The cipher was designed with high performance in software in mind, where fully optimized implementations achieve an encryption speed of up to 3.7 CPB on a Pentium 3, and of 9.7 CPB on an ARM7. However, the cipher also turns out to be very fast and compact in hardware.

The core component of the cipher is a bitstream generator which encrypts 128 message bits per iteration. The cipher's strength rests on a strong mixing of its inner state between two consecutive iterations. The mixing function is entirely based on arithmetical operations that are available on a modern processor, i.e., no S-boxes or lookup tables are required to implement the cipher. The mixing function uses a g-function based on arithmetical squaring, and the ARX operations -- logical XOR, bit-wise rotation with hard-wired rotation amounts, and addition modulo 2³².

The g-function used in Rabbit -- squaring a 32-bit number to produce a 64-bit number, and then combining the left half and the right half of that square number with xor, to produce a 32-bit result -- provides much better results than using the 32 middle bits of that square number (the middle-square method).^[2]

The authors of the cipher have provided a full set of cryptanalytic white papers on the Cryptico home page.^[3] It is also described in RFC 4503. Cryptico had patents pending for the algorithm and for many years required a license fee for commercial use of the cipher which was waived for non-commercial uses. However, the algorithm was made free for any use on October 6, 2008.^[4]

Security

Rabbit claims 128-bit security against attackers whose target is one specific key. If, however, the attacker targets a large number of keys at once and does not really care which one he breaks, then the small IV size results in a reduced security level of 96 bit. This is due to generic TMD trade-off attacks.^[5]

A small bias in the output of Rabbit exists,^[6] resulting in a distinguisher with 2²⁴⁷ complexity discovered by Jean-Philippe Aumasson in December 2006. Even though this distinguisher was improved to 2¹⁵⁸ in 2008,^[7] it's not a threat to Rabbit's security because its complexity is significantly higher than the brute-force of the key space (2¹²⁸).

References

External links

• Rabbit RFC
• eSTREAM page on Rabbit

Stream ciphers Widely used ciphers RC4 Block ciphers in stream mode ChaCha eSTREAM Portfolio Software HC-256 Rabbit Salsa20 SOSEMANUK Hardware Grain MICKEY Trivium Other ciphers A5/1 A5/2 Achterbahn E0 F-FCSR FISH ISAAC MUGI Panama Phelix Pike Py QUAD Scream SEAL SNOW SOBER SOBER-128 VEST WAKE Theory Shift register LFSR NLFSR Shrinking generator T-function IV Attacks Correlation attack Correlation immunity Cryptography History of cryptography Cryptanalysis Outline of cryptography Symmetric-key algorithm Block cipher Stream cipher Public-key cryptography Cryptographic hash function Message authentication code Random numbers Steganography Portal