26、利用动态立方体攻击破解Grain - 128

利用动态立方体攻击破解Grain - 128

1. Grain - 128简介

Grain - 128的状态由一个128位的线性反馈移位寄存器（LFSR）和一个128位的非线性反馈移位寄存器（NFSR）组成。其反馈函数分别为：
- LFSR反馈函数：$s_{i + 128} = s_i + s_{i + 7} + s_{i + 38} + s_{i + 70} + s_{i + 81} + s_{i + 96}$
- NFSR反馈函数：$b_{i + 128} = s_i + b_i + b_{i + 26} + b_{i + 56} + b_{i + 91} + b_{i + 96} + b_{i + 3}b_{i + 67} + b_{i + 11}b_{i + 13} + b_{i + 17}b_{i + 18} + b_{i + 27}b_{i + 59} + b_{i + 40}b_{i + 48} + b_{i + 61}b_{i + 65} + b_{i + 68}b_{i + 84}$

输出函数定义为：$z_i = \sum_{j\in A} b_{i + j} + h(x) + s_{i + 93}$，其中$A = {2, 15, 36, 45, 64, 73, 89}$，$h(x) = x_0x_1 + x_2x_3 + x_4x_5 + x_6x_7 + x_0x_4x_8$，变量$x_0, x_1, x_2, x_3, x_4, x_5, x_6, x_7$和$x_8$分别对应抽头位置$b_{i + 12}, s_{i + 8}, s_{i + 13}, s_{i + 20}, b_{i + 95}, s_{i + 42}, s_{i + 60}, s_{