I'm wondering if the following question would be on topic and ethical:

How would the stream cipher GOC be cryptanalyzed with modern techniques?

The GOC (Générateur d'Octets Chiffrants) is a stream cipher, designed circa 1982 in France, with the objective of being efficient on 8-bit microprocessors. It was widely deployed (and occasionally used) in France, notably in the Lecam, a Smart Card reader connected to (or embedded into) a Minitel (an ancestor of the web browser). The GOC was mostly used to encipher information displayed on a terminal (personal bank statement, stock prices available for a fee..), and key presses.

The GOC is described in exquisite detail in patent FR2519828A2, assigned to the French state (I'm aware of a single typo, which can be corrected with common sense or from the drawing). At least the first named inventor is a noted cryptographer (he's the G in GQ, a zero-knowledge protocol).

In summary, the GOC has a 64-bit key; a state of 109 bits (organized as 19 bytes); and produce 5 pseudo-random bits at each step, which involves a dozen elementary operations on bytes: XOR, addition, modified modular reduction mod 31 or 127 reducing to some subtractions. I have short portable C code that I wrote from specs, and a KAT, which (I believe) match deployed implementations. I could post that as part of the question, or elsewhere.

In its usage context, the GOC is typically keyed with the output of DES or similar algorithm implemented in a Smart Card, thus it is fair to disregard related-key attacks. Ample known plaintext is available (say 100 consecutive 5-bit output). I do not know for certain if the initial plaintext is known (this is somewhat relevant, since the key setup is primitive).

I have not really tried any cryptanalysis. I have arguments that the GOC is weak, but not trivially weak. I think it would make at least an interesting test case for modern automated cryptanalysis tools, such as CryptoMiniSAT.

One serious issue is that I have no evidence that the GOC is no longer in use in some obscure application. Another is that I have not attempted to contact the authors.

I'm wondering if the following question would be on topic and ethical:

How would the stream cipher GOC be cryptanalyzed with modern techniques?

The GOC (Générateur d'Octets Chiffrants) is a stream cipher, designed circa 1982 in France, with the objective of being efficient on 8-bit microprocessors. It was widely deployed (and occasionally used) in France, notably in the Lecam, a Smart Card reader connected to (or embedded into) a Minitel (an ancestor of the web browser). The GOC was mostly used to encipher information displayed on a terminal (personal bank statement, stock prices available for a fee..), and key presses.

The GOC is described in exquisite detail in patent FR2519828A2, assigned to the French state (I'm aware of a single typo, which can be corrected with common sense or from the drawing). At least the first named inventor is a noted cryptographer (he's the G in GQ, a zero-knowledge protocol).

In summary, the GOC has a 64-bit key; a state of 109 bits (organized as 19 bytes); and produce 5 pseudo-random bits at each step, which involves a dozen elementary operations on bytes: XOR, addition, modified modular reduction mod 31 or 127 reducing to some subtractions. I have short portable C code that I wrote from specs, and a KAT, which (I believe) match deployed implementations. I could post that as part of the question, or elsewhere.

In its usage context, the GOC is typically keyed with the output of DES or similar algorithm implemented in a Smart Card, thus it is fair to disregard related-key attacks. Ample known plaintext is available (say 100 consecutive 5-bit output). I do not know for certain if the initial plaintext is known (this is somewhat relevant, since the key setup is primitive).

I have not really tried any cryptanalysis. I have arguments that the GOC is weak, but not trivially weak. I think it would make at least an interesting test case for modern automated cryptanalysis tools, such as CryptoMiniSAT.

One serious issue is that I have no evidence that the GOC is no longer in use in some obscure application. Another is that I have not attempted to contact the authors.

Update: 12 years later, I asked that question!