6
$\begingroup$

I'm wondering if the following question would be on topic and ethical:

How would the stream cipher GOC be cryptanalyzed with modern techniques?

The GOC (Générateur d'Octets Chiffrants) is a stream cipher, designed circa 1982 in France, with the objective of being efficient on 8-bit microprocessors. It was widely deployed (and occasionally used) in France, notably in the Lecam, a Smart Card reader connected to (or embedded into) a Minitel (an ancestor of the web browser). The GOC was mostly used to encipher information displayed on a terminal (personal bank statement, stock prices available for a fee..), and key presses.

The GOC is described in exquisite detail in patent FR2519828A2, assigned to the French state (I'm aware of a single typo, which can be corrected with common sense or from the drawing). At least the first named inventor is a noted cryptographer (he's the G in GQ, a zero-knowledge protocol).

In summary, the GOC has a 64-bit key; a state of 109 bits (organized as 19 bytes); and produce 5 pseudo-random bits at each step, which involves a dozen elementary operations on bytes: XOR, addition, modified modular reduction mod 31 or 127 reducing to some subtractions. I have short portable C code that I wrote from specs, and a KAT, which (I believe) match deployed implementations. I could post that as part of the question, or elsewhere.

In its usage context, the GOC is typically keyed with the output of DES or similar algorithm implemented in a Smart Card, thus it is fair to disregard related-key attacks. Ample known plaintext is available (say 100 consecutive 5-bit output). I do not know for certain if the initial plaintext is known (this is somewhat relevant, since the key setup is primitive).

I have not really tried any cryptanalysis. I have arguments that the GOC is weak, but not trivially weak. I think it would make at least an interesting test case for modern automated cryptanalysis tools, such as CryptoMiniSAT.

One serious issue is that I have no evidence that the GOC is no longer in use in some obscure application. Another is that I have not attempted to contact the authors.

Update: 12 years later, I asked that question!

$\endgroup$

1 Answer 1

Reset to default
6
$\begingroup$

The question seems on topic, and trying to break published ciphers is certainly ethical because that's what academic cryptographers do all day long. Publishing descriptions of cryptanalytic attacks is no problem (although one may prefer writing an article instead of an answer in crypto.SE, if the break is non-trivial). In my view, ethical issues might occur when one publishes an easy-to-use automated attack tool. Short words: math = good, C = bad.

$\endgroup$
3
  • $\begingroup$ I agree here. The only problem I might see that such a question might have a too large scope for this site. This would depend on the actual wording of the question. $\endgroup$
    – Paŭlo Ebermann Mod
    Commented Oct 21, 2011 at 22:08
  • $\begingroup$ Math vs C seems a rather artificial distinction since there's no shortage of blackhats able to create and distribute cracking tools if provided with the former. $\endgroup$
    – Dan Is Fiddling By Firelight
    Commented Feb 3, 2012 at 21:38
  • $\begingroup$ 12 years later, I asked that question! $\endgroup$
    – fgrieu Mod
    Commented Sep 4, 2023 at 20:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .