Defence Science Journal, Vol. 71, No. 4, July 2021, pp. 499-506, DOI : 10.14429/dsj.71.

16209
© 2021, DESIDOC

Deep Learning based Cryptanalysis of Stream Ciphers

Girish Mishra#,@, Indivar Gupta#, S.V.S.S.N.V.G. Krishna Murthy@, and S.K. Pal#
#
DRDO-Scientific Analysis Group, Delhi - 110 054, India
@
DRDO-Defence Institute of Advanced Technology, Pune - 411 025, India
*
E-mail: gmishratech28@[Link]

Abstract
Conventional cryptanalysis techniques necessitate an extensive analysis of non-linear functions defining the
relationship of plain data, key, and corresponding cipher data. These functions have very high degree terms and make
cryptanalysis work extremely difficult. The advent of deep learning algorithms along with the better and efficient
computing resources has brought new opportunities to analyze cipher data in its raw form. The basic principle of
designing a cipher is to introduce randomness into it, which means the absence of any patterns in cipher data. Due
to this fact, the analysis of cipher data in its raw form becomes essential. Deep learning algorithms are different from
conventional machine learning algorithms as the former directly work on raw data without any formal requirement
of feature selection or feature extraction steps. With these facts and the assumption of the suitability of employing
deep learning algorithms for cipher data, authors introduced a deep learning based method for finding biases in
stream ciphers in the black-box analysis model. The proposed method has the objective to predict the occurrence of
an output bit/byte at a specific location in the stream cipher generated keystream. The authors validate their method
on stream cipher RC4 and its improved variant RC4A and discuss the results in detail. Further, the authors apply
the method on two more stream ciphers namely Trivium and TRIAD. The proposed method can find bias in RC4
and shows the absence of this bias in its improved variant and other two ciphers. Focusing on RC4, the authors
present a comparative analysis with some existing methods in terms of approach and observations and showed that
their process is more straightforward and less complicated than the existing ones.
Keywords: Stream cipher; Cryptanalysis; RC4; Deep learning

1. Introduction layers of artificial neurons, which helps feature learning from

Deep Learning is a new field of machine learning the raw input dataset.
techniques where the learning methods are generally based There are many existing, well-established methods for
on the Artificial Neural Network framework. Deep learning, cryptanalysis. However, the foremost step in applying these
invariably known as deep neural networks, has a variety of methods is to observe an inherent flaw in the cipher algorithm
architectures such as Recurrent Neural Network (RNN), Deep and then exploit it to mount the cryptanalytic attack, which
Belief Network (DBN), and Convolution Neural Network is generally very complex. The advantage of deep learning
(CNN). These architectures are applied in diverse domains methods to have automatic feature engineering capabilities
to solve different problems like natural language processing, from raw data can help to observe the flaw, as mentioned
machine translation, medical image processing, computer above. Sometimes it may also assist in the cryptanalysis task.
vision, etc.1,2. These deep learning architectures have produced Moreover, the stream cipher generated keystream should
excellent results in respective domains, which have sometimes not have any biases. The adversaries can exploit the same in
outperformed human experts. Deep learning also has an mounting cryptanalytic attacks on the cipher to get complete or
extra edge over traditional machine learning algorithms due partial information about the key or the plain data. So, before
to its capability of representation learning. Representation employing any of the available cryptanalytic techniques, which
learning is a term used in machine learning to denote a class are very complicated in nature, it would be crucial to know
of techniques that automatically discover the representations such biases by using a deep learning approach that directly
required for feature detection from raw data. Establishing works over the raw data.
representation learning techniques is motivated by the fact that The application of machine learning in cryptography,
any machine learning task, such as classification or regression, especially of deep learning, has been explored in a very
generally require input that is computationally convenient and confined manner. Rivest, in his landmark survey paper4
meaningful to process. To summarise, deep learning is a class emphasised over the fact that how cryptography and machine
of machine learning algorithms3 that uses multiple hidden learning contributed ideas and techniques to each other.
He perceived machine learning and cryptanalysis as sister
Received : 21 August 2020, Revised : 26 November 2020 fields as both of them share the common goal of learning an
Accepted : 22 February 2021, Online published : 01 July 2021 unknown function from input-output pairs. Recently, Abadi

499
 Def. SCI. J., Vol. 71, No. 4, July 2021

and Andersen5, established a milestone work when exploring

whether, in a multi-agent system, neural networks can learn
to use secret keys to protect information from other neural
networks. Hesamifard et al.6 attended the problem of ensuring
the privacy of raw data and developed new techniques for
providing solutions to run deep neural networks over encrypted
data. Picek et al.7 analysed the convolutional neural network’s
performance for side-channel analysis while posing a problem
to researchers whether the deep learning networks are better
suited for side-channel analysis compared to other machine
learning techniques. In other work, Wang8 carried out a side-
channel analysis of block cipher AES using deep learning. In
latest developments, Gohr9 came up with improved attacks
on round-reduced lightweight block cipher Speck32/6410.
This work9 is perhaps the first such work that combined Figure 1. Black-box analysis model for proposed method.
neural networks with robust conventional cryptanalysis
techniques and demonstrated a neural network-based attack on 2. Preliminaries
a symmetric cryptographic primitive and improved upon the This section provides a brief description of deep learning
published state of the art. Gohr’s work was carried forward by fundamentals, which are necessary for understanding the
Baksi et al.11, Jain et al.12, and Yadav et al.13. All these works proposed method. It also contains a design description of RC4
clubbed conventional differential cryptanalysis with machine stream cipher.
learning and achieved better results. Recently, Xiao et al.14
quantified a cipher’s strength by measuring the difficulty for 2.1 Deep Learning Methods
a neural network in mimicking the cipher algorithm. They Deep learning is a class of machine learning algorithms3,15
defined several new metrics such as cipher match rate, training that successively uses multiple layers of artificial neurons to
data complexity, and training time complexity to assess the extract higher-level features from the raw input. For example,
cipher strength quantitatively. This work showed that a popular in image processing, initial lower layers identify edges,
stream cipher Hitag2, used in modern cars’ security, is weaker whereas higher layers identify more meaningful features
than the 3-round DES cipher. The literature survey indicates such as digits, letters, or faces. Figure 2 shows a general deep
that the crypto research community has started an extensive learning architecture containing an input and output layer with
exploration of deep learning applicability in cryptography in multiple intermediate hidden layers.
recent times. Due to the vanishing gradient problem in neural networks16
In this paper, authors proposed a deep learning based and computational limitations until a few years back, it was
method. The method is in line with the advantages of deep not possible (or computationally infeasible) to train multiple-
learning techniques as these techniques do not require feature layered neural networks. But, recent developments in the last
extraction or feature selection task, which otherwise can not decade, such as increased processing with GPU (Graphical
be escaped in any other mathematical, statistical, or analytical Processing Unit) and TPU (Tensor Processing Unit) from
procedures. It progressively learns the necessary features from Google and introduction of Rectified Linear Unit (ReLU)
raw data. The proposed method considers the problem in the as an activation function in place of the classical sigmoid
black-box scenario, as shown in Figure 1. Black-box as a device function, made it possible to stack multiple hidden layers in
can be interpreted in terms of its inputs and outputs without the network17. ReLU and Sigmoid activation functions are
any knowledge of its internal workings. In our experiments, 1
the prior assumption is to consider a stream cipher algorithm defined as f ( x) = max(0, x) and g ( x) = respectively.
1 + e− x
as a black box and deal with the problem as a classification
The input layer takes the raw input, and intermediate hidden
problem. The objective is to predict the value at a specific
location in the output from an available input.
Following are authors main contributions in this
paper:
• The findings from this paper show that the deep
learning based method is more straightforward and
advantageous compared to existing methods for the
analysis of stream ciphers.
• The validation of the proposed method through
extensive analysis of RC4 stream cipher and its
improved variant RC4A establishes the applicability
of deep learning methods in cipher data.
• The performance analysis indicates towards the
generalisation of the method to other stream ciphers. Figure 2. General Deep Learning Architecture.

500
 Mishra, et al.: Deep Learning based Cryptanalysis of Stream Ciphers

layers progressively process the input data further by using an biased at that specific byte position. The existence of this bias
activation function. After that, the output layer generally uses makes the stream cipher vulnerable to cryptanalytic attacks.
Softmax function for final classification. The Softmax function RC4 is a stream cipher that iteratively generates the
is given below: keystream in a byte-wise form. The generated keystream
was claimed to possess pseudo-random characteristics. The
e xi
F(Xi ) = k
where i = 0,1, 2,..., k exclusive-or (XOR) of keystream bits with the plaintext bits
∑e xi
is done for encryption. The decryption is performed on similar
i =0 lines by bit-wise XOR of ciphertext bits with the keystream bits.
Here k denotes the number of possible outputs. Stacking RC4 algorithm is composed of two phases: Key Scheduling
many intermediate layers between input and output layers Algorithm (KSA) and Pseudo Random Generation Algorithm
allows networks to learn an abstract representation of the (PRGA). The cipher description is given in Algorithm 1, and a
mapping from input data to the corresponding target output. simple layout of RC4 stream cipher is shown in Figure 3.
Some popular deep learning techniques are Convolution
Neural Networks (CNN), Recurrent Neural Networks (RNN), A lg orithm1( RC 4 Stream Cipher )
and Long Short Term Memory networks (LSTM)18. −−−−−−−−−−−−−−−−−−−
Key Scheduling Algorithm
2.2 Brief Description of Stream Ciphers
Symmetric key cryptography comprises of Block ciphers 1. procedure KSA( )
and Stream ciphers. In stream ciphers, the keystream of the 2. for i = 0 to N − 1 do
desired length is generated using an initial key (invariably 3. s[i ] ← i
known as a secret key). The generated keystream is then
4. end for
masked (generally, using exclusive-or) with the plaintext
bits to provide a ciphertext. In the early era of modern 5. j←0
cryptography, stream ciphers were widely used due to their 6. for i = 0 to N − 1 do
simplicity and speed than that of block ciphers. Stream ciphers 7. j ← j + s[i ] + key[i mod keylength]mod N
have been the preferred choice in applications where extremely
8. swap ( s[i ] and s[ j ])
high throughput is needed or only low complexity hardware
is available for usage. Keeping in mind the fundamental 9. end for
requirement in cryptography, the stream cipher design should Pseudo Random Generation Algorithm
ensure the desired cryptographic requirement of randomness 11. procedure PRGA()
in the output keystream. One of the criteria of fulfilling this is
12. while i ≥ 0 do
to ensure that the occurrence of any value in the range 0 to 255
at a byte position in stream cipher generated keystream should 13. i ← i +1
have equal probability. In other words, the occurrence of any 14. j ← j + s[i ]
value (in the given range) should have a probability 1/256. If 15. swap ( s[i ] and s[ j ])
the probability of the occurrence of any value at a byte position
16. output ( s[ s[i ] + s[ j ]])
differs from it significantly, the keystream is adjudged to be
17. end while
18. end procedure

In the algorithmic flow of RC4, '+ ' denotes the

addition mod ulo N operation. In KSA, N pairs of the
array s[ ] are swapped based on the values of the secret key
(key). At the end of KSA phase, an initial state is achieved
for PRGA. After that, the output keystream of the desired
length is generated in PRGA phase of the algorithm.
Paul and Praneel19 found a weakness in RC4 stream
cipher, and later on, to improve the security of the cipher,
they proposed a strengthened RC4 variant, which they named
RC4A. RC4A stream cipher uses two key components
instead of using only one to generate two state arrays s1
and s2 by following the Key Scheduling Algorithm (KSA)
of RC4. Other steps of RC4A pseudo-random generation
algorithm19 are similar, as performed in RC4.
As discussed earlier, we carry out the same experiment
over two more stream ciphers namely Trivium20 and
TRIAD21. Trivium was designed to explore how much
Figure 3. A Simple Layout of RC4.

501
 Def. SCI. J., Vol. 71, No. 4, July 2021

a stream cipher can be made simple while maintaining the mentioned N pairs respectively
desired level of security and also ensuring the speed and 6. Pass the dataset to deep learning network by considering
flexibility. Since then, Trivium has been a well-tested stream Initial Key K as input and 1st byte of corresponding KS as
cipher for its security analysis and till date no cryptanalytic target
attacks superior to brute-force are reported. So, we select this 7. Train the network using training dataset to create a deep
cipher to see if our method can learn and predict any bias in learning model
Trivium generated keystream. On the other hand, TRIAD-SC 8. Validate the model on the test dataset and collect the
is relatively a new stream cipher based on which a family of result which shows the prediction probability of the model for
lightweight symmetric-key schemes are proposed under NIST 1st byte of KS
Lightweight Cipher competition23. No significant cryptanalytic 9. Repeat the process mentioned in steps from 6 to 8 for
work has been reported on TRIAD-SC as on date, therefore we experimenting with 2nd, 3rd, 4th, . . . bytes of KS
experiment over this stream cipher to explore any possibility 10. ith byte of KS is biased If Prediction Probability (for
of finding the biases in the keystream generated by this cipher. i byte of KS ) is significantly more than 1/256 (0.0039), else
th

Trivium is a synchronous stream cipher designed specifically it is random

for hardware usage, although it performs reasonably good in
software implementation as well. Trivium was submitted to 4. Analysis of Stream Ciphers using
the eSTREAM competition22 by its designers20 and was later Proposed Methodology
selected for profile 2 of the eSTREAM project. Profile 2 was The experimental set-up, as explained in Section 3, is used
targeted for low area hardware ciphers. Trivium generates for cryptanalysis of RC4 by taking the following values:
keystream output of size up to 264 bits from a given key and IV, length of Initial Key ( n ) = 5
each of 80-bit size. We here avoid more details and the same #Samples/ Pairs ( N ) = 4,00,000
can be had at reference20. The experiment has been performed for predicting 1st, 2nd,
TRAID, a stream cipher based family, consists of an 3 , 4th, . . . bytes of RC4 keystream. As explained earlier, RC4
rd

authentication encryption mode (TRAID-AE) and a hash takes a variable-length Initial Key as input (length typically
function (TRIAD-HASH). TRIAD-AE is basically an being in the range between 5 and 256 bytes) and iteratively
encryption-then-mac construction, in which a stream cipher generates a pseudorandom Keystream in byte-wise form as
TRIAD-SC is meant for performing encryption module. TRIAD output. In our experimental setup, initially, we fixed the input
was submitted to the lightweight crypto standardisation process key size to 5 bytes and generated 4,00,000 input-output pairs.
of NIST23. TRIAD-SC takes 128-bit secret key and a 96-bit The size of State Vector/ Initial State, which gets initialised by
nonce as input along with one constant value (0xFFFFFFFE) the initial key and generates keystream by its regular updation,
and generates the keystream of desired length for encrypting is taken to be 256 for our experiments. It is re-emphasised
the plaintext. We are not providing any further details about the that the variable Initial Key is the input, and the jth byte of the
algorithm and the same can be found in21. Keystream denotes the target value in our experimental set-up.
In other words, for one training/test pair, the Initial Key is the
3. Proposed Methodology for input, and jth byte of correspondingly generated Keystream is
Cryptanalysis of Stream Cipher the target value.
In this section, we propose a method that is primarily based Initially, deep learning based prediction model was set-up
on deep learning. We adopt this method for the cryptanalysis of for predicting the first output byte of RC4 keystream. For each
stream ciphers with the target of finding biases in the generated sample in our supervised deep learning model, five bytes of
keystream. The detailed stepwise algorithm is as follows: initial key are taken as five neurons in input layer and first byte
of the keystream is taken as target in output layer. For example,
0. Let the initial parameters be represented as: if initial key is 0xEB9F72AE1C (in Hex format) and generated
a) Initial Key: K keystream is 0xBBF316E8D940AF0AD3 . . . (in Hex format),
b) Initial State: S then 0xEB, 0x9F, 0x72, 0xAE and 0x1C are five neurons in
c) Keystream: KS input layer and first byte 0xBB is the target in output layer. In
(Considering the black-box scenario, the updation of S total, 4,00,000 such input-output pairs were taken for creating
is not known to our method) the deep learning model. This data set was divided in 80%
(3,20,000 in numbers) training and 20% (80,000 in numbers)
1. Let K = k1k2 ...kn*8 ; where n denotes the length (in test instances for validation of the method. Seven dense layers,
bytes) of the Initial Key. each with 10 neurons and ReLU activation function, followed
2. With K as input, run stream cipher algorithm to by an output layer with 256 neurons with Softmax activation
generate the keystream KS function have been taken in creating the model. The model is
3. Iterate Step-1 and Step-2, N times for N different compiled with adam optimizer and categorical_crossentropy
values of K to generate " K − KS " pairs, i.e., “InitialKey − as loss function3. Loss denotes the error between actual target
Keystream” pairs and output value predicted by DL network. Adam optimizer,
4. Create a dataset consisting of these N pairs an extension to stochastic gradient descent, has found broader
5. Divide dataset into two parts, namely Training dataset adoption in recent times after increasing popularity of deep
and Test dataset having 80% and the remaining 20% of above- learning techniques in diversified domains. Categorical

502
 Mishra, et al.: Deep Learning based Cryptanalysis of Stream Ciphers

crossentropy is a loss function used in multi-classs classification The broad objective of the experiment is to create deep
tasks. Multi-class classification is related to the tasks where a learning model to predict the output bytes of RC4 keystream
given sample can belong only one of many possible categories. when the initial key is known to us. For validating the proposed
This actually quantifies the difference between two probability method, we construct ten different deep learning models, one
distributions. Ours is a supervised learning problem as the each for the first 10 bytes of the keystream. Table 1 shows the
model is first trained with the help of the samples for which results of our experiments. We used 4,00,000 samples (input-
the classes are known. The process of backpropagation is used output pairs) for constructing each deep learning model for the
for fine tuning the weights for minimizing the loss. Training is prediction of output bytes as the prediction rates were stable
done in five epochs and after five epochs results are collected with this sample size. For this amount of samples, average
for training and validation data. Similar prediction models were execution time of the code/model over GPU runtime in Google
also created for predicting each of the first ten output bytes of Colab was observed to be 16 seconds. We also carried out
RC4 keystream. The deep learning arrangement employed in the experiments with fewer samples and observed that the
our work is shown in Figure 4. model was continually providing reasonable prediction rates
The similar arrangement of experiment has been used even with 30,000 samples. But below this number, the results
for cryptanalysis of RC4A stream cipher except the following (prediction rates) were not consistent.
parameter: Theoretically, if a well-designed stream cipher generates
length of Initial Key ( n ) = 10 a random keystream, then it may safely be assumed that the
The length of initial key in case of RC4A is taken large occurrence of a specific value at any output byte position in
in comparison to that for RC4 as the initial key for the former
Table 1. Prediction Probability for different output byte
stream cipher is a combination of two key components. The positions in RC4 Keystream for input secret keys of
rest of experimental set-up and the amount of data are exactly size 5 bytes
same in both cases.
For experimenting with two other stream ciphers, Trivium Byte Position Training Accuracy Testing Accuracy
and TRAID-SC, we generated 217 keystream samples for in RC4 (Prediction Probability (Prediction Probability
different respective inputs for each cipher. The objective was Keystream for Training Data) for Test Data)
to compute the prediction accuracy for each of the first 256 1 0.0040 0.0040
bits of the keystream. We also performed the experiments for
2 0.0079 0.0073
predicting the first 32 bytes of the keystream.
3 0.0040 0.0040
5. Experimental Results and 4 0.0041 0.0040
Comparative Analysis 5 0.0040 0.0039
The implementation of the code for the proposed method
has been done on Google Colab24. Colaboratory (Colab in 6 0.0040 0.0042
short) is a free cloud service provided by Google in Jupyter 7 0.0040 0.0039
notebook environment where availability of GPUs and TPUs 8 0.0039 0.0042
may be used for the development of codes for problem-solving.
9 0.0040 0.0040
It allows developing deep learning algorithms using popular
libraries such as PyTorch, TensorFlow, and Keras25. 10 0.0040 0.0040

Figure 4. Deep Learning arrangement used in the experiment.

503
 Def. SCI. J., Vol. 71, No. 4, July 2021

the keystream could not be predicted with better than chance (i.e. RC4A). In case of stream ciphers Trivium and TRIAD,
probability (chance probability means the occurrence of the achieved accuracy was almost equal to chance probability.
each possible output should be equiprobable, like chances of As nothing significant was observed for two ciphers, we omit
occurrence of either head or tail in tossing a coin should be showing the results here.
with equal probability i.e., 0.5). Mantin and Shamir26 performed a comprehensive
Similarly, in our case, had RC4 stream cipher generated statistical analysis of RC4 keystream. Their result shows that
a random keystream, no method would have predicted the the probability of the second output keystream byte of RC4
occurrence of a specific value at any output byte position being zero is approximately double than expected if the initial
of keystream with significantly better than 1/256 = 0.0039 permutation is randomly chosen. Paul and Praneel19, after
probability (as a byte may take any value from 0 to 255). Our doing rigorous analysis, presented a new statistical bias in the
experimentation results show that the deep learning model has distribution of the first two output bytes of RC4 keystream
been able to predict the second output byte with a significantly generator. Pudovkina27 analytically attempted to detect a bias
good probability (i.e., 1/128 = 0.0073). In contrast, it could in the distribution of first and second output values of RC4
not learn to predict the occurrence of other output bytes with keystream considering certain uniformity assumptions. The
better than chance probability. For other output bytes of methods used by these researchers and us along with respective
RC4 keystream, the prediction probability is approximately observations are shown in Table 4. Several other researchers
1/256=0.0039. In other words, our model could learn the through statistical and mathematical means and experiments
process of mapping the input initial key to the second byte of tried to find biases in RC4 and other stream ciphers by making
the keystream with a biased probability. This finding exposes
Table 3. Prediction Probability for different output byte
the presence of bias at second byte position in RC4 keystream,
positions in RC4A Keystream for input secret keys
which can enable the adversaries in mounting a practical
of size 5 bytes
ciphertext-only attack in some applications. We carried out
similar experiments for four other different input initial key Byte Position Training Accuracy Testing Accuracy
sizes of 8, 16, 24, and 32 bytes. In all the experiments, we in RC4A (Prediction Probability (Prediction Probability
obtained similar findings that that the model could learn the Keystream for Training Data) for Test Data)
biased behavior at 2nd output byte of RC4 keystream with the 1 0.0040 0.0042
probability around 1/128. For other output bytes, the prediction 2 0.0044 0.0037
probability was approximately 1/256, which is the desired 3 0.0041 0.0046
randomness for output byte of RC4 keystream. The overall 4 0.0042 0.0040
results for our experiment with RC4 stream cipher are shown
5 0.0048 0.0033
in Table 2.
6 0.0049 0.0046
The experiments on similar lines were also carried out for
RC4A stream cipher. The experimental results for the same are 7 0.0041 0.0036
presented in Table 3. The results clearly validate the designers 8 0.0044 0.0044
claim that they have successfully eliminated the bias at second 9 0.0039 0.0037
output byte in their improved variant of RC4 stream cipher 10 0.0044 0.0041

Table 2. Prediction Probability for outputs bytes in RC4 Keystream for different input key sizes

Key Size Prediction Probability for Different Output Bytes of RC4 Keystream
in Bytes 1st Byte 2nd Byte 3rd Byte 4th Byte 5th Byte 6th Byte 7th Byte 8th Byte 9th Byte 10th Byte
5 0.0040 0.0079 0.0040 0.0041 0.0040 0.0040 0.0040 0.0039 0.0040 0.0040
8 0.0039 0.0079 0.0041 0.0037 0.0046 0.0038 0.0041 0.0035 0.0038 0.0042
16 0.0040 0.0077 0.0039 0.0042 0.0033 0.0042 0.0042 0.0038 0.0036 0.0042
24 0.0041 0.0075 0.0042 0.0041 0.0040 0.0042 0.0036 0.0044 0.0035 0.0041
32 0.0043 0.0075 0.0038 0.0038 0.0038 0.0038 0.0037 0.0039 0.0038 0.0036

Table 4. Comparative Analysis of different methods for finding weakness of RC4 in terms of approach and observations
Type Observation Source
The probability of second output word of RC4 being 0 is approximately double than the expected
Statistical analysis Ref.26
probability. Other output words have uniform distribution
The first two output words of RC4 are equal with probability that is significantly less than the
Statistical analysis Ref.19
expected probability
Exhaustive probabilistic model The distribution of first, second output values of RC4 and digraphs are not uniform Ref.27
The prediction probability of second output word of RC4 is almost double than the expected This
Deep learning method
probability. Other output words have prediction probability as expected in uniform distribution work

504
 Mishra, et al.: Deep Learning based Cryptanalysis of Stream Ciphers

certain assumptions. Thus, the most of the findings have been doi: 10.1007/3-540-57332-1_36
based on manual calculation of the probability distribution in 5. Abadi, M. & Andersen, D.G. Learning to protect
keystream data, which required much in-depth analysis of the communications with adversarial neural cryptography.
cipher structure. On the other side, our proposed method does arXiv preprint arXiv:1610.06918, 2016, [Link]
not require prior assumptions and any complex mathematical abs/1610.06918 [Accessed on 31 July 2020].
or statistical analysis for finding the bias. It simply needs input- 6. Hesamifard, E.; Takabi, H. & Ghasemi, M. Cryptodl:
output pairs of the stream cipher algorithm and passes them Deep neural networks over encrypted data. arXiv preprint
to the deep learning framework. Therefore, it can evidently arXiv:1711.05189, 2017, [Link]
be concluded that the proposed deep learning based method [Accessed on 12 July 2020].
provides a straightforward approach for cryptanalysis of stream doi: 10.1145/3292006.3300044
ciphers in terms of finding the biases. 7. Picek, S.; Samiotis, I.P.; Kim, J.; Heuser, A.; Bhasin, S.
& Legay, A. On the performance of convolutional neural
6. Conclusion networks for side-channel analysis. In Proceedings of
The foremost application of the proposed work is to the International Conference on Security, Privacy, and
perceive distinguishability in different stream ciphers, which Applied Cryptography Engineering, Springer, Cham,
simply ensures mounting of distinguishing attack on stream 2018, pp. 157-176.
ciphers. In other words, the distinguishing attack means if 8. Wang, H. Side-channel analysis of aes based on deep
certain number of black boxes generate the pseudo-random learning. [Link]
keystreams from a known input key, then the black box behaving diva2:1325691/[Link], 2019 [Accessed on
as a specific stream cipher can be identified amongst all. Thus, 07 Aug 2020].
a deep learning based method has successfully been applied in 9. Gohr, A. Improving attacks on round-reduced speck32/64
finding the bias and further exploration of distinguishability in using deep learning. In Proceedings of Annual International
stream ciphers. The proposed method has been validated on Cryptology Conference, Springer, 2019, pp. 150–179.
RC4 stream cipher to ascertain its simplicity in comparison doi: 10.1007/978-3-030-26951-7_6
to earlier sophisticated mathematical and statistical methods. 10. Beaulieu, R.; Shors, D.; Smith, J.; Treatman-Clark,
The observations and analysis throughout the paper clearly S.; Weeks, B. & Wingers, L. The SIMON and SPECK
indicate that the emergence of new deep learning techniques Families of Lightweight Block Ciphers. IACR Cryptol.
will always go hand in hand with cryptographic analysis. ePrint Arch., 2013, p.404, [Link]
The prediction accuracy can be impacted by many factors, pdf [Accessed on 07 Aug 2020].
including the network design, the training data volume, and 11. Baksi, A.; Breier, J.; Dong, X. & Yi, C. Machine learning
the training time. We also carried out the experiments over assisted differential distinguishers for lightweight
three other stream ciphers RC4A, Trivium and TRIAD, but did ciphers. IACR Cryptol. ePrint Arch., 2020, p.571, https://
not observe anything significant. In future, more experiments [Link]/2020/[Link] [Accessed on 14 Oct 2020].
will be performed to gain better insights into the experimental 12. Jain, A.; Kohli, V. & Mishra, G. Deep learning based
setting. The aim will also be to analyze several other stream differential distinguisher for lightweight cipher PRESENT.
ciphers and explore better representation of cryptographic Cryptology ePrint Archive, Report 2020/846. https://
data which may become more relevant to deep learning [Link]/2020/846. [Accessed on 14 Oct 2020].
framework. 13. Yadav, T. & Kumar, M. Differential-ML distinguisher:
machine learning based generic extension for differential
References cryptanalysis, [Link]
1. Bahdanau, D.; Cho, K. & Bengio, Y. Neural machine [Accessed on 14 Oct 2020].
translation by jointly learning to align and translate. 14. Xiao, Y.; Hao, Q. & Yao, D. D. Neural cryptanalysis:
arXiv preprint arXiv:1409.0473, 2014, [Link] metrics, methodology, and applications in cps ciphers. In
abs/1409.0473 [Accessed on 01 Aug 2020]. Proceedings of the Conference on Dependable and Secure
2. Chen, C.; Seff, A.; Kornhauser, A. & Xiao, J. Deepdriving: Computing (DSC), IEEE, 2019, pp. 1-8.
Learning affordance for direct perception in autonomous doi: 10.1109/dsc47296.2019.8937659
driving. In Proceedings of the International Conference 15. Maghrebi, H.; Portigliatti, T. & Prouff, E. Breaking
on Computer Vision, IEEE, 2015, pp. 2722-2730. cryptographic implementations using deep learning
doi: 10.1109/iccv.2015.312 techniques. In Proceedings of the International Conference
3. Deng, L. & Yu, D. Deep learning: methods and on Security, Privacy, and Applied Cryptography
applications. Foundations and trends in signal processing, Engineering, Springer, Cham, 2016, pp. 3-26.
Now Publishers Inc. Hanover, MA, USA, 2014, 7(3–4), doi: 10.1007/978-3-319-49445-6_1
pp. 197-387. 16. Hochreiter, S. The vanishing gradient problem during
doi: 10.1561/9781601988157 learning recurrent neural nets and problem solutions. J. of
4. Rivest, R.L. Cryptography and machine learning. In Uncertain. Fuzziness Knowl.-based Systems, 6(02), 1998,
Proceedings of the International Conference on the pp. 107–116.
Theory and Application of Cryptology, Springer, Berlin, doi: 10.1142/s0218488598000094
Heidelberg, 1991, pp. 427-439. 17. Jarrett, K.; Kavukcuoglu, K.; Ranzato, M.A. & LeCun, Y.,

505
 Def. SCI. J., Vol. 71, No. 4, July 2021

September. What is the best multi-stage architecture for Contributors

object recognition?. In Proceedings of the international
conference on computer vision, IEEE. 2009, pp. 2146- Mr Girish Mishra completed his [Link]. and [Link]. in Mathematics
2153. from University of Rajasthan Jaipur, India. He has been
working as a Scientist in Scientific Analysis Group, Defence
doi: 10.1109/iccv.2009.5459469
R&D Organisation since 2003. He has worked and contributed
18. Brownlee, J. Long Short-term Memory Networks with in various areas related to cryptography, information security
Python: Develop Sequence Prediction Models with Deep and machine learning. He has published more than 15 research
Learning. Machine Learning Mastery, 2017. papers in various international journals and conferences. He
19. Paul, S. & Preneel, B. A New Weakness in the RC4 received DRDO Young Scientist award in 2010 and Lab Scientist
Keystream Generator and an Approach to Improve the award in 2007. His current areas of interest include machine
Security of the Cipher. In Proceedings of the International learning, blockchain technology and cryptography.
Workshop on Fast Software Encryption, 2004, February, In the current study, he contributed in development, execution,
pp. 245-259. Springer, Berlin, Heidelberg. and analysis of the concept and the algorithm.
doi: 10.1007/978-3-540-25937-4_16
Dr Indivar Gupta completed his PhD from IIT Delhi, India.
20. De Canniere, C. & Preneel, B. Trivium. In New stream He has been working as a Senior Scientist in Scientific Analysis
cipher designs. 2008, pp. 244-266. Springer, Berlin, Group, DRDO since 2000 and has research contributions in
Heidelberg. various areas related to cryptography and information security.
21. Isobe, S.T., Meier, W. and Zhang, B., TRIAD v1., He has published more than 20 research papers in various
[Link] international journals and conferences. Presently, his areas
Cryptography/documents/round-1/spec-doc/TRIAD- of research include computational algebra, number theory,
[Link], accessed on 01 Feb 2021. cryptography, information security, and high-performance
22. Robshaw, M. The eSTREAM project. In New Stream computing.
In the current study he made a contribution in the development
Cipher Designs. 2008. pp. 1-6. Springer, Berlin,
of concept and technique.
Heidelberg.
23. McKay, K., Bassham, L., Sönmez Turan, M. ^ Mouha, N. Dr S.V.S.S.N.V.G. Krishna Murthy obtained his Post-graduation
Report on lightweight cryptography (No. NIST Internal from Osmania University, Hyderabad and Doctoral degree
or Interagency Report (NISTIR) 8114 (Draft)). 2016, from Indian Institute of Technology Kanpur, Kanpur. He has
National Institute of Standards and Technology. 21 years of experience in teaching. He is currently Associate
24. Bonner, A. Getting started with google colab. https:// Professor & Head, Department of Applied Mathematics, Defence
[Link], 2019 [Accessed on 07 Aug Institute of Advanced Technology, Deemed University, Pune.
2020]. His research interests include Mathematical Modelling, Finite
Element Analysis in fluid flow through Porous Media, Numerical
25. Erickson, B.J.; Korfiatis, P.; Akkus, Z.; Kline, T. &
Method’s for Partial differential equations, Numerical parallel
Philbrick, K. Toolkits and libraries for deep learning. J. of Algorithms, Computational Fluid Dynamics. He was a recipient
Digital Imaging, 2017, 30(4), pp. 400-405. of Erasmus Mundus – WILL Power (Window India Learning
doi: 10.1007/s10278-017-9965-6 Link Power) Fellowship `2010-11’. He has authored more than
26. Mantin, I. & Shamir, A. A practical attack on broadcast 30 publications in reputed journals other than conferences.
RC4. In International workshop on fast software In the current study, he did the development of the concept
encryption, 2001, April, pp. 152-164. Springer, Berlin, and technique.
Heidelberg.
doi: 10.1007/3-540-45473-x_13 Dr Saibal Kumar Pal is working as a Senior Scientist and
Divisional Head at Defence Research & Development Organisation,
27. Pudovkina, M. Statistical weaknesses in the alleged RC4
Scientific Analysis Group, Delhi. He has also worked as the
keystream generator. IACR Cryptol. ePrint Arch., 2002, Chief Information Security Officer (CISO) of DRDO during
p.171, [Link] [Accessed on the period 2017 – 2019. Dr. Pal completed his PhD from
07 July 2020]. University of Delhi in the area of Information Security. He
doi: 10.1007/3-540-44706-7_2 has co-authored 3 books on Electronic Governance, AI & Data
Science & has more than 250 research publications in peer-
reviewed journals & international conference proceedings. His
areas of interest are Cryptography, Cyber Security, Computational
Intelligence and Information Systems. Dr. Pal is a recipient
of Lab Scientist Award in 2010 and DRDO Scientist of the
Year Award in 2012.
In the current study, he contributed in the development of the
concept and technique.

506