Cryptanalysis of TWOPRIME

Ding et al [DNRS97] propose a stream generator based on several layers. We present several attacks. First, we observe that the non-surjectivity of a linear combination step allows us to recover half the key with minimal effort. Next, we show that the various bytes are insufficiently mixed by these layers, enabling an attack similar to those on two-loop Vigenere ciphers to recover the remainder of the key. Combining these techniques lets us recover the entire TWOPRIME key. We require the generator to produce 2 blocks (2 bytes), or 19 hours worth of output, of which we examine about one million blocks (2 bytes); the computational workload can be estimated at 2 operations. Another set of attacks trades off texts for time, reducing the amount of known plaintext needed to just eight blocks (64 bytes), while needing 2 time and 2 space. We also show how to break two variants of TWOPRIME presented in the original paper.