Design Principles for Combiners with Memory

Stream ciphers are widely used for online-encryption of arbitrarily long data, for example when transmitting speech-data between a mobile phone and a base station. An important class of stream ciphers are combiners with memory, with the E0 generator from the Bluetooth standard for wireless communication being their most prominent example. In this paper, we develop design principles for increasing the resistance of combiners with memory against the most dangerous types of cryptanalytic attacks, namely correlation attacks and algebraic attacks. In the case of algebraic attacks, we introduce the first method to guarantee lower bounds on the attack complexity. Starting from the design of the E0 generator, we combine our results in order to construct ciphers that are simultaneously strengthened against both kinds of attacks. Our analysis shows that small changes in the design of E0 already suffice to improve its security enormously.