Distinguishing attacks on ISAAC

This paper presents two strong distinguishers for the deterministic random bit generator ISAAC, requiring 2 and 2 samples of respectively 64 and 32 bits, based on the observation that more than 2 167 initial states among the 2 192 ones induce a strongly non-uniform distribution of the bits produced at the first round of the algorithm. A previous attack on ISAAC presented at Asiacrypt’06 by Paul and Preneel is demonstrated to be non relevant, since relies on an erroneous algorithm. The results of this paper stress the unsecurity of ISAAC, both as a pseudo-random generator and as a stream cipher. A modification of the algorithm is proposed to fix the weaknesses discovered. ISAAC [3] is a deterministic random bits generator presented at FSE’96 by Jenkins, who claims that it has “no bad initial states, not even the state of all zeros”. We contradict this affirmation, presenting more than 28 167 weak states, in Section 2, after a short description of ISAAC and the observation of some minor weaknesses, in Section 1. Recall that, as a source of non-uniform randomness, weak states might distort simulations, and harm cryptographic applications, and so generators with many such states should not be used. In Section 3, we exploit some weak states to construct two strong distinguishers, requiring respectively 248 64-bit samples and 264 32-bit samples. Sections 4 and 5 respectively propose a modification of ISAAC’s algorithm to avoid the design flaws presented, and point out an error in a previous analysis of ISAAC. Section 6 is our conclusion.