Linear Approximations for 2-round Trivium

Trivium, designed by De Cannière and Preneel, is one of the focus ciphers of Phase II for the eSTREAM project. In this paper, we model the initialization part of Trivium as an 8-round function where each round consists of 144 Trivium clocks, and analyze the security margin in terms of number of rounds. This is an open question. Nevertheless, we give some partial answers. As one example, we apply Matsui’s linear cryptanalysis to 2-round Trivium and give a linear approximation with bias 2−31. In addition, we analyze the completeness property of the initialization function. We propose a new input to the initialization of Trivium that has better diffusion properties. However, the security margin of the new proposal is also an open question. We conjecture that an R-round Trivium is secure if each register bit is affected by all the key and IV bits in R round.