Achterbahn-128/80: Design and Analysis

We determine the imbalances of the keystreams produced by Achterbahn-80 and Achterbahn-128 in two different ways. The number of cyclically inequivalent keystreams produced by the keystream generators of Achterbahn-80 and Achterbahn-128 is determined. An abstract model for the keystream generator of a primitive NLFSR combination generator is used to justify the correlation attack introduced in [6] and generalized in [8]. A common error in a guess and determine attack is discussed. The optimal decision rule for finding the correct initial state of the target shift register in the guess and determine attack is described in the coin tossing model. The reliability of results derived from the abstract keystream generator model and the coin tossing model is demonstrated by running an actual guess and determine attack on a cipher that could be called Baby-Achterbahn. Two attacks against Achterbahn-128/80 found by Naya-Plasencia [8] and Hell and Johansson [5] are shown to be equivalent.