Breaking Grain-128 With Dynamic Cube Attacks
A well designed cipher is expected to resist all known cryptanalytic attacks, including distinguishing attacks and key recovery attacks. These two types of attacks are closely related since in many cases a distinguisher can be extended to a key recovery attack. Examples include many of the key-recovery attacks on iterated block ciphers such as differential cryptanalysis and linear crypt-analysis: First, the attacker constructs a distinguisher for a certain number of rounds of the iterated block cipher (usually one round less than the total number of rounds). Then, the attacker guesses part of the secret key and uses it to partially decrypt several ciphertexts in the final round.