Editing Stream cipher attacks (section)

==Chosen-IV attack==
{{Expand section|date=December 2017}}

Stream ciphers combine a secret key with an agreed initialization vector (IV) to produce a pseudo-random sequence which from time-to-time is re-synchronized.<ref>{{cite book |last1=Englund |first1=Hakan |last2=Johansson |first2=Thomas |last3=Sonmez Turan |first3=Meltem |title=Progress in Cryptology – INDOCRYPT 2007 |chapter=A Framework for Chosen IV Statistical Analysis of Stream Ciphers |series=Lecture Notes in Computer Science |date=2007 |volume=4859 |publisher=Springer |pages=268–281 |doi=10.1007/978-3-540-77026-8_20 |isbn=978-3-540-77025-1 |s2cid=18097959 |edition=INDOCRYPT / volume 4859 of LNCS |url=https://pdfs.semanticscholar.org/cdaf/30e07673a11eb95f62793858951da2feba32.pdf |archive-url=https://web.archive.org/web/20181001182527/https://pdfs.semanticscholar.org/cdaf/30e07673a11eb95f62793858951da2feba32.pdf |url-status=dead |archive-date=2018-10-01 |accessdate=1 October 2018}}</ref>  A "Chosen IV" attack relies on finding particular IV's which taken together probably will reveal information about the secret key.  Typically multiple pairs of IV are chosen and differences in generated key-streams are then analysed statistically for a linear [[Correlation attack|correlation]] and/or an algebraic Boolean relation (see also [[Differential cryptanalysis]]).  If choosing particular values of the initialization vector does expose a non-random pattern in the generated sequence, then this attack computes some bits and thus shortens the effective key length.  A symptom of the attack would be frequent re-synchronisation.  Modern stream ciphers include steps to adequately mix the secret key with an initialization vector, usually by performing many initial rounds.