Mosquito

• 1. Introduction

  ›

  MOSQUITO is a stream cipher algorithm designed by two cryptographers, Joan Daemen and Paris Kitsos, and submitted to a project called eSTREAM, which ran under the umbrella of eCRYPT. The puzzle they were trying to solve sounds deceptively simple: how do you build a cipher that can recover automatically if something goes wrong mid-transmission? The answer they pursued was a class of cipher called a self-synchronizing stream cipher. And that pursuit would lead them into one of the hardest open problems in modern cryptography. Why did every dedicated attempt at building such a cipher keep falling apart under attack? That is the question MOSQUITO's story forces us to confront.

• 2. The Problem MOSQUITO Solved

  ›

  Daemen and Kitsos spelled out their reasoning in a document published in 2005. Self-synchronizing stream encryption, they wrote, can already be done by taking a block cipher and running it in a mode called CFB. But for single-bit self-synchronizing encryption, that approach is very inefficient. Their argument was that the field needed a dedicated design built specifically for hardware, not an adaptation of something built for a different purpose. The phrase they used was pointed: "we believe that it would be useful to design a dedicated self-synchronizing stream cipher that is efficient in hardware." The distinction between repurposing an existing tool and building the right tool for the job was central to why they submitted MOSQUITO to the eSTREAM evaluation process at all.

• 3. Inside the Cipher

  ›

  MOSQUITO's internal architecture rests on eight registers of varying lengths. The largest is the CCSR, which holds 128 bits. The next register holds 53 bits, followed by one holding 12 bits, and another holding 3 bits. Each clock cycle, the cipher calculates new bits for every register except the CCSR by drawing on combinations of bits from the previous register. The CCSR itself behaves differently: it operates as a shift register, with its elements shifting along, while a bit from the cipher's own output gets written back into position zero. That feedback loop is what gives MOSQUITO its self-synchronizing character. One design constraint followed directly from the hardware target: the combinational logic performing the calculations had to be kept relatively simple. If the logic grew too complex, pipeline operations could misfire because register bits would not finish processing before the next clock cycle began.

• 4. Broken in a Year

  ›

  Antoine Joux and Frederic Muller broke MOSQUITO in 2006, less than a year after Daemen and Kitsos published their design. Their method was a differential chosen ciphertext attack, a technique that exploits what happens to cipher output when an attacker can introduce calculated changes to the ciphertext. Joux and Muller were not just attacking MOSQUITO in isolation; they were attacking a whole family. In their conference paper they wrote: "All the dedicated Self-Synchronizing Stream Ciphers of the KNOT-MOSQUITO family are subject to differential chosen ciphertext attacks." They connected their findings to earlier breaks of HBB, KNOT, and SSS, drawing a bleak conclusion: it is, they wrote, "extremely difficult to design a SSSC resistant against chosen-ciphertext attacks." The family of ciphers, not just a single entry, had been undermined.

• 5. MOUSTIQUE and the Open Problem

  ›

  A tweaked successor named MOUSTIQUE was proposed after MOSQUITO fell. MOUSTIQUE advanced through the eSTREAM evaluation process all the way to Phase 3, and it did so as the only self-synchronizing cipher still standing at that stage. The eSTREAM project noted that reaching Phase 3 represented "a significant advance in the development of stream ciphers" for every algorithm that made it that far. MOUSTIQUE's position was remarkable: it was the lone representative of its kind at the top of the evaluation. Then Kasper and colleagues broke it as well. With MOUSTIQUE gone, the search for a secure and efficient self-synchronizing stream cipher remained, as the field concluded, an open research problem. MOSQUITO and its successor had not failed for want of ingenuity; they had revealed a structural difficulty that no one had yet found a way around.