Phase-shift Fault Analysis of Grain v1

This paper deals with the phase-shift fault analysis of stream cipher Grain v1. We assume that the attacker is able to desynchronize the linear and nonlinear registers of the cipher during the keystream generation phase by either forcing one of the registers to clock one more time, while the other register is not clocked, or by preventing one of the registers from clocking, while the other register is clocked. Using this technique, we are able to obtain the full inner state of the cipher in reasonable time (under 12 hours on a single PC) by using 150 bits of unfaulted keystream, 600 bits of faulted keystreams and by correctly guessing 28 bits of the linear register.