Welch--Gong (WG) is a hardware-oriented LFSR-based stream cipher. WG-7 is a version of the eStream submission Welch--Gong, used for RFID encryption and authentication purposes. It offers 80-bit cryptographic security. In modern days, almost all ciphers achieve the security by exploiting the nonlinear feedback structure. In this paper, we investigate the security of the nonlinear feedback-based initialization phase of the WG-7 stream cipher using the conventional bit-based division property of cube attack, by considering the cipher in a non-blackbox polynomial setting. In our work, we mount the cube attack using mixed-integer-linear-programming(MILP) models. The results of our attack enable us to recover the secret key of WG-7 after 20 rounds of initialization utilizing $2^{10}$ keystream bits in $2^{73}$ time. We show that our proposed attack takes significantly lower data complexity. To the best of our knowledge, our attack is the first one that investigates the security of the nonlinear feedback-based initialization phase of WG-7 cipher.

翻译：Welch-Gong（WG）是一种面向硬件的基于LFSR的流密码。WG-7是eStream候选算法Welch-Gong的一个版本，用于RFID加密和认证，提供80比特的密码学安全等级。现代密码体制大多通过利用非线性反馈结构来实现安全性。本文在非黑盒多项式设定下，采用基于比特的立方攻击传统划分性质，研究了WG-7流密码中基于非线性反馈的初始化阶段的安全性。我们的工作中，通过混合整数线性规划（MILP）模型实施了立方攻击。攻击结果表明，在20轮初始化后，我们能够利用$2^{10}$比特密钥流在$2^{73}$时间复杂度内恢复WG-7的密钥。我们提出的攻击显著降低了数据复杂度。据我们所知，本攻击是首个针对WG-7密码非线性反馈初始化阶段安全性的研究工作。