Improved cube attack on round-reduced Trivium-LE(F) using a large number of superpolys

Trivium-LE(F), an energy-efficient variant of Trivium with broader applicability in resource-constrained devices, reduces energy consumption by 15% and reaches the maximum algebraic degree of 80 in fewer rounds compared than Trivium. The cube attack, an important cryptanalytic technique, is one of the most powerful cryptanalytic methods for stream ciphers. This paper presents an improved cube attack on round-reduced Trivium-LE(F) using small cubes and a large number of superpolys. In the offline phase, we choose small cubes with dimensions within available computational resources and apply the graph-based MILP modeling method with pruning techniques proposed by Delaune et al. to achieve efficient recovery of a large number of superpolys. In the online phase, we apply the testing method proposed by Zhang et al. to recover the key bits involved in the system of equations, by exploiting the sparsity and asymmetry of the superpoly equations. For the 743-round Trivium-LE(F), using 1074 superpolys derived from a 54-dimensional mother cube, we successfully recovered at least 50 bits of the secret key, reducing the secret key recovery attack complexity from the brute-force search level of 2⁸⁰ 2 80 to 2⁵⁴ 2 54 . Compared to previous works, our attack uses smaller cubes, making cube-sum computation feasible under current computational resources. In addition, we recover enough superpolys to extract a large number of key bits, significantly reducing the complexity of the brute-force search stage.