Rabbit (cipher)

Rabbit is a high-speed stream cipher first presented in February 2003 at the 10th Fast Software Encryption workshop and designed by Martin Boesgaard, Mette Vesterager, Thomas Pedersen, Jesper Christiansen and Ove Scavenius of Cryptico. It takes a 128-bit key and a 64-bit initialization vector, and its core is a bitstream generator that produces 128 bits of keystream per iteration. The design leans on arithmetic a modern processor already offers: a squaring-based g-function combined with exclusive-or, fixed bit rotations and addition modulo 2 to the 32, with no S-boxes or lookup tables, which keeps it fast and compact in software and in hardware. Rabbit was submitted to the eSTREAM project in May 2005 and is described in RFC 4503. Cryptico held pending patents and charged commercial licence fees for years, then made the algorithm free for any use on 6 October 2008 and released its source as public domain. The designers claim 128-bit security against an attacker after one key, which drops to about 96 bits against an attacker who targets many keys at once because of the small IV. A small output bias found by Jean-Philippe Aumasson in December 2006 gives a distinguisher that is far costlier than brute force and is not regarded as a threat.