Related-key chosen IV attacks on Grain-v1 and Grain-128

The slide resynchronization attack on Grain was proposed in [6]. This attack finds related keys and initialization vectors of Grain that generate the 1-bit shifted keystream sequence. In this paper, we extend the attack proposed in [6] and propose related-key chosen IV attacks on Grain-v1 and Grain-128. The attack on Grain-v1 recovers the secret key with 2(22.59) chosen IVs, 2(26.29)-bit keystream sequences and 2(22.90) computational complexity. To recover the secret key of Grain-128, our attack requires 2(26.59) chosen IVs, 2(31.39)-bit keystream sequences and 2(27.01) computational complexity. These works are the first known key recovery attacks on Grain-v1 and Grain-128.