Preneel which requires 288 bytes. There is a still a debate whether these attacks constitute an academic break of Py. When the attackers claim that the above attacks can be built with workload less than the exhaustive search under the design specifications of Py and therefore, it is clearly a theoretical break of the cipher, the designers rule out the attacks because Py's security bounds limit any attacker to a total of 264 bytes of output across all keystreams everywhere. A recent revision of the Paul, Preneel, and Sekar paper includes a detailed discussion of this issue in section 9. There are no doubts about the legitimacy of the Wu and Preneel attack. Py was selected as Phase 2 Focus Candidate for Profile 1 (software) by the eSTREAM project but did not advance to Phase 3 due to the Wu and Preneel chosen IV attack. . In January 2007, three new ciphers namely TPy, TPypy and TPy6 have been proposed by the designers of Py to eliminate the above attacks. The TPy is still vulnerable against the above distinguishing attacks by Paul et al. (complexity 288) and Crowley (complexity 272), which do not depend on the key schedule. The best attack so far on the TPypy, which is conjectured to be the strongest of the Py-family of ciphers, is by Sekar et al. which is a distinguishing attack with data complexity 2281. This attack is only meaningful if the key-size of TPypy is longer than 281 bits. To remove attacks on TPy and TPypy, Sekar, Paul and Preneel at Indocrypt 2007 gave proposals for two new ciphers RCR-32 and RCR-64. So far there are no attacks against the RCR-32 and RCR-64. Round functions Py is based on the idea of "sliding arrays": arrays are indexed relative to a start pointer, which is advanced by one word each round. Where modulo indexing is available (hardware, and many digital signal processors), these can be implemented as circular buffers. In software, these are most easily implemented as large arrays. When the end of the array is reached, the working portions are copied back to the beginning and operations continue. The 256-byte P array contains a 256-entry permutation (each byte appears exactly once), while the Y array contains 260 32-bit words. #include <stdint.h> #define ROTL32(x, s) ((x)<<(s) | (x)>>(32-(s))) uint8_t *P; // P[0] through P[255] are active uint32_t *Y; // Y[-3] through Y[256] are