In this paper, a new strategy, maximum last round, is proposed to select cubes for cube attacks. This strategy considers the cubes in a particular round where the probability of its superpoly to be 1 is at most, where is a very small number. A heuristic method to find a number of suitable cubes using this strategy and the previously used strategies (i.e., maximum initial zero, maximum last zero) are proposed. To get a bias at the higher rounds, the heuristic, too, imposes conditions on some state bits of the cipher to make the non-constant superpoly of a cube as zero for the first few rounds. Some cube testers are formed by using those suitable cubes to implement a distinguishing attack on Grain-128a of reduced KSA (or initialization) rounds. We present a distinguisher for Grain-128a of 191 (out of 256) KSA round in the single key setup and 201 (out of 256) KSA round in the weak key setup by using the cubes of dimension 5. The number of rounds is the highest till today, and the cube dimension is smaller than the previous results. Further, we tested our algorithm on Grain-128 and achieved good results by using small cubes.

In this study, the authors construct two different distinguishers on Grain‐v1 with 112 and 114 initialisation rounds. Their first distinguisher can distinguish Grain‐v1 with 112 initialisation rounds from a uniform random source for 99% of the randomly chosen keys from full key space. The second one can distinguish Grain‐v1 from a random source for 73% of the randomly chosen keys for one‐fourth of the total key space (2 78 keys out of 2 80 keys). Our results improve upon the earlier distinguishers. The technique used for the distinguishers is conditional differential cryptanalysis. The existing works in this direction considered only one bit difference in the initialisation vector. However, for the first time, they could handle complicated conditions for the 2‐bit difference to obtain better cryptanalytic results. Extending their technique by allowing the 1‐bit difference in the pair of keys (i.e. related keys) and the 4‐bit difference in IVs, they could observe the non‐randomness till 116 initialisation rounds with a success in 62% cases.