Luís Soares Barbosa

Michael Goedicke

Erich J Neuhold

Ricardo Reis

Steven Furnell

Eunika Mercier-Laurent

Marco Winckler

Ilias Maglogiannis

John Macintyre

Lazaros Iliadis

Jose C Principe

How Can Artificial Intelligence Efficiently Support Sustainable Development?

IFIP was founded in 1960 under the auspices of UNESCO, following the first World Computer Congress held in Paris the previous year. A federation for societies working in information processing, IFIP's aim is two-fold: to support information processing in the countries of its members and to encourage technology transfer to developing nations. As its mission statement clearly states:

IFIP is the global non-profit federation of societies of ICT professionals that aims at achieving a worldwide professional and socially responsible development and application of information and communication technologies.

IFIP is a non-profit-making organization, run almost solely by 2500 volunteers. It operates through a number of technical committees and working groups, which organize events and publications. IFIP's events range from large international open conferences to working conferences and local seminars.

The flagship event is the IFIP World Computer Congress, at which both invited and contributed papers are presented. Contributed papers are rigorously refereed and the rejection rate is high.

As with the Congress, participation in the open conferences is open to all and papers may be invited or submitted. Again, submitted papers are stringently refereed.

The working conferences are structured differently. They are usually run by a working group and attendance is generally smaller and occasionally by invitation only. Their purpose is to create an atmosphere conducive to innovation and development. Refereeing is also rigorous and papers are subjected to extensive group discussion.

Ilias Maglogiannis

Preface Artificial Intelligence (AI) continues to advance, following extreme development rhythms in the new era of the 21st century. It has already made its way into our daily lives in various forms. It is estimated that more than 80 billion USD have been invested by car industries for the design and development of autonomous self-driving vehicles. AI technologies like Google Duplex are accomplishing real-world conversations and arrangements with humans, using Deep Neural Networks (e.g., Google voice search, Wavenet). It is estimated by the International Data Corporation, a global provider of market intelligence, that investments in AI business globally will reach up to 110 billion USD by 2024.

AI is a major part of the Fourth Industrial Revolution, together with other technologies like the Internet of Things, Genetic Engineering, Quantum Computing, and its impact in the evolution of our post-modern societies in various domains is huge and growing. On the other hand, there are major areas of ethical concern for our societies, namely privacy, surveillance, bias-discrimination, and elimination of entire job categories. Moreover, serious questions arise on the superiority and indispensability of human judgment on important aspect of life. In other words, "Can smart machines outthink our human judgment?".

The 17th International Conference on Artificial Intelligence Applications and Innovations (AIAI 2021) offered insight into all timely challenges related to technical, legal, and ethical aspects of intelligent systems and their applications. New algorithms and potential prototypes employed in diverse domains were introduced.

AIAI is a mature international scientific conference series that has been held all over the world and it is well established in the scientific area of AI. Its history is long and very successful, following and propagating the evolution of intelligent systems.

The first event was organized in Toulouse, France, in 2004. Since then, it has had a continuous and dynamic presence as a major global, but mainly European, scientific event. It has been organized in China, Greece, Cyprus, Australia, and France. It has always been technically supported by the International Federation for Information Processing (IFIP) and more specifically by Working Group 12.5, which is interested in AI applications.

Following a long-standing tradition, this Springer volume belongs to the IFIP AICT series and it contains the papers that were accepted to be presented orally at the AIAI 2021 conference. An additional volume comprises the papers that were accepted and presented at the workshops and were held as parallel events. The event was held during June 25-27, 2021, in Greece (virtually). The diverse nature of papers presented demonstrates the vitality of AI algorithms and approaches. It certainly proves the very wide range of AI applications as well.

The response of the international scientific community to the AIAI 2021 call for papers was more than satisfactory, with 113 papers initially submitted by authors in 21 different countries from all over the globe, namely Australia, Austria, Belgium, Czech Republic, Egypt, France, Germany, Greece, Lebanon, Netherlands, India, Italy, China, Poland, Portugal, Romania, Sweden, Taiwan, Turkey, UK, and USA.

All papers were peer reviewed by at least two independent academic referees. Where needed, a third referee was consulted to resolve any potential conflicts. A total of 54 papers (47.79% of the submitted manuscripts) were accepted to be published as full papers (12 pages long) in the proceedings. Owing to the high quality of the submissions, the Program Committee decided that it should accept 7 more papers to be published as short papers (10 pages long).

The accepted papers cover the following thematic topics:

Swarm Intelligence Text Mining and Machine Translation Time Series Emotion recognition

Eight keynote speakers were invited to give lectures on timely aspects of AI. We wish to thank all keynote speakers for enlightening our conference with their state-of-the-art lectures.

In addition to the main conference, the following eight scientific workshops on timely AI subjects were organized under the framework of AIAI 2021:

• The 6th Workshop on 5G-Putting Intelligence to the Network Edge (5G-PINE 2021) Abstract. Computer vision is an area of artificial intelligence aimed at developing technical systems capable of perceiving the environment through image and video processing and analysis. In this talk, we mainly focus on human-centered computer vision, that is, computer vision for capturing aspects of human presence such as the geometry and motion of the human body, as well as for recognizing human actions, behavior, intentions and emotional states. Such technologies may constitute a fundamental building block for the development of a variety of applications in almost all aspects of human life (health, security, work, education, transportation, entertainment, etc.). In this special area, we give specific examples of our research activity and highlight the significant boost achieved due to the exploitation of state-of-the-art machine learning techniques and deep neural networks. We also give examples of applications developed based on these technologies in the field of robotics and ambient intelligence environments.

Unveiling Recurrent Neural Networks -What Do They Actually Learn and How?

Peter Tino

School of Computer Science, University of Birmingham, UK Abstract. When learning from "dynamic" data where the order in which the data is presented does matter, the key issue is how such temporal structures get represented within the learning machine. In the case of artificial neural networks, an often-adopted strategy is to introduce feedback-connections with time delays. This enables the neurons to form their activation patterns based on the past, as well as the current neural activations. Neural networks of this kind became known as Recurrent Neural Networks (RNN). Many diverse architectures fall under this umbrella, with a wide variety of application domains. We will briefly review past attempts to understand the way RNNs learn to represent the past in order to perform the tasks they are trained on.

To that end, we will adopt the general view of RNNs as parameterized state space models and input driven non-autonomous dynamical systems. We will then present some new results connecting RNNs to a widely known class of models in machine learning -kernel machines. In particular, we will show that RNNs can be viewed as "temporal feature spaces". This framework will enable us to understand how high-dimensional RNNs constructed with very few degrees of freedom in their parameterization can still achieve competitive performances. Such observations can be viewed as "dynamical analogs" to classical "static" kernel machines that often achieve excellent performance using rich feature spaces constructed with very few degrees of freedom (e.g. single scale parameter in Gaussian kernels).

Deep Learning and Kernel Machines

Johan Suykens KU Leuven, ESAT-Stadius and Leuven AI Institute, Belgium Abstract. Over the last decades, with neural networks and deep learning, several powerful architectures have been proposed, including e.g., convolutional neural networks (CNN), stacked autoencoders, deep Boltzmann machines (DBM), deep generative models and generative adversarial networks (GAN). On the other hand, with support vector machines (SVM) and kernel machines, solid foundations in learning theory and optimization have been achieved. Within this talk, we outline a unifying picture and show several new synergies, for which model representations and duality principles play an important role. A recent example is restricted kernel machines (RKM), which connects least squares support vector machines (LS-SVM) to restricted Boltzmann machines (RBM). New developments on this will be shown for deep learning, generative models, multi-view and tensor-based models, latent space exploration, robustness and explainability. Abstract. The talk argues and demonstrates that brain-inspired spiking neural network (SNN) architectures can be used for incremental and transfer learning, i.e. to learn new data and new classes/tasks/categories incrementally utilising some previously learned knowledge. Similarly to how the brain manifests transfer learning, these SNN models do not need to be restricted in number of layers, neurons in each layer, etc. as they adopt self-organising learning principles. The new learned knowledge can be extracted in forms of graphs and symbolic fuzzy rules and its evolution traced over time. The presented approach is illustrated on an exemplar brain-inspired SNN architecture NeuCube (free software and open source available from www.kedri.aut.ac.nz/neucube and from www.neucube.io). The extraction of symbolic rules from NeuCube at each learning tasks and each subject allows for knowledge transfer between humans and machines in an adaptive, evolving, interactive way. This opens the field to build new types of open and transparent BCI and AI systems.

Brain-Inspired

More details can be found in: N.Kasabov, Time-Space, Spiking Neural Networks and Brain-Inspired Artificial Intelligence, Springer, 2019, https:// www.springer.com/gp/book/9783662577134.

Abstracts of Tutorials

Modern Methods and Tools for Human Biosignal Analysis

Vangelis Metsis

Texas State University, USA

Abstract. The term biosignal refers to any signal that can be measured from living organisms. Biosignals have been used in medicine, sports science, and psychology for diagnoses, and there have been impressive advancements in these areas. Recently, the fields of human-computer interaction and affective computing have found an interest in using biosignals as a means of understanding the human state and intention. This interest has been reinforced by the fact that acquiring information with sensors and interfacing electrically with the human body has become much easier in the past few years. Moving from large analog technologies to digital ones has led to the miniaturization of sensing devices. Wireless transmission technologies (e.g., Bluetooth low energy), which can be easily integrated with the acquisition hardware, have removed the need for bulky wiring. This tutorial will present an overview of modern applications of human biosignals and will provide practical examples of machine learning-based methods and tools for biosignal analysis. Traditional machine learning algorithms for feature extraction and classification will be compared with recent developments in deep learning and its applications to biosignal and time-series data processing in general.

Anomaly Detection in Images

Giacomo Boracchi

Politecnico di Milano, Italy

Anomaly detection problems are ubiquitous in engineering: the prompt detection of anomalies is often a primary concern, since these might provide precious information for understanding the dynamics of a monitored process and for activating suitable countermeasures. In fact, anomalies are typically the most informative regions in an image (e.g., defects in images used for quality control). Not surprisingly, anomaly detection problems have been widely investigated in the image processing and pattern recognition communities and are key in application scenarios ranging from quality inspection to health monitoring. The tutorial presents a rigorous formulation of the anomaly-detection problem that fits with many imaging scenarios and applications. The tutorial describes, by means of illustrative examples, the most important anomaly-detection approaches in the literature, and their connection with the machine-learning perspective of semi-supervised and unsupervised learning/monitoring. Special emphasis will be given to anomaly-detection methods based on learned models, which are often adopted to handle images and signals. In particular, these will be divided into traditional models (including dictionaries yielding sparse representations) and deep learning models. The tutorial is accompanied by various examples from our research projects where we applied anomaly-detection algorithms to solve real world problems: visual quality inspection for monitoring chip and nanofiber production.

  • John Macintyre • Lazaros Iliadis (Eds.)

	Artificial Intelligence
	Applications
	and Innovations
	17th IFIP WG 12.5 International Conference, AIAI 2021
	Hersonissos, Crete, Greece, June 25-27, 2021
	Proceedings

  • The 1st Workshop on Artificial Intelligence in Biomedical Engineering and Informatics (AI-BIO 2021) • The 1st Workshop on Defense Applications of AI (DAAI 2021) • The 1st Workshop on Distributed AI for REsource-Constrained Platforms (DARE 2021) • The 1st Workshop on Energy Efficiency and Artificial Intelligence (EEAI 2021) • The 10th Mining Humanistic Data Workshop (MHDW 2021) • The 1st Workshop on AI and Ethics (AIETH 2021) • Designing a Novel Adaptive Cybersecurity Solution for Internet-of-Vehicle Workshop (nIoVe)We are grateful to everyone who made AIAI 2021 such a success, and we hope that we can meet again in person at the next event.Abstract. Machine learning (ML) is a key and increasingly pervasive technology in the 21st century. It is going to impact the way people live and work in a significant way. In general, machine learning algorithms simulate the way brain learns and solves an estimation/recognition problem. They usually require a learning phase to discover the patterns among the available data, similar to the humans. An expanded definition of ML is advanced as algorithms that can learn from examples and data and solve seemingly interactable learning and unteachable problems, referred to as ingenious artificial intelligence (AI). Recent and innovative applications of ML in various fields and projects currently being pursued by leading high-tech and industrial companies such as Boeing, Google, IBM, Uber, Baidu, Facebook, and Tesla are reviewed. Then, machine learning algorithms developed by the author and his associates are briefly described.Finally, examples are presented in different areas from health monitoring of smart highrise building structures to automated EEG-based diagnosis of various neurological and psychiatric disorders such as epilepsy, the Alzheimer's disease, Parkinson's disease, and autism spectrum disorder.

	Machine Learning: A Key Ubiquitous Human-Centered Computer Vision:
	Technology in the 21st Century Core Components and Applications
	Hojjat Adeli Antonis Argyros 1,2
	Ohio State University, Columbus, USA, Fellow of the Institute of Electrical and 1 Computer Science Department, University of Crete, Greece
	Electronics Engineers (IEEE), Honorary Professor, Southeast University, 2 Researcher, Foundation for Research and Technology -Hellas (FORTH)
	Nanjing, China, Member, Polish and Lithuanian Academy of Sciences, Elected
	corresponding member of the Spanish Royal Academy of Engineering.
	June 2021	Ilias Maglogiannis
		Lazaros Iliadis
		John MacIntyre

  Data Analytics for Incremental and Transfer Learning of Cognitive Spatio-Temporal Data and for Knowledge Transfer Nikola Kasabov Fellow IEEE, Fellow RSNZ, Fellow INNS College of Fellows Professor of Knowledge Engineering and Founding Director KEDRI Auckland University of Technology, Auckland, New Zealand George Moore Chair/Professor, University of Ulster, UK Honorary Professor Teesside University UK and the University of Auckland, NZ

Workshops Co-chairs Christos Makris University of Patras, Greece Katia Kermanidis Ionian University, Greece Phivos Mylonas Ionian University, Greece Spyros Sioutas University of Patras, Greece Program Committee Georgios Alexandridis University of the Aegean, Greece Serafín Alonso Castro University of Leon, Spain Ioannis Anagnostopoulos University of Thessaly, Greece Costin Badica University of Craiova, Romania Giacomo Boracchi Politecnico di Milano, Italy Francisco Carvalho Polytechnic Institute of Tomar, Portugal Diego Casado-Mansilla Polytechnic School of the University of Alcalá, Spain Ioannis Chamodrakas National and Kapodistrian University of Athens, Greece Kostantinos Delibasis University of Thessaly, Greece Konstantinos Demertzis Democritus University of Thrace, Greece Georgios Drakopoulos Ionian University, Greece Mauro Gaggero National Research Council of Italy, Italy Eleonora Giunchiglia University of Oxford, UK Peter Hajek University of Pardubice, Czech Republic Giannis Haralabopoulos University of Nottingham, UK Lazaros Iliadis Democritus University of Thrace, Greece Andreas Kanavos Ionian University, Greece Nikos Karacapilidis University of Patras, Greece Petros Kefalas CITY College, International Faculty of the University of Sheffield, Greece Katia Kermanidis Ionian University, Greece Petia Koprinkova-Hristova Bulgarian Academy of Sciences, Bulgaria Stelios Krinidis Centre for Research and Technology Hellas, Greece Florin Leon Technical University of Iasi, Romania Aristidis Likas University of Ioannina, Greece Pietro Liò University of Cambridge, UK Ioannis Livieris University of Patras, Greece Doina Logofătu Frankfurt University of Applied Sciences, Germany Ilias Maglogiannis University of Piraeus, Greece Goerge Magoulas Birkbeck, University of London, UK Christos Makris University of Patras, Greece Mario Malcangi University of Milan, Italy Andreas Menychtas University of Piraeus, Greece Vangelis Metsis Texas State University, USA Nikolaos Mitianoudis Democritus University of Thrace, Greece Antonio Moran University of Leon, Spain x Organization Konstantinos Moutselos University of Piraeus, Greece Phivos Mylonas Ionian University, Greece Stefanos Nikiforos Ionian University, Greece Stavros Ntalampiras University of Milan, Italy Vladimir Olej University of Pardubice, Czech Republic Mihaela Oprea University Petroleum-Gas of Ploiesti, Romania Ioannis P. Chochliouros Hellenic Telecommunications Organization (OTE), Greece Basil Papadopoulos Democritus University of Thrace, Greece Antonis Papaleonidas Democritus University of Thrace, Greece Pavlidis George Centre for Research and Technology Hellas, Greece Isidoros Perikos University of Patras, Greece Elias Pimenidis University of the West of England, UK Panagiotis Pintelas University of Patras, Greece Bernardete Ribeiro University of Coimbra, Portugal Antonio Staiano University of Naples Parthenope, Italy Christos Timplalexis Centre for Research and Technology Hellas, Greece Nicolas Tsapatsoulis Cyprus University of Technology, Cyprus Tsolakis Apostolos Centre for Research and Technology Hellas, Greece Petra Vidnerová Czech Academy of Sciences, Czech Republic Paulo Vitor de Campos Souza CEFET-MG, Brazil Gerasimos Vonitsanos University of Patras, Greece


Diana Cardenas
email: cardenas2@univ-lorraine.fr

Davy Monticolo
email: davy.monticolo@univ-lorraine.fr

Laurent Muller
email: l.muller@univ-lorraine.fr

Pascal Lhoste
email: pascal.lhoste@univ-lorraine.fr

CIGI 2021 Continuous Improvement process model: A Knowledge Management approach

Keywords: Amélioration Continue, Amélioration de la performance, Gestion des connaissances, Modélisation des processus Continuous Improvement, Performance Improvement, Knowledge Management, Process modelling, Knowledge Capitalization

Le contexte en constante évolution et les défis qu'il représente, amènent les entreprises à la nécessité d'améliorer leur performance de façon permanente. Depuis ses origines et à un rythme d'adoption croissant, l'amélioration continue (vue sous les différentes méthodologies comme le Lean Manufacturing, le Lean Six Sigma, etc.) a joué un rôle important, car sa mise en oeuvre est considérée comme un moyen d'améliorer le niveau de performance et les processus. Néanmoins, et malgré les nombreuses études développées, il y a un grand nombre d'échecs sur ces mises en oeuvre. Les études actuelles se sont surtout concentrées sur l'identification des facteurs d'échec ou de succès, mais la clarification du processus organisationnel reste inexplorée et mal comprise. En conséquence, suivant la méthode MASK et le méta-modèle KROM, cette étude propose un modèle de processus de l'amélioration continue en mettant en évidence les objectifs, les missions et les cinq processus clés. Ceci est réalisé en capitalisant les connaissances issues des entretiens avec 5 experts sur l'amélioration continue provenant d'entreprises multinationales.

Abstract -The current changing context and challenges it poses, bring companies to the need to improve their performance in a continuous way. For this means, since its origins and at an increasing adoption rate, the Continuous Improvement (seen under the different methodologies like, Lean Manufacturing, Lean Six Sigma, etc.) has played an important role, as its implementation is understood to lead to a better performance level and improved processes. Nevertheless, and despite the numerous developed studies, there is being seen a high number of failures on these implementations. Current studies have been focused mostly on the identification of failure or success factors, but the clarification of the organizational process remains unexplored and misunderstood. Accordingly, following MASK method and KROM meta-modelling, this study proposes a continuous improvement process model evidencing the goals, missions and the five key processes. This is done by capitalizing the knowledge from the interviews with 5 experts on Continuous Improvement from multinational companies.

INTRODUCTION

Nowadays, companies are seeking to constantly improve their level of performance. Thus, the Continuous Improvement of the performance in an organization plays a fundamental role. Continuous Improvement has been known over the years as an approach with the main purpose of enhancing the performance in an organization or their processes [START_REF] Bond | The role of performance measurement in continuous improvement[END_REF][START_REF] Gonzalez Aleu | Systematic literature review of critical success factors for continuous improvement projects[END_REF]. It has been widely popularized and implemented through various methodologies, among those, the most important and well-known are Lean Manufacturing, Lean Six Sigma and Six Sigma [START_REF] Gutierrez-Gutierrez | Continuous improvement initiatives for dynamic capabilities development: A systematic literature review[END_REF][START_REF] Mclean | Failure of Continuous Improvement initiatives in manufacturing environments: a systematic review of the evidence[END_REF][START_REF] Costa | Lean, six sigma and lean six sigma in the food industry: A systematic literature review[END_REF].

It is found in the literature that the widespread adoption of the Continuous Improvement approach not only leads to a better performance level, but it also contributes to the innovation of the organization. And that it is in fact through its implementation that is possible for a firm to promote a culture that responds to the challenges and changes in the context for enduring its sustainability [START_REF] Hyland | Performance measurement and continuous improvement: Are they linked to manufacturing strategy?[END_REF]. This extensive interest, its well-known popularity and widespread implementation is said to be highly motivated by the changes in the business environment, which constantly forces companies to keep on improving their performance in order to remain competitive and be able to fulfill customer demands [START_REF] Khan | Application of continuous improvement techniques to improve organization performance A case study[END_REF][START_REF] Singh | Continuous Improvement Strategies: An Overview[END_REF].

With no doubt, the Continuous Improvement plays a critical and strategic role for the organizations. Nonetheless, there is not much clarity in the literature on the process. Its management is frequently misunderstood, which mainly starts with the blurry use of the term, because it is both used for the complete process, but also refers to just the outcomes of that process [START_REF] Bessant | An evolutionary model of continuous improvement behaviour[END_REF]. Also, even though the great interest in research on continuous improvement and the widely disseminated promised benefits, what has been appreciated lately is that there is still a lot of gaps to be filled, gaps that are leading to a high percentage of companies that fail in the implementation of continuous improvement, and thus a great amount of resources are being wasted [START_REF] Mclean | Failure of Continuous Improvement initiatives in manufacturing environments: a systematic review of the evidence[END_REF][START_REF] Sanchez-Ruiz | Barriers to effectively implementing continuous improvement in Spanish firms[END_REF].

In the literature we observe that the reasons for failure are the lack of knowledge on Continuous Improvement, lack of an appropriate measurement and follow up system [START_REF] Sanchez-Ruiz | Barriers to effectively implementing continuous improvement in Spanish firms[END_REF], and lack of alignment with the strategy of the companies [START_REF] Middel | Continuous improvement in the Netherlands: A surveybased study into current practices[END_REF]. Very valuable studies as the two previously mentioned, have been focused on evidencing or identifying the failure or success factor on continuous improvement implementation, but leaving aside the clarification of its whole process. Which is indeed, of mayor importance, as having a formal and well-established process is critical for successful implementation of improvements [START_REF] Middel | Continuous improvement in the Netherlands: A surveybased study into current practices[END_REF]. Thus, it becomes highly relevant to analyze the process of continuous improvement, but not only from the perspective of the execution of projects or outcomes of the process, as it has been mainly analyzed in studies as the ones from [START_REF] Tennant | A continuous improvement process at Severn Trent Water[END_REF] and [START_REF] Unzueta | Continuous improvement framework to develop cultural change: case study, capital goods company[END_REF], but rather to consider the whole complete process in organizations, which has been poorly researched.

Therefore, in order to have a better management of the Continuous Improvement and consequently, helping in reducing the failure rates of implementations, there is still the lack of an overarching vision of this process in the industry. One that is not only focused on isolated solutions or actions, but that allows to understand the process in a comprehensive manner. Thus, the scientific question that arises is: how to model the process of Continuous Improvement of the performance in the organizations? as this is not clear in the literature. Consequently, the aim of this study is to propose a unified model of this process, through MASK, a Knowledge Management approach based on the capitalization of experts' knowledge [START_REF] Ermine | Knowledge Management with the MASK method[END_REF]. From which the identification of five principal processes of the continuous improvement is done. For doing so, the next section reviews the concepts of Continuous Improvement and Knowledge Management. Then, the methodology for this study is explained in the third section. Followed by the results and discussion in the fourth section. And finally, in the fifth section the conclusions are shown.

BACKGROUND

Continuous Improvement

From its beginnings, Continuous Improvement has been seen as a key element in the performance improvement, constantly increasing its adoption rate [START_REF] Hyland | Performance measurement and continuous improvement: Are they linked to manufacturing strategy?[END_REF]. According to the literature, Continuous Improvement was originated in Japan after the Second World War, was then when it was started to be used as an approach and philosophy for performance improvement and not only as isolated initiatives. Becoming then, one of the foundations of the success of the Japanese manufacturing [START_REF] Singh | Continuous improvement philosophy -literature review and directions[END_REF]. As highlighted by [START_REF] Sanchez | Three decades of continuous improvement[END_REF], some of the first definitions of Continuous improvement date from 1982 and 1989 by authors Deming and Imai, respectively. From which, it is highlighted its iterative characteristic and the involvement of the different levels at the organization.

The concept has been evolving along with the changes in the environment, it has been constantly ratifying its great importance for organizations. Being seen as an umbrella term and as a necessity for organizations in order to have a better organizational performance, to remain competitive in the market and to adapt to the new context [START_REF] Khan | Application of continuous improvement techniques to improve organization performance A case study[END_REF][START_REF] Singh | Continuous Improvement Strategies: An Overview[END_REF]. It is certainly a process in which a key factor is the knowledge and involvement of the entire organization [START_REF] Mclean | Failure of Continuous Improvement initiatives in manufacturing environments: a systematic review of the evidence[END_REF][START_REF] Singh | Continuous improvement philosophy -literature review and directions[END_REF].

Despite this, continuous improvement is a subject that still needs further research and to be analyzed in a more complete way. In this sense, there are studies, like the one from [START_REF] Almaiman | Facilitating a continuous improvement culture: A literature review[END_REF], who identifies the cultural aspects that facilitate Continuous Improvement, while stating its importance for achieving the desired benefits. Also, the one from [START_REF] Heavey | Introducing a new continuous improvement framework for increased organisational return on investment[END_REF] that proposes a framework for continuous improvement by determining its key forces for improving customer value. And finally, the one from [START_REF] Berger | Continuous improvement and kaizen: Standardization and organizational designs[END_REF] who evidences the core principles that are the basis of the Continuous Improvement. Even with the importance and relevance of those studies, there is still lacking a clarification on what is the process of Continuous Improvement.

Knowledge Management

Knowledge Management has been largely studied, having over the last two decades a noticeable increase of interest from academic researchers as well as from practitioners [START_REF] Lee | Revealing research themes and trends in knowledge management: From 1995 to 2010[END_REF][START_REF] Sarka | Future research on information technology in knowledge management[END_REF]. it is being understood as mechanisms and processes through which is enabled the creation, sharing and re-utilization of knowledge [START_REF] Amaral | Organizational learning and knowledge managementinsights from industrial managers[END_REF][START_REF] Bolis | The workers role in knowledge management and sustainability policies[END_REF][START_REF] Mårtensson | A critical review of knowledge management as a management tool[END_REF][START_REF] Poage | Covering the Intangibles in a KM Initiative[END_REF]. Being thus, strategic in the era of the knowledge economy, and aiming at creating value, developing intangible resources, and improving the competitiveness in organizations [START_REF] Patil | Methodological literature review of knowledge management research[END_REF].

The theory states that knowledge is created through the social interaction of individuals and organizations, and this creation process involves the interaction of two types of knowledge, the tacit and the explicit one, hence enabling a continuous process of knowledge creation [START_REF] Nonaka | SECI, Ba and Leadership: A Unified Model of Dynamic Knowledge Creation[END_REF]. This process involves four modes of knowledge creation, which are, socialization, externalization, combination, and internalization. It expresses the knowledge creation or crystallization as a neverending spiral that starts with the individual tacit knowledge level that is subsequently being externalized, transformed into explicit knowledge and then shared among the organization, for ultimately being internalized by individuals, providing a greater understanding and then generating more tacit knowledge [START_REF] Nonaka | Tacit knowledge and knowledge conversion: Controversy and advancement in organizational knowledge creation theory[END_REF].

Knowledge management builds up on the theory stated by [START_REF] Nonaka | The Knowledge-Creating Company: How Japanese Companies Create the Dynamics of Innovation[END_REF]. It is in fact a strategic approach that supports the knowledge creation process [START_REF] Matta | How to capitalize knowledge with the MASK method ?[END_REF], which is focused on analyzing the organization knowledge as a resource, and with the main objectives of knowledge capitalization (valorize the knowledge and preserve it), sharing (not only the knowledge circulation, but to reach a collective intelligence) and creation (linked to the permanent innovation of organizations) [START_REF] Ermine | La Gestion Des Connaissances[END_REF].

This process for knowledge capitalization, the externalization from tacit knowledge of the experts to explicit one, can be either done by an approach of only knowledge transcriptions, or under a knowledge engineering approach, which in the literature is considered to be even more complete and robust [START_REF] Ermine | La Gestion Des Connaissances[END_REF]]. Among the different methods of knowledge engineering, MASK (Method for Analysis and Structuring Knowledge) stands out [START_REF] Matta | How to capitalize knowledge with the MASK method ?[END_REF]. MASK is an evolution of knowledge management of nearly 30 years, it is a well-structured method which allows the knowledge capitalization from experts in a specified subject, it is based on the interviews to experts, the modeling of the knowledge and the model validation from the experts [START_REF] Aries | MASK : Une Méthode d'ingénierie Des Connaissances Pour l'analyse et La Structuration Des Connaissances[END_REF].

METHODOLOGY

With the purpose of providing a clearer understanding and modelling the process of the Continuous Improvement, the following methodology is proposed (Figure 1). This is based on a knowledge management approach, more specifically MASK method and KROM (Knowledge Reuse Organizational Meta-Model) [START_REF] Girodon | KROM: An organizational Meta-Model oriented to knowledge: A case from Ophthalmic industry[END_REF]. This methodology, under the approach of Knowledge Management aims at capitalizing the knowledge from experts in the industry, to transform their tacit knowledge on explicit [START_REF] Matta | How to capitalize knowledge with the MASK method ?[END_REF], for consequently sharing it and make it available to the use of the scientific community, and thus continue to contribute to the cycle of knowledge in the subject.

Figure 1. Methodology

For this study, the steps of MASK method as described in [START_REF] Ermine | Knowledge Management with the MASK method[END_REF][START_REF] Ermine | La Gestion Des Connaissances[END_REF] were followed: starting with the framing of the knowledge capitalization project by establishing the objectives and scope. Followed by the identification of the profiles of the experts to be interviewed, for this, different organizations and locations were privileged, as experts' diversity is often seen as an important factor for taking into account different social practices [START_REF] Nonaka | Tacit knowledge and knowledge conversion: Controversy and advancement in organizational knowledge creation theory[END_REF]. Then, the planning of the interviews was done, for which, a series of questions and a protocol of interview were established and then tested to further improve them. After that, it is the actual interviews to the selected experts.

For the next step, based on the interviews, the knowledge modelling is done. For this study we opted to develop the knowledge modelling with KROM meta-model, as it is centered on organizational modelling based on knowledge [START_REF] Girodon | KROM: An organizational Meta-Model oriented to knowledge: A case from Ophthalmic industry[END_REF][START_REF] Monticolo | Approches Organisationnelles Pour La Conception de Systèmes Multi-Agents Dédiés à La Gestion Des Connaissances[END_REF]. Through it, the organizational and process models are developed, for making it possible to clarify the Continuous Improvement process, by showing its goals, missions, subprocesses and the activities within them. After developing the models, an important step to follow is to develop a second interview with experts in order to have their validation on the gathered knowledge and feedback on the models for further improving them and confirm its accuracy.

RESULTS AND DISCUSSION

By following the MASK method, the first thing that was done was the framing of the project of knowledge capitalization, which is shown in (Table 1) and contains the objective and five w's and how. This is a very important step to do, as this gives us clarity regarding the scope of the knowledge field to clarify.

Table 1. Framing of Knowledge Capitalization project

Framing of the project Objective To access and capitalize the knowledge of experts in Continuous Improvement, with the objective to understand and clarify its processes, activities, characteristics.

Five W's and How What

The domain of study is the process of Continuous Improvement in the industry.

Who

The group of experts to interview are industry professionals with vast experience on Continuous Improvement.

Where

The interviews are developed by videoconference due to the actual situation and for having access to a diverse group of experts.

When

Each interview is designed to last 1 hour maximum. The total length of the process, including modeling and second round of interviews (experts' feedback on built models) is about 3 to 4 months.

How

A first interview with a defined protocol is done with the experts for gathering information. Following, after analyzing and structuring the information, a second round of interviews with available experts is developed to validate the structured models and receive feedback for further improvement.

Why

Because there is a need to give clarity on how the actual organizational process of the Continuous Improvement in the industry is, looking towards a lower failure ratio on implementations and a future transformation of the process.

Based on the described framing, the profile of the experts to be interviewed was determined, also the protocol of interview with the proposed questions was defined, taking into account the models to be used. In order to validate and improve this protocol prior to interviewing the experts, a mock interview was developed with one of the authors, who has more than 20 years of experience in the subject to study. With the intention to get a diversity of context on the experts for proposing more generalized models, a total of 5 experts from 4 different companies (located in France, Switzerland, Mexico, United States) were interviewed. All experts have a vast experience in Continuous Improvement, with positions such as Managers, Directors and Expert specialists in Process and Operational Excellence, Lean, Production and Continuous Improvement.

After gathering and analyzing the information from each of the interviews, the authors proceeded to capitalize the experts' knowledge by means of the models proposed by KROM. Since the interview to the first expert, the models were developed and consequently improved with the knowledge from the subsequent experts. By this, it was possible to observe that besides the particularities of the context of each expert, their knowledge on the subject was consistent. It was observed that the experts shared the same vision on Continuous Improvement and through the process even some of their answers were very similar, meaning in this way that a good quality and pertinence of the knowledge that captured under this Knowledge Management approach.

To confirm the relevance of the models developed, a second round of interviews with two of the experts was conducted. In these, as suggested in the MASK method [START_REF] Aries | MASK : Une Méthode d'ingénierie Des Connaissances Pour l'analyse et La Structuration Des Connaissances[END_REF], the aim is to obtain feedback and validation of the models by the experts, which process is considered sufficient when there is nothing more to add to the models. One of these second interviews was at the beginning of the process, in order to validate the early stages of the models; and the other one at the end of the process, after capitalizing the knowledge from all of the experts and consolidating them into one set of unified and comprehensive models.

As results of the capitalization of the knowledge, Figure 2 and Figure 3 show respectively the organizational structure model and the process model for Continuous Improvement. The model in Figure 2 is structured for representing the three principal missions of Continuous Improvement: to give support to the improvement of the processes in the company, to guide the establishment of the performance indicators, and to maintain a high level of performance. At the same time, it can be seen that these missions contribute to the achievement of the following goals: to excel from the competition, to quickly adapt to customer's (either external or internal) expectations, and to allow the company to sustain itself over time. Representing in this way the identity of the Continuous Improvement, which is in fact very important to clarify, as we have seen that one of the failure reasons in implementations is actually the lack of alignment with the company strategy [START_REF] Middel | Continuous improvement in the Netherlands: A surveybased study into current practices[END_REF], as it is often not seen as the whole organizational process.

Moreover, for fulfilling the identified missions, they rely on five processes, namely: to give support to the problem resolution, support the performance strategy, to train and coach th e From the interviews it was possible to not only identify for each mission which are the processes that they rely on and how these missions are contributing to the goals. But also, it was possible to map the whole organizational process and to identify the activities within them, its entries (e), exits (s), controls (c) and mechanisms (m). From the five identified processes, as an example, in Figure 4 and Figure 5 we represent "support problem resolution" and "support performance strategy" respectively.

In the process model for "support problem resolution" (Figure 4) are represented all the activities that it is constituted by. In this, it was evidenced the critical importance of well-defined performance indicators, as well as the data reliability of its measures, in which the role of data manager is lately becoming more and more valuable. This process receives as controls and entries, among others, the performance indicators measure, their target levels, and their level of conformity.

These come from other of the defined processes (follow-up and report performance indicators, support performance strategy, measure performance indicators), and become crucial for the right development of this process in order to obtain the desired outputs (lessons learned, action plan performance indicators, improved processes). Which highlights once again the need to see the Continuous Improvement as a whose organizational process and not as isolated bricks.

Likewise, in Figure 5 is shown the process model for "support performance strategy". This represents a very crucial process, as in its activities we find: to support the establishment of the mission and vision of the organization, from which the performance indicators are identified and defined with its target levels (generally done under a top-down approach, but taking into account that the reporting usually follows a bottom-up one), then the dashboard in which they are going to be reported is Consequently, with the development of these models under a Knowledge Management approach, we seek to give more clarity on the organizational process of the Continuous Improvement, which is important and vital for the survival of the companies, but so far poorly studied as a complete process. A general and mostly agreed opinion among the experts is that Continuous Improvement is fundamental for companies seeking to be adaptable and competitive. It must be considered as an essential part of its strategy, no matter under which specific methodology it is implemented (Lean, Six Sigma, Lean Six Sigma, TPS…) or the way it is represented in the companies (a whole department, a group of experts, a shared philosophy with each process owner empowered). Thus, a clearer way to understand it, is shown in this paper, which is expected to be seen as a reference for the as-is process and later analyze the to-be one.

Moreover, the developed models can be confronted with another reference describing performance improvement requirements: ISO 9000 standards. In ISO 9001 standard (Fundamentals and vocabulary) [International Organization for Standardization, 2015], one of the seven principles of quality management is improvement. This principle reminds us that the success of an organization is based on a constant desire for improvement and proposes to bring the organization's processes under control. In ISO 9001 standard (Requirements), chapter 9 (Performance assessment) and chapter 10 (Improvement) are directly concerned with performance improvement, they broadly take up the elements presented in our model. Finally, in the ISO 9004 standard (Quality of an organization -Guidance to achieve sustained success) [International Organization for Standardization, 2018], the term improvement (in different forms) appears 146 times, thus, reflecting the great importance of this notion in this quality standard. By analyzing the standard, we believe that the models developed are in line with the standards, they are complementary. In our models we can find the processes and activities in detail, but the standard, in contrast with our models, opens the scope to the outside of the organization (in chapter 5.2 involves the interested parties for detecting opportunities for sustainable performance improvement, and chapter 10.4.3 talks about comparing the organization's performance with agreed benchmarks) and considers the practice of internal audits and self-assessments with the staff. The standards give a much more general vision, nevertheless with our models obtained from the capitalization of expert knowledge, we propose a more detailed vision that can become a great insight for practitioners.

CONCLUSIONS

This study developed the organizational and process models of the Continuous Improvement, intending to give a better understanding, highly motivated by its fundamental role for organizations. This was developed under a Knowledge Management approach, following the MASK method, and capitalizing the knowledge of the experts through the models proposed by KROM. This study is providing in the results, a model depicting the three goals, three missions and five processes of the organizational process of Continuous improvement, as well as the activities within two of these processes. With this, we intend to give more clarity and to help towards the creation and sharing of knowledge in order to help to reduce the failure rate in the implementation of Continuous Improvement initiatives.

Furthermore, these models represent how the Continuous Improvement is being managed and developed in the industry nowadays, however the authors believe it is important to be conscious that it should be evolving along with the changes in the environment, like the fourth industrial revolution, which should take us to further adapt and improve it. In this regard some key elements were identified in the interviews, like the importance of continuously tracking the performance and the analysis and reliability of the data, for improving the decisions management and base it on data instead of just intuition.

The results from this study could lead to various perspectives and applications, with the developed models, a more understandable view of the Continuous Improvement is given, which could become the basis for guiding practitioners through its implementation and for developing a diagnosis of the Continuous Improvement process in the companies. It could allow based on this process, to propose a decision-making system for helping engineers and managers to better analyze and improve the performance. It could as well be the starting point towards an analysis for the improvement of the process, as for this, having a clear understanding of the process is a must. And finally, for developing the digitalization of the workflow of the process in order to have a better visibility and control.

Figure 2 .

 2 Figure 2. Continuous Improvement Organizational structure model

Figure 5 .

 5 Figure 5. Process model: Support performance strategy structured, and also it is determined the continuous improvement yearly strategy, with the training programs and kaizen projects and their schedule. Throughout the interviews, it was evidenced that even if the identification of the performance indicators plays a highly important role, it is mainly done by instinct. Its identification and dependability connection between the different levels of indicators (low, medium, high) represents without doubt an important room for further improvement and systematization.


Olivier Billet
email: olivier.billet@orange-ftgroup.com

Anne Canteaut
email: anne.canteaut@inria.fr

Nicolas Courtois
email: n.courtois@ucl.ac.uk

Henri Gilbert
email: henri.gilbert@orange-ftgroup.com

Louis Goubin
email: louis.goubin@prism.uvsq.fr

Aline Gouget
email: aline.gouget@gemalto.com

Louis Granboulan
email: louis.granboulan@eads.net

Cédric Lauradoux
email: cedric.lauradoux@inria.fr

Marine Minier
email: marine.minier@insa-lyon.fr

C Berbain
email: come.berbain@orange-ftgroup.com

T Pornin

H Sibert
email: herve.sibert@nxp.com

Sosemanuk, a fast software-oriented stream cipher ⋆

come

Introduction

This paper presents a proposal for a new synchronous software-oriented stream cipher, named Sosemanuk. The Sosemanuk cipher uses both basic design principles from the stream cipher SNOW 2.0 [START_REF] Ekdahl | A new version of the stream cipher SNOW[END_REF] and transformations derived from the block cipher SERPENT [START_REF] Biham | SERPENT: A new block cipher proposal[END_REF]. For this reason, its name should refer both to SERPENT and SNOW. However, it is wellknown that snow snakes do not exist since snakes either hibernate or move to warmer climes during the winter.Instead Sosemanuk is a popular sport played by the Eastern Canadian tribes. It consists in throwing a wooden stick along a snow bank as far as possible. Its name means snowsnake in the Cree language, since the stick looks like a snake in the snow. Kwakweco-cime win is a variant of the same game but does not sound like an appropriate cipher name. More details on the Sosemanuk game and a demonstration can be found in [START_REF] Howard | Snow snake demonstration gives history lesson[END_REF] and [START_REF]The story of Snowsnake[END_REF].

The Sosemanuk stream cipher is a new synchronous stream cipher dedicated to software applications. Its key length is variable between 128 and 256 bits. Any key length is claimed to achieve 128-bit security. It is inspired by the design of SNOW 2.0 which is very elegant and achieves a very high throughput on a Pentium 4. Sosemanuk aims at improving SNOW 2.0 from two respects. First, it avoids some structural properties which may appear as potential weaknesses, even if the SNOW 2.0 cipher with a 128-bit key resists all known attacks. Second, efficiency is improved on several architectures by reducing the internal state size, thus allowing for a more direct mapping of data on the processor registers. Sosemanuk also requires a reduced amount of static data; this lower data cache pressure yields better performance on several architectures. Another strength of Sosemanuk is that its key setup procedure is based on a reduced version of the well-known block cipher SERPENT, improving classical initialization procedures both from an efficiency and a security point of view.

Specification

SERPENT and derivatives

SERPENT [START_REF] Biham | SERPENT: A new block cipher proposal[END_REF] is a block cipher proposed as an AES candidate. SERPENT operates over blocks of 128 bits which are split into four 32-bit words, which are then combined in so-called "bitslice" mode. SERPENT can thus be defined as working over quartets of 32-bit words. We number SERPENT input and output quartets from 0 to 3, and write them in the order: (Y 3 , Y 2 , Y 1 , Y 0 ). Y 0 is the least significant word, and contains the least significant bits of the 32 4-bit inputs to the SERPENT S-boxes. When SERPENT output is written into 16 bytes, the Y i values are written following the little-endian convention (least significant byte first), and Y 0 is output first, then Y 1 , and so on.

From SERPENT, we define two primitives called Serpent1 and Ser-pent24.

Serpent1 A SERPENT rounds consist of, in that order:

a subkey addition, by bitwise exclusive or; -S-box application (which is expressed as a set of bitwise combinations between the four running 32-bit words, in bitslice mode); -a linear bijective transformation (which amounts to a few XORs, shifts and rotations in bitslice mode), see Appendix A.2.

Serpent1 is one round of SERPENT, without the key addition and the linear transformation. SERPENT uses eight distinct S-boxes (see A.1 for details), numbered from S 0 to S 7 on 4-bit words. We define Serpent1 as the application of S 2 , in bitslice mode. This is the third S-box layer of SERPENT. Serpent1 takes four 32-bit words as input, and provides four 32-bit words as output.

Serpent24 Serpent24 is SERPENT reduced to 24 rounds, instead of the 32 rounds of the full version of SERPENT. Serpent24 is equal to the first 24 rounds of SERPENT, where the last round (the 24th) is a complete one and includes a complete round with the linear transformation and an XOR with the 25th subkey. In other words, the 24th round of Serpent24 is thus equivalent to the thirty-second round of SERPENT, except that it contains the linear transformation and that the 24th and 25th subkeys are used (32nd and 33rd subkeys in SERPENT). Thus, the last round equation on Page 224 in [START_REF] Biham | SERPENT: A new block cipher proposal[END_REF] is

R 23 (X) = L Ŝ23 (X ⊕ K23 ) ⊕ K24 .
Serpent24 uses only 25 128-bit subkeys, which are the first 25 subkeys produced by the SERPENT key schedule. In Sosemanuk, Serpent24 is used for the initialization step, only in encryption mode. Decryption is not used.

The LFSR

Underlying finite field Most of the stream cipher internal state is held in a LFSR containing 10 elements of F 2 32 , the field with 2 32 elements. The elements of F 2 32 are represented exactly as in SNOW 2.0. We recall this representation here. Let F 2 denote the finite field with 2 elements. Let β be a root of the primitive polynomial:

Q(X) = X 8 + X 7 + X 5 + X 3 + 1 on F 2 [X]
. We define the field F 2 8 as the quotient F 2 [X]/Q(X). Each element in F 2 8 is represented using the basis (β 7 , β 6 , ...β, 1). Since the chosen polynomial is primitive, then β is a multiplicative generator of all invertible elements of F 2 8 : every non-zero element in F 2 8 is equal to β k for some integer k (0 ≤ k ≤ 254). Any element in F 2 8 is identified with an 8-bit integer by the following bijection:

φ : F 2 8 → {0, 1, . . . , 255} x = 7 i=0 x i β i → 7 i=0 x i 2 i
where each x i is either 0 or 1. For instance, β 23 is represented by the integer φ(β 23 ) = 0xE1 (in hexadecimal).Therefore, the addition of two elements in F 2 8 corresponds to a bitwise XOR between the corresponding integer representations. The multiplication by β is a left shift by one bit of the integer representation, followed by an XOR with a fixed mask if the most significant bit dropped by the shift equals 1.

Let α be a root of the primitive polynomial

P (X) = X 4 + β 23 X 3 + β 245 X 2 + β 48 X + β 239 on F 2 8 [X]
. The field F 2 32 is then defined as the quotient F 2 8 [X]/P (X), i.e., its elements are represented with the basis (α 3 , α 2 , α, 1). Any element in F 2 32 is identified with a 32-bit integer by the following bijection:

ψ : F 2 32 → {0, 1, . . . , 2 32 -1} y = 3 i=0 y i α i → 3 i=0 φ(y i )2 8i
Thus, the addition of two elements in F 2 32 corresponds to a bitwise XOR between their integer representations. This operation will hereafter be denoted by ⊕. Sosemanuk also uses multiplications and divisions of elements in F 2 32 by α. Multiplication of z ∈ F 2 32 by α corresponds to a left shift by 8 bits of ψ(z), followed by an XOR with a 32-bit mask which depends only on the most significant byte of ψ(z). Division of z ∈ F 2 32 by α is a right shift by 8 bits of ψ(z), followed by an XOR with a 32-bit mask which depends only on the least significant byte of ψ(z).

Definition of the LFSR The LFSR operates over elements of F 2 32 . The initial state, at t = 0, entails the ten 32-bit values s 1 to s 10 . At each step, a new value is computed, with the following recurrence:

s t+10 = s t+9 ⊕ α -1 s t+3 ⊕ αs t , ∀t ≥ 1
and the register is shifted (see Figure 1 for an illustration of the LFSR). The LFSR is associated with the following feedback polynomial:

π(X) = αX 10 + α -1 X 7 + X + 1 ∈ F 2 32 [X]
Since the LFSR is non-singular and since π is a primitive polynomial, the sequence of 32-bit words (s t ) t≥1 is periodic and has maximal period (2 320 -1).

The Finite State Machine

The Finite State Machine (FSM) is a component with 64 bits of memory, corresponding to two 32-bit registers R1 and R2. At each step, the FSM takes as inputs some words from the LFSR state; it updates the memory bits and produces a 32-bit output. The FSM operates on the LFSR state at time t ≥ 1 as follows:

F SM t : (R1 t-1 , R2 t-1 , s t+1 , s t+8 , s t+9 ) → (R1 t , R2 t , f t )
where

R1 t = (R2 t-1 + mux(lsb(R1 t-1 ), s t+1 , s t+1 ⊕ s t+8 )) mod 2 32 (1)
R2 t = Trans(R1 t-1 ) (2)
f t = (s t+9 + R1 t mod 2 32 ) ⊕ R2 t (3)
where lsb(x) is the least significant bit of x, mux(c, x, y) is equal to x if c = 0, or to y if c = 1. The internal transition function Trans on F 2 32 is defined by

Trans(z) = (M × z mod 2 32 ) <<<7
where M is the constant value 0x54655307 (the hexadecimal expression of the first ten decimals of π) and <<< denotes bitwise rotation of a 32-bit value (by 7 bits here).

Output transformation

The outputs of the FSM are grouped by four, and Serpent1 is applied to each group; the result is then combined by XOR with the corresponding dropped values from the LFSR, to produce the output values z t :

(z t+3 , z t+2 , z t+1 , z t ) = Serpent1 (f t+3 , f t+2 , f t+1 , f t ) ⊕ (s t+3 , s t+2 , s t+1 , s t )
Four consecutive rounds of Sosemanuk are depicted in Figure 2.

Sosemanuk workflow

The Sosemanuk cipher combines the FSM and the LFSR to produce the output values z t . Time t = 0 designates the internal state after initialization; the first output value is z 1 . Figure 3 gives a graphical overview of Sosemanuk.

At time t ≥ 1, we perform the following operations:

-The FSM is updated: R1 t , R2 t and the intermediate value f t are computed from R1 t-1 , R2 t-1 , s t+1 , s t+8 and s t+9 . -The LFSR is updated: s t+10 is computed, from s t , s t+3 and s t+9 . The value s t is sent to an internal buffer, and the LFSR is shifted.

Once every four steps, four output values z t , z t+1 , z t+2 and z t+3 are produced from the accumulated values f t , f t+1 , f t+2 , f t+3 and s t , s t+1 , s t+2 , s t+3 . Thus, Sosemanuk produces 32-bit values. We recommend encoding them into groups of four bytes using the little-endian convention, because it is faster on the most widely used high-end software platform (x86-compatible PC), and because SERPENT uses that convention.

Therefore, the first four iterations of Sosemanuk are as follows.

-The LFSR initial state contains values s 1 to s 10 ; no value s 0 is defined. The FSM initial state contains R1 0 and R2 0 . -During the first step, R1

s t+3 z t z t+1 z t+2 z t+3 R1 t-1 R2 t-1 Serpent1 s t+9 s t+10 s t+11 s t+12 f t+1 f t+2 f t+3 f t s t+1 ⊕ s t+8 s t+4 s t+4 ⊕ s t+11 s t+3 s t+3 ⊕ s t+10 s t+2 s t+2 ⊕ s t+9 or s t+1
or or or Fig. 2. The output transformation on four consecutive rounds of Sosemanuk.

s t+7 α s t s t+1 Serpent1 R2 f t (×4) mux output R1 Trans s t+9 α -1 s t+3
Fig. 3. An overview of Sosemanuk

Key initialization and IV injection

The Sosemanuk initialization process is split into two steps:

the key schedule, which processes the secret key but does not depend on the IV; and the IV injection, which uses the output of the key schedule and the IV. This initializes the stream cipher internal state.

Key schedule

The key setup corresponds to the Serpent24 key schedule, which produces 25 128-bit subkeys, as 100 32-bit words. These 25 128-bit subkeys are identical to the first 25 128-bit subkeys produced by the plain SERPENT key schedule. SERPENT accepts any key length from 1 to 256 bits; hence, Sosemanuk may work with exactly the same keys. However, since Sosemanuk aims at 128-bit security; its key length must then be at least 128 bits. Therefore, 128 bits is the standard key length. Any key length from 128 bits to 256 bits is supported. But, the security level still corresponds to 128-bit security. In other words, using a longer secret key does not guarantee to provide the security level usually expected from such a key.

IV injection

The IV is a 128-bit value. It is used as input to the Ser-pent24 block cipher, as initialized by the key schedule. Serpent24 consists of 24 rounds and the outputs of the 12th, 18th and 24th rounds are used. We denote those outputs as follows:

-(Y 12 3 , Y 12 2 , Y 12 1 , Y 12 0 ): output of the 12th round; -(Y 18 3 , Y 18 2 , Y 18 1 , Y 18 0 ): output of the 18th round; -(Y 24 3 , Y 24 2 , Y 24
1 , Y 24 0 ): output of the 24th round. The output of each round consists of the four 32-bit words just after the linear transformation, except for the 24th round, for which the output is taken just after the addition of the 25th subkey.

These values are used to initialize the Sosemanuk internal state, with the following values:

(s 7 , s 8 , s 9 , s 10 ) = (Y 12 3 , Y 12 2 , Y 12 1 , Y 12 0 ) (s 5 , s 6 ) = (Y 18 1 , Y 18 3 ) (s 1 , s 2 , s 3 , s 4 ) = (Y 24 3 , Y 24 2 , Y 24 1 , Y 24 0 ) R1 0 = Y 18 0 R2 0 = Y 18 2
3 Design rationale

Key initialization and IV injection

Underlying principle. A first property of the initialization process is that it is split into two distinct steps: the key schedule which does not depend on the IV, and the IV injection which generates the initial state of the generator from the IV and from the output of the key schedule. Then, the IV setup for a fixed key is less expensive than a complete key setup, improving the common design since changing the IV is more frequent than changing the secret key.

A second characteristic of Sosemanuk is that the IV setup is derived from the application of a block cipher over the IV. If we consider the function F K which maps a n-bit IV to the first n bits of output stream generated from the key K and the IV, then F K must be computationaly indistinguishable from a random function over F n 2 . Hence, the computation of F K cannot "morally" be faster than the best known PRF over n-bit blocks. It so happens that the fastest known PRF use the same implementation techniques that the fastest known Pseudo-Random Permutations (which are block ciphers), and amount to the equivalent performance.

Since Sosemanuk stream generation is very fast, the generation of n stream bits takes little time compared to a computation of a robust PRP over a block of n bits. Following this path of reasoning, we decided to use a block cipher as the fundation of the IV setup for Sosemanuk: the IV setup itself cannot be much faster than the application of a block cipher, and the security requirements for that step are much similar to what is expected from a block cipher.

Choice of the block cipher. The block cipher used in the IV setup is derived from SERPENT for the following reasons:

-SERPENT has been thoroughly analyzed during the AES selection process and its security is well-understood. -SERPENT needs no static data tables, and hence adds little or no data cache pressure. -The SERPENT round function is optimized for operation over data represented as 32-bit words, which is exactly how data is managed within Sosemanuk. Using SERPENT implies no tedious byte extraction from 32-bit words, or recombinations into such words. -We needed a block cipher for the key schedule and IV injection; using something other else than AES seems good for "biodiversity".

Design of Serpent24. The IV injection uses a reduced version of SER-PENT because SERPENT aimed at 256-bit security, whereas Sosemanuk is meant for 128-bit security. The best linear bias and differential bias for a 6-round version of SERPENT are 2 -28 and 2 -58 respectively [START_REF] Biham | SERPENT: A new block cipher proposal[END_REF]. Thus, 12 rounds should provide appropriate security. Twelve more rounds are added in order to generate enough data (three 128-bit words are needed for initializing Sosemanuk), hence 24 rounds for Serpent24. We rely on the Sosemanuk core itself to provide some security margins (the output of Serpent24 is not available directly to the attacker). Two consecutive outputs of data are spaced with six inner rounds in order to prevent the existence of relations between the bits of the initial state and the secret key bits which could be used in an attack.

LFSR

The SNOW 2.0 LFSR contains 16 elements, which means 512 bits of internal state. Since we aim only at 128-bit security, we can accommodate a shorter LFSR. To defeat time-memory-data trade-off attacks, 256 bits of internal state at least should be used; we wanted some security margin, hence an LFSR length a bit more than six words.

LFSR length. The LFSR length n must be as small as possible: the bigger the state, the more difficult it is to map the state values on the processor registers. Ideally, the total state should fit in the 16 general-purpose registers that the new AMD64 architecture offers.

For efficient LFSR implementation, the LFSR must not be physically shifted; moving data around contributes nothing to actual security, and takes time. If n is the LFSR length, then kn steps (for some integer k) must be "unrolled", so that at each step only one LFSR cell is modified. Moreover, since Serpent1 operates over four successive output values, kn corresponds to lcm(4, n) and it should be kept as small as possible, since a higher code size increases code cache pressure.

These considerations led us to n = 8 or 10. But, an LFSR of length eight presents potential weaknesses which may be exploited in a guessand-determine attack (see Section 4.3). Therefore, a LFSR of length 10 is a suitable choice: the 384-bit internal state length should be enough; only 20 steps need to be unrolled for an efficient implementation. The total internal state fits in 12 registers, which should map fine on the new AMD64 architecture.

Feedback polynomial. The design criteria for the feedback polynomial are similar to those used in SNOW 2.0. Since the feedback polynomial must be as sparse as possible, we chose as in SNOW 2.0 a primitive polynomial of the form

π(X) = c 0 X 10 + c a X n-a + c b X n-b + 1 ,
where 0 < a < b < 10. The coefficients c 0 , c a and c b preferably lie in {1, α, α -1 } which are the elements corresponding to an efficient multiplication in F 2 32 . Moreover, {c 0 , c a , c b } must contain at least two distinct non-binary elements; otherwise, a multiple of π with binary coefficients can be easily constructed [START_REF] Ekdahl | Distinguishing attacks on SOBER[END_REF][START_REF] Hawkes | Guess-and-determine attacks on SNOW[END_REF], providing an equation which holds for each single bit position. We also want a and b to be coprime with the LFSR length. Otherwise, for instance if d = gcd(a, 10) > 1, the corresponding recurrence relation

s t+10 = c b s t+b + c a s t+a + c 0 s t
involves three terms of a decimated sequence (s dt+i ) t>0 (for some integer i), which can be generated by an LFSR of length n/d [START_REF] Rueppel | Analysis and Design of stream ciphers[END_REF]. These conditions led us to a = 3 and b = 9. Since a and b are not coprime, c a and c b must be different; otherwise, some simplified relations may be exhibited by manipulating the feedback polynomial as shown in [START_REF] Hawkes | Guess-and-determine attacks on SNOW[END_REF][START_REF] Cannière | Guess and determine attack on SNOW -NESSIE public reports[END_REF]. The values c 0 = α, c 3 = α -1 and c 9 = 1 correspond to a suitable primitive polynomial that fulfills all previously mentioned conditions.

FSM

The Trans function. The Trans function is chosen according to the following implementation criteria: no static data tables in order to reduce the cache pressure and the function must be fast on modern processors. For these reasons, the Trans function is composed of a 32-bit multiplication and a bitwise rotation which are both very fast. The 32-bit multiplication provides excellent "data mixing" compared to the number of clock cycles it consumes. The bitwise rotation avoids the existence of a linear relation between the least-significant bits of the inputs and the output of the FSM.

The operations involved in the Trans functions are incompatible with the other operations used in the FSM (addition over Z 2 32 , XOR operation). Actually, mixing operations on the ring and on the vector space disables associativity and commutativity laws. For instance,

(M × (R2 t-1 + s t+1 mod 2 32 ) mod 2 32 ) <<<7 = (M × (R2 t-1 ) mod 2 32 ) <<<7 + (M × (s t+1 ) mod 2 32 ) <<<7 mod 2 32 .
The mux operation. The mux operation aims at increasing the complexity of fast correlation and algebraic attacks, since it decimates the FSM input sequence in an irregular fashion. Moreover, this operation can be implemented efficiently with either control bit extension and bitwise operations, or an architecture specific "conditional move" opcode. Modern C compilers know how to perform those optimizations when compiling the C conditional ternary operator "?:". This multiplexer is quite fast and requires no jump.

It is fitting that both LFSR elements s t+c and s t+d (with c ≤ d) in the mux operation are not involved in the recurrence relation. Otherwise the complexity of guess-and-determine attacksmight be reduced. The distance (d -c) between those elements must be coprime with the LFSR length since they must not be expressed as a decimated sequence with a lower linear complexity. Here, we choose d-c = 7. Finally, it must be impossible for the inputs of the mux operation at two different steps correspond to the same element in the LFSR sequence. For this reason, the mux operation outputs either s t+c or s t+c ⊕ s t+d . If s t+c ⊕ s t+d is the input of the FSM at time t, the possible inputs at time (t + d -c) are s t+d and s t+d ⊕ s t+2d-c , which do not match any previous input. It is worth noticy that this property does not hold anymore if the mux outputs either s t+c or s t+d .

The output transformation

The output transformation derived from Serpent1 aims at mixing four successive outputs of the FSM in a nonlinear way. As a consequence, any 32-bit keystream word produced by Sosemanuk depends on four consecutive intermediate values f t . As a result, recovering any single output of the FSM, f t , in a guess-and-determine attack requires the knowledge of at least four consecutive words from the LFSR sequence, s t , s t+1 , s t+2 , s t+3 (see Section 4.3 for details).

The following properties have also been taken into account in the choice of output transformation.

-Both nonlinear mixing operations involved in Sosemanuk (the Trans operation and the Serpent1 used in bitslice mode) do not provide any correlation probability or linear property on the least significant bits that could be used to mount an attack (see Section 4.4 for further details). -From an algebraic point of view, those operations are combined to produce nonlinear equations (see Section 4.6). -No linear relation can be directly exploited on the least significant bit of the values (f t , f t+1 , f t+2 , f t+3 ), only quadratic equations with more variables than the number of possible equations (see Section 4.4). -The linear relation between s t and Serpent1 (f t , f t+1 , f t+2 , f t+3 ) prevents Sosemanuk from SQUARE-like attacks.

Finally, the fastest SERPENT S-box (S 2 ) has been chosen in Serpent1 from an efficiency point of view [START_REF] Osvik | Speeding up SERPENT[END_REF]. But, S 2 also guarantees that there is no differential-linear relation on the least significant bit (the "most linear" one in the output of the FSM).

Resistance against known attacks

Our stream cipher Sosemanuk offers a 128-bit security, based on the following security model.

Security model

The attacker is a probabilistic Turing Machine with access to a black box (oracle) that accepts the following three instructions: Reset, Init with a 128-bit input, GetStream with a 1-bit output. The attacker's goal is to distinguish with probability 2/3 between a black box that generates random output, and a black box that implements the stream cipher, where Reset generates a random key, Init initializes the internal state of the stream cipher with a new chosen IV, and GetStream generates the next bit of keystream. The attacker is allowed to do 2 128 elementary operations, an instruction to the black box being an elementary operation.

This security model falls under remarks made by Hong and Sarkar [START_REF] Hong | Rediscovery of time memory tradeoffs[END_REF], because the precomputation time is not bounded by our model. Therefore our claim is that the 256-bit key variant of Sosemanuk provide a 128bit security. We do not know of a formal security model that restricts the precomputation time, i.e. that only allows the attacker one of the probabilistic Turing machines that can be built in a reasonable time from the current content of today's computers. Therefore, our claim is that the 128-bit key variant of Sosemanuk, and all variants with larger keys, provide a 128-bit security against an attacker that is not allowed to benefit from large precomputation.

The following sections focus on the security of Sosemanuk against known attacks. It is important to note that the secret key of the cipher cannot be easily recovered from the initial state of the generator. Once the initial state is recovered, the attacker is only able to generate the output sequence for a particular key and a given IV. Recovering the secret key or generating the output for a different IV additionally requires the cost of an attack on Serpent24 with a certain number of plaintext/ciphertext pairs.

Time-memory-data tradeoff attacks

Due to the choice of the length of the LFSR (more than twice the key length), the time-memory-data tradeoff attacks described in [START_REF] Babbage | A space/time trade-off in exhaustive search attacks on stream ciphers[END_REF][START_REF] Golić | Cryptanalysis of alleged A5 stream cipher[END_REF][START_REF] Biryukov | Cryptanalytic time-memory-data trade-offs for stream ciphers[END_REF] are impracticable. Moreover, since these TMDTO attacks aim at recovering the internal state of the cipher, recovering the secret key requires the additional cost of an attack against Serpent24. The best time-memory data tradeoff attack is the Hellman's one [START_REF] Hellman | A cryptanalytic time-memory trade-off[END_REF] which aims at recovering a pair (K, IV ). For a 128-bit secret key and a 128-bit IV, its time complexity is equal to 2 128 cipher operations (see [START_REF] Hong | Rediscovery of time memory tradeoffs[END_REF] for further details).

Guess and determine attacks

The main weaknesses of SNOW 1.0 are related to this type of attacks (two at least have been exhibited [START_REF] Hawkes | Guess-and-determine attacks on SNOW[END_REF], [START_REF] Cannière | Guess and determine attack on SNOW -NESSIE public reports[END_REF]). They essentially exploit a particular weakness in the linear recurrence equation. This does not hold anymore for the new polynomial choice in SNOW 2.0 and for the polynomial used in Sosemanuk which involve non-binary multiplications by two different constants. The first attack [START_REF] Hawkes | Guess-and-determine attacks on SNOW[END_REF] also exploited a "trick" coming from the dependence between the values R1 t-1 and R1 t . This trick is avoided in SNOW 2.0 (because there is no direct link between those two register values anymore) and in Sosemanuk.

The best guess and determine attack we have found on Sosemanuk is the following.

-Guess at time t, s t , s t+1 , s t+2 , s t+3 , R1 t-1 and R2 t-1 (6 words).

-Compute the corresponding outputs of the FSM (f t , f t+1 , f t+2 , f t+3 ).

-Compute R2 t = T rans(R1 t-1 ) and R1 t from Equation (1) if lsb(R1 t-1 ) = 1 (this can be done only with probability 1/2).

-From f t = (s t+9 + R1 t mod 2 32 ) ⊕ R2 t , compute s t+9 .
-Compute R1 t+1 from the knowledge of both s t+2 and s t+9 ; compute R2 t+1 . Compute s t+10 from f t+1 , R1 t+1 and R2 t+1 . -Compute R1 t+2 from s t+3 and s t+10 ; compute R2 t+2 . Compute s t+11 from f t+2 , R1 t+2 and R2 t+2 . Now, s t+4 can be recovered due to the feedback relation at time t + 1:

α -1 s t+4 = s t+11 ⊕ s t+10 ⊕ αs t+1 .
-Compute R1 t+3 from s t+4 and s t+11 ; compute R2 t+2 . Compute s t+12 from f t+3 , R1 t+3 and R2 t+3 . Compute s t+5 by the feedback relation at time t + 2:

α -1 s t+5 = s t+12 ⊕ s t+11 ⊕ αs t+2 .
At this point, the LFSR words s t , s t+1 , s t+2 , s t+3 , s t+4 , s t+5 , s t+9 are known. Three elements (s t+6 , s t+7 , s t+8 ) remain unknown. To complete the full 10 words state of the LFSR, we need to guess 2 more words, s t+6 and s t+7 since each f t+i , 4 ≤ i ≤ 7, depends on all 4 words s t+4 , s t+5 , s t+6 and s t+7 . Therefore, this attack requires the guess of 8 32-bit words, leading to a complexity of 2 256 .

Note that in [START_REF] Ahmadi | Improved guess and determine attack on SOSEMANUK[END_REF] and in [START_REF] Tsunoo | Evaluation of SOSEMANUK with regard to guess-and-determine attacks[END_REF] the authors respectively proposed two guess and determine attacks against Sosemanuk that have a complexity approximatively equal to 2 226 and 2 224 computations. However, as stated in paragraphs 2.6, 3.2 and 4.1, we never intended to have more than 128-bit security. The internal state of Sosemanuk is 384-bit long, which would be bad practice if we aimed at 256-bit security. Therefore, those guess-and-determine attacks, while being interesting theoretical studies, do not compromise the security of Sosemanuk.

Correlation attacks

In order to find a relevant correlation in Sosemanuk, the following questions can be addressed:

does there exist a linear relation at bit level between some input and output bits? -does there exist a particular relation between some input bit vector and some output bit vector?

In the first case, two linear relations could be exhibited at the bit level. In the first, the least significant bit of s t+9 was "conserved", since the modular addition over Z 2 32 is a linear operation on the least significant bit. The second linear relation induced by the FSM concerns the least significant bit of s t+1 or of s t+1 ⊕ s t+8 (used to compute R1 t ) or the seventh bit of R2 t computed from s t or of s t ⊕ s t+7 . We here use that R2 t = Trans(R1 t-1 ) and R1 t-1 = R2 t-2 + (s t or (s t ⊕ s t+7 )) mod 2 32 .

No linear relation holds after applying Serpent1 and there are too many unknown bits to exploit a relation on the outputs words due to the bitslice design. Moreover, a fast correlation attack seems to be impracticable because the mux operation prevents certainty in the dependence between the LFSR states and the observed keystream.

Distinguishing attacks

A distinguishing attack by D. Coppersmith, S. Halevi and C. Jutla (see [START_REF] Coppersmith | Cryptanalysis of stream ciphers with linear masking[END_REF]) against the first version of SNOW used a particular weakness of the feedback polynomial built on a single multiplication by α. This property does not hold for the choice of the new polynomial in SNOW 2.0 and for the polynomial used in Sosemanuk where multiplication by α -1 is also included.

In [START_REF] Watanabe | A distinguishing attack of SNOW 2.0 with linear masking method[END_REF], D. Watanabe, A. Biryukov and C. De Cannière have mounted a new distinguishing attack on SNOW 2.0 with a complexity about 2 225 operations using multiple linear masking method. They construct 3 different masks Γ 1 = Γ , Γ 2 = Γ • α and Γ 3 = Γ • α -1 based on the same linear relation Γ .

The linear property deduced from the masks Γ i (i = 1, 2 or 3) must hold with a high probability on the both following quantities:

Γ i • S ′ (x) = Γ i • x and Γ i • z ⊕ Γ i • t = Γ i • (z ⊞ t)
for i=1,2 and 3, where S ′ is the transition function of the FSM in SNOW 2.0. In the case of SNOW 2.0, the hardest hypothesis to satisfy is the first one defined on y = S ′ (x). In the case of Sosemanuk, we need P r(Γ i • Trans(x) = Γ i • x) i=1,2,3 to be high. But, we also need that ∀i = 1, 2, 3, the relation

(Γ ′ i , Γ ′ i , Γ ′ i , Γ ′ i )•(x 1 , x 2 , x 3 , x 4 ) = Serpent1 ((Γ i , Γ i , Γ i , Γ i )•(x 1 , x 2 , x 3 , x 4 )) .
for some Γ ′ i ∈ F 32 2 , holds with a high probability. Due to the bitslice design chosen for Serpent1, it seems very difficult to find such a mask. Therefore, the attack described in [START_REF] Watanabe | A distinguishing attack of SNOW 2.0 with linear masking method[END_REF] could not be applied directly on Sosemanuk.

Algebraic attacks

Let us consider, as in [START_REF] Billet | Resistance of SNOW 2.0 against algebraic attacks[END_REF], the initial state of the LFSR at bit level:

(s 10 , • • • , s 1 ) = (s 31 10 , • • • , s 0 10 , • • • , s 31 1 , • • • , s 0 1 )
Then, the outputs of Sosemanuk at time t ≥ 1 could be written:

F t ((s 10 31 , • • • , s 1 0 )) = (z t , z t+1 , z t+2 , z t+3 )
where F is a vectorial Boolean function from F 320 2 into F 128 2 that could be seen as 128 Boolean functions F j , ∀j ∈ [0..127] from F 320 2 into F 2 . Let us study the degree of an F j function depending on a particular bit of the output or on a linear combination of output bits because it is not possible to directly compute the algebraic immunity of each function F j due to the very large number of variables (320 input bits). We think that the following remarks prevent the existence of low degree relations between the inputs and the outputs of F j .

-The output bit i after the modular addition on Z 2 32 is of degree i + 1 (as described in [START_REF] Braeken | The ANF of the composition of × and + mod 2 n with a Boolean function[END_REF]). -The output bit i after the Trans mapping is of degree i+1-7 mod 32, ∀i = 6 and equal to 32 for i = 6 (as described in [START_REF] Braeken | The ANF of the composition of × and + mod 2 n with a Boolean function[END_REF]).

-The mux operation does not enable to determine with probability one the exact number of bits of the initial state involved in the algebraic relation.

-The algebraic immunity of the SERPENT S-box S 2 at 4-bit word level is equal to 2 (see [START_REF] Meier | Algebraic attacks and decomposition of Boolean functions[END_REF] for a definition of the algebraic immunity and more details).

Under those remarks, we think that an algebraic attack against Sosemanuk is intractable.

Implementation

The reference C implementation is also an optimized implementation. When compiled with the SOSEMANUK_VECTOR macro defined, it is a full program (with its own main() function) which outputs two detailed test vectors. Since the LFSR length is ten, we unroll the C code on 20 rounds (see 3.2 for details); each test vector contains:

-A copy of the secret key (a sequence of bytes, expressed in hexadecimal). -The expanded secret key, as described by the SERPENT specification:

the key is expanded to 256 bits, then read as a 256-bit number with the little endian convention. The test vector outputs that key as a big hexadecimal number, with some digit grouping. -The 25 Serpent24 subkeys, each of them consisting of four 32-bit words (in the (K 3 , K 2 , K 1 , K 0 ) order). -The 128-bit IV, as a sequence of 16 bytes.

-The IV, once transformed into four 32-bit words, in the (I 3 , I 2 , I 1 , I 0 ) order. -The initial LFSR state (s 1 to s 10 , in that order).

-The initial FSM state (R1 0 and R2 0 ).

-Ten times the following data:

• -The total stream output (160 bytes).

Software implementation

This section is devoted to the software performance of Sosemanuk. It compares the performance of Sosemanuk with the other candidates selected in the Phase 3 (Software Profile), SNOW 2.0 and AES-CTR using the eSTREAM testing framework and the provided reference C implementations [START_REF] Cannière | estream optimized code HOWTO. eSTREAM, ECRYPT Stream Cipher Project[END_REF]. The three tables Table 1, Table 2 and Table 3 sum up the results (for the keystream generation, the IV setup and the key setup) given in [START_REF] Cannière | Software performance of the phase 3 candidates. eSTREAM, ECRYPT Stream Cipher Project[END_REF] for three different architectures: an Intel Pentium 4 (CISC target), an AMD Athlon64 X2 4200+ (CISC target) and an Alpha EV6 (RISC target).

All the results presented for Sosemanuk have been computed using the supplied reference C implementation.

Code size. The main unrolled loop implies a code size between 2 and 5 KB depending on the platform and the compiler. Therefore, the entire code fits in the L1 cache.

Static data. The reference C implementation uses static data tables with a total size equal to 4 KB. This amount is 3 times smaller than the size of static data required in SNOW 2.0, leading to a lower date cache pressure. Key setup. We recall that the key setup (the subkey generation given by Serpent24 ) is made once and that each new IV injection for a given key corresponds to a small version of the block cipher SERPENT.

The performance of the key setup and of the IV setup in Sosemanuk are directly derived from the performance of SERPENT [START_REF] Gladman | SERPENT performance[END_REF]. Due to intellectual property aspects, our reference implementation does not reuse the best implementation of SERPENT. However, the performance given in [START_REF] Matsui | How to maximize software performance of symmetric primitives on Pentiums[END_REF] (i.e., computed on the Gladman's code written in assembly language [START_REF] Gladman | SERPENT performance[END_REF]) leads to the following results on a Pentium 4:

key setup ≃ 900 cycles; -IV setup ≃ 480 cycles.

These estimations for the IV setup (resp. key setup) performance corresponds to about 3/4 of the best published performance for SERPENT encryption (resp. for SERPENT key schedule).

Table 1. Number of CPU cycles for the stream ciphers using a Pentium 4 at 2.80GHz, Model 15/2/9

As shown in these tables, Sosemanuk remains among the fastest algorithms on several platforms due to a good design for the mappings of data on the processor registers and a low data cache pressure.

Hardware implementation

In [START_REF] Good | Hardware results for selected stream cipher candidates[END_REF], the authors propose hardware implementations and performance metrics for several stream cipher candidates and especially Sosemanuk. They remark that even if the design of Sosemanuk is a little bit complex to implement, it leads to an impressive performance. The required number of gates for designing Sosemanuk on 0.13 µm Standard Cell CMOS with a key of length 256 bits is 18819 considering that 32 bits are outputted at each cycle. Moreover, the corresponding leakage power is 33.55 µW for a Table 3. Number of CPU cycles for the stream ciphers using an Alpha EV6 at 500MHz, Model 21264 total power at 10MHz equal to 812.47 µW. The authors also derive the metrics for maximum clock frequency and for an output rate at 10 Mbps (estimated typical future wireless LAN). In this last case, the corresponding clock frequency is equal to 0.313 MHz for a Power-Area-Time equal to 564.8 nJ-um2. In conclusion, they recommend Sosemanuk for WLAN applications with a key length equal to 256 bits. They say that "with regard to Sosemanuk, the utility as a hardware cipher is clear thus in our opinion requires adding to the hardware focus profile."

The new synchronous stream cipher Sosemanuk based upon the SNOW 2.0 design improves it from several points of view. From a security point of view, Sosemanuk avoids some potential weaknesses as the distinguishing attack proposed in [START_REF] Watanabe | A distinguishing attack of SNOW 2.0 with linear masking method[END_REF] due to the particular use of Serpent1 in bitslice mode. The chosen LFSR is designed to eliminate all potential weaknesses (particular decimation properties, linear relations,...). The mappings used in the Finite State Machine have been carefully designed in the following way:

-The Trans function guarantees good properties of confusion and diffusion for a low cost in software. Moreover, this mapping prevents Sosemanuk from algebraic attacks. -The mux operation, that could be efficiently implemented, protects Sosemanuk from fast correlation attacks and algebraic attacks.

The Serpent1 output transformation, very efficient in bitslice mode, provides nonlinear equations, a good diffusion and it improves the resistance to guess-and-determine attacks.

The new design chosen for the key setup and the IV injection allows to split the initialization procedure into two distinct parts, without any loss of security. It leads to a much faster resynchronization mechanism.

From an efficiency point of view, due to a reduced amount of static data and a reduced internal state size, the exploitation of the processor registers is enhanced and the data cache pressure is improved on several platforms, especially on RISC architectures.

Fig. 1 .

 1 Fig. 1. The LFSR

  1 , R2 1 and f 1 are computed from R1 0 , R2 0 , s 2 , s 9 and s 10 . -The first step produces the buffered intermediate values s 1 and f 1 . -During the first step, the feedback word s 11 is computed from s 10 , s 4 and s 1 , and the internal state of the LFSR is updated, leading to a new state composed of s 2 to s 11 . -The first four output values are z 1 , z 2 , z 3 and z 4 , and are computed using one application of Serpent1 over (f 4 , f 3 , f 2 , f 1 ), whose output is combined by XORs with (s 4 , s 3 , s 2 , s 1 ).

	Trans
	s t
	Trans
	s t+1
	Trans
	s t+2
	Trans

  Four times the following: * the new FSM state (R1 t and R2 t ); * the new LFSR state, after the update (the dropped value s t is also output); * the intermediate output f t . • The Serpent1 input. • The Serpent1 output. • 16 bytes of Sosemanuk output.

Acknowledgments The authors would like to thank Matt Robshaw for valuable comments.

Note that this work was done while the 4th author was affiliated to Axalto/Gemalto (France), the 7th and the 12th authors were affiliated to France Télécom R&D/Orange Labs (France), the 8th author was affiliated to the École Normale Supérieure (France), the 10th author was affiliated to INRIA Rocquencourt (France).

⋆ Work partially supported by the French Ministry of Research RNRT Project "X-CRYPT" and by the European Commission via ECRYPT network of excellence IST-2002-507932.

A Specifications of SERPENT

In this appendix, a recall on the specifications of SERPENT given in [START_REF] Biham | SERPENT: A new block cipher proposal[END_REF] is made. First, the S-boxes definition is given and the linear part is also defined again.

A.1 S-boxes definitions

The eight SERPENT S-boxes act on 4-bit words and are defined as permutations of Z 16 : S0 : 3, 8, 15, 1, 10, 6, 5, 11, 14, 13, 4, 2, 7, 0, 9, 12 S1 : 15, 12, 2, 7, 9, 0, 5, 10, 1, 11, 14, 8, 6, 13, 3, 4 S2 : 8, 6, 7, 9, 3, 12, 10, 15, 13, 1, 14, 4, 0, 11, 5, 2 S3 : 0, 15, 11, 8, 12, 9, 6, 3, 13, 1, 2, 4, 10, 7, 5, 14 S4 : 1, 15, 8, 3, 12, 0, 11, 6, 2, 5, 4, 10, 9, 14, 7, 13 S5 : 15, 5, 2, 11, 4, 10, 9, 12, 0, 3, 14, 8, 13, 6, 7, 1 S6 : 7, 2, 12, 5, 8, 4, 6, 11, 14, 9, 1, 15, 13, 3, 10, 0 S7 : 1, 13, 15, 0, 14, 8, 2, 11, 7, 4, 12, 10, 9, 3, 5, 6

A.2 Linear part of SERPENT round function

The linear part of a one round version of SERPENT acts on 4 32-bit words (X 3 , X 2 , X 1 , X 0 ) where X 0 is the least significant word and is defined as follows: