General  

Designers  Dai Watanabe, Soichi Furuya, Kazuo Takaragi, Bart Preneel 
First published  February 2002 
Derived from  Panama 
Certification  CRYPTREC 
Cipher detail  
Key sizes  128 bits 
State size  1216 bits 
Rounds  32 
In cryptography, MUGI is a pseudorandom number generator (PRNG) designed for use as a stream cipher. It has been recommended for Japanese government use by the CRYPTREC project.
MUGI takes a 128bit secret key and a 128bit initial vector (IV). After a key and IV setup process, MUGI outputs 64bit output strings based on the internal state, while updating the internal state after each output block. MUGI has a 1216bit internal state; there are three 64bit registers (the "state") and 16 64bit registers (the "buffer").
MUGI uses the nonlinear Sbox that was originally defined in Advanced Encryption Standard (AES). A part of the linear transformation also reuses the MDS matrix of AES. The basic design is influenced by that of Panama.
As of September 2006, there are no known attacks against MUGI that are faster than serial bruteforce of the key space or of the internal state.
In the paper, "A weakness of the linear part of stream cipher MUGI", by GOLIC Jovan Dj, Roy Bimal and Meier Willi, the abstract claims: "The linearly updated component of the stream cipher MUGI, called the buffer, is analyzed theoretically by using the generating function method. In particular, it is proven that the intrinsic response of the buffer, without the feedback from the nonlinearly updated component, consists of binary linear recurring sequences with small linear complexity 32 and with extremely small period 48. It is then shown how this weakness can in principle be used to facilitate the linear cryptanalysis of MUGI with two main objectives: to reconstruct the secret key and to find linear statistical distinguishers."
In the paper, "Analysis of the Nonlinear Part of Mugi" by Alex Biryukov and Adi Shamir, the abstract claims: "This paper presents the results of a preliminary analysis of the stream cipher Mugi. We study the nonlinear component of this cipher and identify several potential weaknesses in its design. While we can not break the full Mugi design, we show that it is extremely sensitive to small variations. For example, it is possible to recover the full 1216bit state of the cipher and the original 128bit secret key using just 56 words of known stream and in 2^{14} steps of analysis if the cipher outputs any state word which is different than the one used in the actual design. If the linear part is eliminated from the design, then the secret nonlinear 192bit state can be recovered given only three output words and in just 2^{32} steps. If it is kept in the design but in a simplified form, then the scheme can be broken by an attack which is slightly faster than exhaustive search."

