NSC-128: A MUGI-Type Stream Cipher with an Invertible Nonlinear Buffer Update and MILP-Based Security Bounds

MUGI, a keystream generator in ISO/IEC 18033-4, updates its sixteen-word buffer linearly, and this part has been the main target of its cryptanalysis. We study NSC-128, a MUGI-type generator with a 128-bit key whose buffer update passes fifteen words through an F-function built on the Kuznyechik S-box. Analysis of a draft showed that its initialisation, like MUGI’s, keeps the XOR of the state words invariant with probability one while the buffer is zero, and that its round function was not injective. The revised design removes both; its round function is a permutation. Using byte-level mixed-integer linear programming, a segment argument based on this property and an exact treatment of the two F-calls that share their input, we show that chosen-IV and related-key differential characteristics have probability at most 2−130, that IV-to-keystream linear trails have squared correlation at most 2−151, and that every keystream-only linear trail has at least 46 active S-boxes. Avalanche and NIST SP 800-22 tests on the full cipher show no deviation from randomness; with reduced initialisation, cube distinguishers exist up to three of the 32 iterations that follow IV loading. With 17 F-evaluations per output word, NSC-128 is about four times slower than MUGI in software.