AEGIS

an authenticated stream cipher

is one of fifteen third-round candidates of CAESAR competition (Competition for Authenticated Encryption: Security

Applicability

and Robustness). Three AEGIS versions: AEGIS-128、AEGIS-256 and AEGIS-128L are recommended in different internal state and key sizes. This paper proposes two types of weak state for AEGIS-256 and AEGIS-128L respectively. The probabilities of these types of weak state are greater than the existing results. And based on those analyses

a forgery attack on AEGIS-256 is introduced. Indeed

we present internal states with the corresponding plaintexts

in which the tags are 0. As for AEGIS-128L

we attain the information leakage of encryption. Finally

we give brief analysis of what is responsible for weak states. To the best of our knowledge

except for design document

there is no cryptanalysis on weak state of AEGIS proposed until now. Therefore

our work is significant for CAESAR competition.