'Sandwich attack' busts new cellphone crypto
Kasumi cipher cracked (in theory)
A new encryption scheme for protecting 3G phone networks hasn't even gone into commercial use and already cryptographers have cracked it - at least theoretically.
In a paper published Tuesday, the cryptographers showed that the Kasumi cipher, which is also referred to as A5/3, can be broken using what's known as a related-key attack, in which a message encrypted with one key is later changed to one or more different keys. The team dubbed the technique a sandwich attack because it was broken into three parts: two thick slices at the top and bottom and a thin slice in the middle.
"By using this distinguisher and analyzing the single remaining round, we can derive the complete 128 bit key of the full Kasumi by using only 4 related keys, 226 data, 230 bytes of memory, and 232 time," they wrote. "These complexities are so small that we have actually simulated the attack in less than two hours on a single PC, and experimentally verified its correctness and complexity."
The results come two weeks after a separate team released a practical method for cracking A5/1, the cipher currently used to prevent snooping on GSM networks. The technique relies on about $4,000 worth of equipment and requires the capture of only a few minutes worth of an encrypted conversation in order to break it. The attack exploits weaknesses in the decades-old cipher.
The GSM Association, which represents about 800 cellular carriers in 219 countries, has vowed to switch to the much more modern A5/3 cipher, but so far, it has provided no time line for doing so.
By contrast, the exploit against A5/3 is much less practical, because it requires an attacker to collect "several million known plaintexts" in order to deduce the key that encrypts a conversation, said Karsten Nohl, a cryptography expert and researcher at the University of Virginia. During a typical call, such plaintexts are transmitted every second or so. Still, he said the research is important because it shows the realistic limitations of the cipher.
"The attack should stand as a reminder that A5/3 and any other cipher will need to be replaced eventually," he told The Register. "Hopefully this fact is considered when upgrading GSM."
Nohl's comments are particularly poignant since the attack, limited as it may be, exploits weaknesses in the algorithm itself, rather than ways the algorithm is implemented.
The paper was published by Orr Dunkelman, Nathan Keller, and Adi Shamir, the last researcher being the S in the widely used RSA public-key encryption algorithm. They are faculty members with the Mathematics and Computer Science at the Weizmann Institute of Science in Israel. A PDF of the paper is here. ®
Well, for computer science studies of algorithms you've got in terms of program runtime O(n) (linear), O(n^2) O(n^3) (cubic time), O(log(n)) etc. For theoretical work you don't worry about n, if there's a n^3 algorithm for doing something you try to find a way to do it that's n^2 or n instead.. So iit takes 2^32 runs through an algoirthm that takes time n. Yeah, if the algorithm takes 1000 cycles it would run 1,000,000 times a second at 1ghz, "n" would be 1 microsecond... Faster CPUs would cut the time. Pipeline stalls and inefficiencies can drop a CPU well under 1 instruction per cycle, slowing things down. Optimizations could cut the run time a lot (both the compiler variety and "hand-optimized assembly" variety), conversely if the algorithm's really complex it could take well over 1000 cycles. So 0.1-50 microseconds or so would be my guesstimate on a likely range.
At 1 microsecond per run it'd take about an hour and 10 minutes. , it needs 64MB of data and 1GB of RAM.
Errrm. What units of time? I am guessing not 2^32 seconds as that works out at about 136 years. Microseconds maybe? Or maybe I am just being thick and missed something?
Is he also the guy who heads the company that supply the crypto for Sky Digital?
Angling for a contract for the replacement?
But note 2^38 plaintexts? That sounds like *quite* a lot.