a low data complexity attack on the gmr 2 cipher used in
play

A Low Data Complexity Attack on the GMR-2 Cipher Used in the - PowerPoint PPT Presentation

Mar 13, 2023 •311 likes •770 views

A Low Data Complexity Attack on the GMR-2 Cipher Used in the Satellite Phones Ruilin Li, Heng Li, Chao Li, Bing Sun National University of Defense Technology, Changsha, China FSE 2013, Singapore 11 th ~13 th March, 2013 Outline

  1. A Low Data Complexity Attack on the GMR-2 Cipher Used in the Satellite Phones Ruilin Li, Heng Li, Chao Li, Bing Sun National University of Defense Technology, Changsha, China FSE 2013, Singapore 11 th ~13 th March, 2013

  2. Outline • Backgrounds and the GMR-2 Cipher • Revisit the Component of the GMR-2 Cipher • The Low Data Complexity Attack • Experimental Result • Conclusion 2

  3. Outline • Backgrounds and the GMR-2 Cipher • Revisit each Component of the GMR-2 Cipher • The Low Data Complexity Attack • Experimental Result • Conclusion 3

  4. Backgrounds and the GMR-2 Cipher • Mobile communication systems have revolutionized the way we interact with each other – GSM, UMTS, CDMA2000, 3GPP LTE • When do we need satellite based mobile system? – In some special cases • researchers on a field trip in a desert • crew on ships on open sea • people living in remote areas or areas that are affected by a natural disaster 4

  5. Backgrounds and the GMR-2 Cipher • What is GMR? – GMR stands for GEO-Mobile Radio – GEO stands for Geostationary Earth Orbit – Design heavily inspired from GSM 5

  6. Backgrounds and the GMR-2 Cipher • Two major GMR Standards – GMR-1 (de-facto standard, Thuraya etc) – GMR-2 (Inmarsat and AcES) • How to protect the security of the communication in GMR system? – Using symmetric cryptography – Both the authentication and encryption are similar as that of GSM A3/A5 algorithms. 6

  7. Backgrounds and the GMR-2 Cipher • Encryption Algorithms in GMR – Stream ciphers – Reconstructed by Driessen et al. • GMR-1 Cipher – Based on A5/2 of GSM – Totally broken by ciphertext-only attack • GMR-2 Cipher – New design strategy – Can be broken by known-plaintext attack – Read-collision based technique 7

  8. Backgrounds and the GMR-2 Cipher • In this talk, we focus on GMR-2 stream cipher – Revisit components of the GMR-2 cipher – Propose dynamic guess and determine strategy – Present a low data complexity attack 8

  9. Outline • Backgrounds and the GMR-2 Cipher • Revisit each Component of the GMR-2 Cipher • The Low Data Complexity Attack • Experimental Result • Conclusion 9

  10. Revisit each Component of the GMR-2 Cipher • Encryption mechanism of the GMR-2 cipher – Data are divided into frames identified by the frame number with 22-bits – New frame is re-initialized – Each frame contains 120-bit (15-byte) • Parameters of the GMR-2 cipher – Key length: 64-bit (Session key) – IV length: 22-bit (Frame number) – Key stream bits length within a frame: 120-bit 10

  11. Revisit each Component of the GMR-2 Cipher K t 1 G 6 H Z l F 8 c 8 6 3 4 s 7 s 6 s 1 s 0 …… 8 p • An overview on the GMR-2 cipher – 8-byte shift register S , a 3-bit counter c , and a toggle bit t – byte-oriented, three major components – combines two bytes of session key with previous output F – is a linear function for mixing purpose G – consists two DES Sboxes as a nonlinear filter H 11

  12. Revisit each Component of the GMR-2 Cipher K t t O 0 >>> 2 8 a t Å O 1 K 0 K 1 K 2 K 3 K 4 K 5 K 6 K 7 1 4 c 4 4 Å 8 p F • The component – At the l -th clock, the input • 8-byte array holding the session key K , read from two sides. • a counter c ranging from 0 to 7 sequentially and repeatedly. • a toggle bit t=c mod 2. • the previous key stream byte p=Z l - 1 12

  13. Revisit each Component of the GMR-2 Cipher K t t O 0 >>> 2 8 a t Å O 1 K 0 K 1 K 2 K 3 K 4 K 5 K 6 K 7 1 4 c 4 4 Å 8 p F • The component – The lower side outputs K c with the help of the counter c . – The upper output depends on the lower output K c , the previous key stream byte p and the toggle bit t . t – maps 4-bit to 3-bit which select the upper output. 1 t – maps 3-bit to 3-bit which determine the rotation. 13 2

  14. Revisit each Component of the GMR-2 Cipher K t t O 0 >>> 2 8 a t Å O 1 K 0 K 1 K 2 K 3 K 4 K 5 K 6 K 7 1 4 c 4 4 Å 8 p F • The component – The output is = • t t a ì ï O K ( ( )) t a 0 ( ) 2 1 í 1 = Å Å Å ï ? î O ((( K p ) 4) & 0xF) (( K p ) & 0xF) 1 c c Å = ì ( K p ) &0xF, if t 0 a = í c Å = ? î 14 (( K p ) 4) &0xF, if t 1 c

  15. Revisit each Component of the GMR-2 Cipher B O ¢ 1 0 O 0 6 8 B 1 O 1 B Å 3 4 B 2 O ¢ 1 8 B 6 2 S 0 G • The component Å Å Å ì a :( , , , ) ( , , , ); B x x x x x x x x x x x 1 3 2 1 0 3 0 3 2 0 3 1 ï a í B :( , x x x x , , ) ( , x x , x , x ); 2 3 2 1 0 1 3 0 2 ï Å Å Å a î B :( , x x x x , , ) ( , x x , x x x , x x ). 3 3 2 1 0 2 0 3 1 0 3 0 15

  16. Revisit each Component of the GMR-2 Cipher t S O ¢ Z 2 4 0 6 l 8 S O ¢ 6 1 4 6 H • The component ¢ ¢ S S = ì ( ( O ), ( O )) if t 0 = 2 1 6 0 8 í Z ¢ ¢ S S = l î ( ( O ), ( O )) if t 1 2 0 6 1 8 S S where and are the two sboxes of DES.Assume the input of 2 6 S is ( x x , , x x , , x x , ), then ( x x , ) selects the row index, and 5 4 3 2 1 0 1 0 16 ( x x , , x x , ) selects the column index. 5 4 3 2

  17. Revisit each Component of the GMR-2 Cipher G H F • Initialization Mode – Set c=0, t=0, and initialize S with frame number N F – 8-byte key is written into the resister in – Clock the cipher 8 times and discard the output Z l 17

  18. Revisit each Component of the GMR-2 Cipher G H F • Generation Mode – For each frame number N , further clock the cipher 15 times, and the output keystream is ¢ = L L L (0) (0) (0) (1) (1) (1) (2) Z ( Z , Z , , Z ; Z , Z , Z ; Z , ) 0 1 14 0 1 14 0 ( N ) Z denotes the l -th byte of keystream generated after l 18 initialization with N

  19. Revisit each Component of the GMR-2 Cipher F • Property of Å = ì ( K p )&0xF, if t 0 a = í c Å = ? î (( ) 4)&0xF, if 1 K p t c a – If p is known, then we can get the value of only by the most/least significant four bits of K c K t t O 0 >>> 2 8 a t Å O 1 K 0 K 1 K 2 K 3 K 4 K 5 K 6 K 7 1 4 c 4 4 Å 19 8 p

  20. Revisit each Component of the GMR-2 Cipher H • Property of S 2 / S – We can “invert ” 6 • Given the row index and the output, the column index can be uniquely obtained. • Given the column index and the output, the row index can be S uniquely obtained, except for when the column index is 4 and 6 the output is 9, the row index can be either 0 or 3. • Given the outputs of both S-boxes, there will be 16 possible inputs. S O ¢ Z 2 0 l S O ¢ 6 1 20

  21. Revisit each Component of the GMR-2 Cipher G • Property of – The key point G – The links between the input and output of the component can be expressed by a well-structured matrix B O ¢ 1 O 0 0 6 8 B 1 O 1 B Å 3 4 B 2 O ¢ 1 8 B 6 2 21 S 0

  22. æ ö ' O æ ö ç 0 , 5 ÷ O æ ö S é ù ç 0 , 7 ÷ 1 0 0 1 0 0 0 0 0 0 0 0 ç ÷ 0 , 5 ç ÷ ' O ê ú ç ÷ 0 , 4 O ç ÷ ç ÷ S 0 1 0 0 0 0 0 0 0 0 0 , 6 1 1 ê ú ç 0 , 7 ÷ ç ' ÷ ç ÷ O O ê ú ç 0 , 3 1 0 0 0 0 0 0 0 0 0 0 0 ÷ S ç ÷ ç ÷ 0 , 5 0 , 4 ê ú ç ÷ ' ç ÷ O ç ÷ O 0 0 1 0 0 0 0 0 0 0 0 0 S 0 , 2 ê ú ç ÷ 0 , 4 ç ÷ ç ÷ 0 , 6 ê ú ç ' ÷ O 0 0 0 0 1 0 0 1 0 0 0 0 ç ÷ O ç ÷ S 1, 5 ê ú ç 0 , 3 ÷ 0 ,1 ç ÷ ç ÷ 0 0 0 0 1 1 0 1 0 0 0 0 ' ê ú ç O O ÷ ç ÷ = S ç ÷ 1, 4 0 , 2 Å ç g 0 , 3 ê ú ç ÷ ç ÷ ÷ ' 0 0 0 0 1 0 0 0 0 0 0 0 O O ê ú S ç ÷ ç ÷ 0 ,1 ç ÷ 1, 3 0 , 0 ê ú ç ÷ ç ÷ 0 0 0 0 0 0 1 0 0 0 0 0 ç ÷ O ' O S ê 1 0 1 1 ú ç 0 , 0 ÷ ç 1, 2 ÷ 0 , 2 ç ÷ ê 0 0 0 0 0 0 0 0 ú ç ÷ O ç ÷ ç ÷ ' 0 O 1, 3 ê ú ç ÷ 0 ,1 0 0 0 0 0 0 0 0 1 0 0 1 ç ÷ ç ÷ ê ú ç O 0 ÷ ç ' ÷ ç ÷ O 1, 2 0 0 0 0 0 0 0 0 0 1 0 0 ê ú ç 0 , 0 ÷ ç ÷ ç ÷ 0 O ê ú ' ç ÷ 1,1 ç O ÷ ç ÷ 0 0 0 0 0 0 0 0 0 0 0 1 ë û ç ÷ 1,1 è ø 0 ç ÷ è O ø 1, 0 ' è O ø 1, 0 22

Recommend

Cryptanalysis of PRINT CIPHER : The Invariant Subspace Attack Gregor Leander, Mohamed

Cryptanalysis of PRINT CIPHER : The Invariant Subspace Attack Gregor Leander, Mohamed

Description of PRINT CIPHER The Attack Relation To Truncated Differential Attack Conclusion Cryptanalysis of PRINT CIPHER : The Invariant Subspace Attack Gregor Leander, Mohamed Abdelraheem, Huda AlKhzaimi, and Erik Zenner DTU Mathematics

598 views • 37 slides
CS 241 Data Organization Ciphers March 22, 2018 Cipher In cryptography, a cipher (or

CS 241 Data Organization Ciphers March 22, 2018 Cipher In cryptography, a cipher (or

CS 241 Data Organization Ciphers March 22, 2018 Cipher In cryptography, a cipher (or cypher) is an algorithm for performing encryption or decryption. When using a cipher, the original information is known as plaintext , and the

449 views • 41 slides
Experimentally Verifying a Complex Algebraic Attack on the Grain-128 Cipher Using Dedicated

Experimentally Verifying a Complex Algebraic Attack on the Grain-128 Cipher Using Dedicated

Experimentally Verifying a Complex Algebraic Attack on the Grain-128 Cipher Using Dedicated Reconfigurable Hardware SHARCS 2012 Washington D.C. Itai Dinur 1 , Tim Gneysu 2 , Christof Paar 2 , Adi Shamir 1 , and Ralf Zimmermann 2 1

754 views • 58 slides
Block Cipher Cryptanalysis II: Block Cipher Cryptanalysis II: Linear Cryptanalysis yp y Andrey

Block Cipher Cryptanalysis II: Block Cipher Cryptanalysis II: Linear Cryptanalysis yp y Andrey

Block Cipher Cryptanalysis II: Block Cipher Cryptanalysis II: Linear Cryptanalysis yp y Andrey Bogdanov Andrey Bogdanov K.U.Leuven, ESAT/COSIC Outline Outline Distribution of Correlation Data Complexity Linear Hulls Zero

659 views • 30 slides
Problem 1 k zero bits n bits IV Block Block Block Block Cipher Cipher Cipher Cipher

Problem 1 k zero bits n bits IV Block Block Block Block Cipher Cipher Cipher Cipher

Problem 1 k zero bits n bits IV Block Block Block Block Cipher Cipher Cipher Cipher removed January 27, 2011 Practical Aspects of Modern Cryptography 2 Problem 1 IV Inverse Inverse Inverse Inverse Cipher Cipher Cipher Cipher

464 views • 20 slides
Block Ciphers Chester Rebeiro IIT Madras CR STINSON : chapters 3 Block Cipher K D K E

Block Ciphers Chester Rebeiro IIT Madras CR STINSON : chapters 3 Block Cipher K D K E

Block Ciphers Chester Rebeiro IIT Madras CR STINSON : chapters 3 Block Cipher K D K E untrusted communication link Alice Bob E D #%AR3Xf34^$ Attack at Dawn!! decryption encryption (ciphertext) message message Attack at

1.56k views • 143 slides
Practical Attack on 8 Rounds of the Lightweight Block Cipher KLEIN Jean-Philippe Aumasson NAGRA,

Practical Attack on 8 Rounds of the Lightweight Block Cipher KLEIN Jean-Philippe Aumasson NAGRA,

Practical Attack on 8 Rounds of the Lightweight Block Cipher KLEIN Jean-Philippe Aumasson NAGRA, Switzerland - Mara Naya-Plasencia FHNW, Windisch, Switzerland and University of Versailles, France - Markku-Juhani O. Saarinen Revere

263 views • 15 slides
Automatic Synthesis of Fault Attack Resistant Cipher Implementations Chester Rebeiro IIT Madras

Automatic Synthesis of Fault Attack Resistant Cipher Implementations Chester Rebeiro IIT Madras

Automatic Synthesis of Fault Attack Resistant Cipher Implementations Chester Rebeiro IIT Madras Side Channel Analysis Electro magnetic Radiation Fault injection Power consumption Timing channels Preventing Side Channel Attacks is

468 views • 34 slides
FSE 2013 Near Collision Attack on the Grain v1 Stream Cipher Bin Zhang and Zhenqi Li

FSE 2013 Near Collision Attack on the Grain v1 Stream Cipher Bin Zhang and Zhenqi Li

FSE 2013 Near Collision Attack on the Grain v1 Stream Cipher Bin Zhang and Zhenqi Li Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100093, China. Institute of Software, Chinese Academy of Sciences,

1.08k views • 97 slides
Vigenre Cipher Like Csar cipher, but use a phrase Example Message THE BOY HAS THE

Vigenre Cipher Like Csar cipher, but use a phrase Example Message THE BOY HAS THE

Vigenre Cipher Like Csar cipher, but use a phrase Example Message THE BOY HAS THE BALL Key VIG Encipher using Csar cipher for each letter: key VIGVIGVIGVIGVIGV plain THEBOYHASTHEBALL cipher OPKWWECIYOPKWIRG May

304 views • 26 slides
Reverse Engineering of a Secret AES-like Cipher by Ineffective Fault Analysis Antoine Wurcker

Reverse Engineering of a Secret AES-like Cipher by Ineffective Fault Analysis Antoine Wurcker

Introduction Scope of the Attack Attack Steps Conclusion Reverse Engineering of a Secret AES-like Cipher by Ineffective Fault Analysis Antoine Wurcker Christophe Clavier antoine.wurcker@xlim.fr christophe.clavier@unilim.fr Universit e

535 views • 51 slides
Caesar Cipher If he had anything confidential to say, he wrote it in cipher, that is, by so

Caesar Cipher If he had anything confidential to say, he wrote it in cipher, that is, by so

Caesar Cipher If he had anything confidential to say, he wrote it in cipher, that is, by so changing the order of the letters of the alphabet, that not a word could be made out. If anyone wishes to decipher these, and get at their meaning, he

1.03k views • 5 slides
Fast Near Collision Attack on the Grain v1 Stream Cipher Bin Zhang , Chao Xu and Willi

Fast Near Collision Attack on the Grain v1 Stream Cipher Bin Zhang , Chao Xu and Willi

Fast Near Collision Attack on the Grain v1 Stream Cipher Bin Zhang , Chao Xu and Willi Meier Chinese Academy of Sciences FHNW,Switzerland 02-05-2018 Bin Zhang , Chao Xu and Willi Meier ( Chinese Academy

596 views • 48 slides
Complexity, Big Data Science, and Complexity Introduction Happiness Emergence Universality

Complexity, Big Data Science, and Complexity Introduction Happiness Emergence Universality

Complexity, Big Data Science, and Happiness Complexity, Big Data Science, and Complexity Introduction Happiness Emergence Universality Symmetry Breaking Discrete Days, St. Michaels College, 2011 The Big Theory Revolution: Big Data

910 views • 74 slides
Classical Ciphers Playfair Cipher Polyalphabetic Ciphers Cryptography Vigen` ere Cipher

Classical Ciphers Playfair Cipher Polyalphabetic Ciphers Cryptography Vigen` ere Cipher

Cryptography Classical Ciphers Caesar Cipher Monoalphabetic Ciphers Classical Ciphers Playfair Cipher Polyalphabetic Ciphers Cryptography Vigen` ere Cipher Vernam Cipher School of Engineering and Technology One Time Pad CQUniversity

1.02k views • 64 slides
Classical Ciphers Playfair Cipher Polyalphabetic Ciphers Cryptography Vigen` ere Cipher

Classical Ciphers Playfair Cipher Polyalphabetic Ciphers Cryptography Vigen` ere Cipher

Cryptography Classical Ciphers Caesar Cipher Monoalphabetic Ciphers Classical Ciphers Playfair Cipher Polyalphabetic Ciphers Cryptography Vigen` ere Cipher Vernam Cipher One Time Pad School of Engineering and Technology CQUniversity

687 views • 64 slides
Tweakable Block Cipher Secure Beyond the Birthday Bound in the Ideal Cipher Model Jooyoung Lee ,

Tweakable Block Cipher Secure Beyond the Birthday Bound in the Ideal Cipher Model Jooyoung Lee ,

Tweakable Block Cipher Secure Beyond the Birthday Bound in the Ideal Cipher Model Jooyoung Lee , Byeonghak Lee KAIST Tweakable Block Cipher A tweakable block cipher accepts an additional input "tweak - Tweaks are publicly used

519 views • 30 slides
Russian Workshop on Complexity and Model Theory, Russian Workshop on Complexity and Model Theory,

Russian Workshop on Complexity and Model Theory, Russian Workshop on Complexity and Model Theory,

THE LINEAR DECOMPOSITION ATTACK THE NONLINEAR DECOMPOSITION ATTACK Russian Workshop on Complexity and Model Theory, Russian Workshop on Complexity and Model Theory, Algebraic cryptology: methods of cryptanalysis via (non)linear decomposition

699 views • 30 slides
Complexity Attack Resistant Flow Lookup Schemes for IPv6: A Measurement Based Comparison David

Complexity Attack Resistant Flow Lookup Schemes for IPv6: A Measurement Based Comparison David

Complexity Attack Resistant Flow Lookup Schemes for IPv6: A Measurement Based Comparison David Malone and Josh Tobin. 2008-12-11 1 Hash Table Lookup scheme to avoid cost of searching full list. carrot zuchinni . . . . . . apricot apple

406 views • 16 slides
A Surfeit of SSH Cipher Suites Martin R. Albrecht, Jean Paul Degabriele, Torben B. Hansen and

A Surfeit of SSH Cipher Suites Martin R. Albrecht, Jean Paul Degabriele, Torben B. Hansen and

A Surfeit of SSH Cipher Suites Martin R. Albrecht, Jean Paul Degabriele, Torben B. Hansen and Kenneth G. Paterson ACM CCS - 27/10/2016 Outline of this talk Overview of SSH and related work. SSH deployment statistics. A new attack on

356 views • 25 slides
Extending the Hill Cipher Two secure modifications of the classic cipher John Chase Matt Davis

Extending the Hill Cipher Two secure modifications of the classic cipher John Chase Matt Davis

Introduction SVK Hill Cipher TF Hill Cipher Summary Extending the Hill Cipher Two secure modifications of the classic cipher John Chase Matt Davis Cryptography 625.480 December 2, 2010 / Final Paper Presentation Introduction SVK Hill

1.31k views • 90 slides
Comparison of Cipher implementations from cipher authors 256-bit stream ciphers D. J.

Comparison of Cipher implementations from cipher authors 256-bit stream ciphers D. J.

Comparison of Cipher implementations from cipher authors 256-bit stream ciphers D. J. Bernstein Timing tools Thanks to: (De Canni` ere) University of Illinois at Chicago Denmark Technical University

602 views • 13 slides
Data Streams & Communication Complexity Lecture 3: Communication Complexity and Lower Bounds

Data Streams & Communication Complexity Lecture 3: Communication Complexity and Lower Bounds

Data Streams & Communication Complexity Lecture 3: Communication Complexity and Lower Bounds Andrew McGregor, UMass Amherst 1/23 Basic Communication Complexity Three friends Alice, Bob, and Charlie each have some information x , y , z

1.11k views • 98 slides
Vigenre Cipher - a polyalphabetic version of the shift cipher Key: (k 1 ,k 2 ,,k m ) Z

Vigenre Cipher - a polyalphabetic version of the shift cipher Key: (k 1 ,k 2 ,,k m ) Z

Vigenre Cipher - a polyalphabetic version of the shift cipher Key: (k 1 ,k 2 ,,k m ) Z 26m , where m is the key length Encryption in blocks: (x 1 , x 2 , , x m ) (x 1 +k 1 , x 2 +k 2 , , x m +k m ) Z 26m Example: encrypt

413 views • 10 slides

More recommend