New mobile phone algorithms a real world story Steve Babbage - PowerPoint PPT Presentation

New mobile phone algorithms – a real world story Steve Babbage Vodafone Group R&D 17 February 2011 1 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

Standards groups 2 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

First generation 3 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

GSM security architecture Visited Home network network SIM Authentication RAND and cipher key generation algorithm K i AKA A3/A8 XRES K C RAND, XRES, K C RAND RAND K i AKA RES RES K C Encryption RES = XRES? algorithm K C A5 ENCRYPT USING K C 4 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

GSM security limitations > Key length > One-way authentication > Unprotected signalling > A5/1, A5/2 5 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

UMTS security architecture (slightly simplified) Visited Home network network SIM Authentication RAND SQN and key agreement K AKA algorithm f1 – f5 RAND SQN XRES CK RAND, XRES, CK, K AKA MAC IK IK, SQN, MAC RAND, SQN, MAC XRES CK MAC IK RES RES = XRES? Check SQN Check MAC CK, IK Encryption algorithm UEA, integrity algorithm UIA ENCRYPT USING CK INTEGRITY PROTECT USING IK 6 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

First UMTS algorithms, UEA1 / UIA1 KASUMI KASUMI KASUMI (CK  ) (CK  ) (CK  ) BLKCTR = 1 BLKCTR = 1 BLKCTR = 2 BLKCTR = 2 BLKCTR = n BLKCTR = n A A BLKCTR = 0 BLKCTR = 0 A5/3 ≈ UEA1 (but 64-bit key) KASUMI KASUMI KASUMI KASUMI KASUMI KASUMI KASUMI KASUMI KASUMI KASUMI KASUMI KASUMI (CK) (CK) (CK) (CK) (CK) (CK) (CK) (CK) (CK) (CK) (CK) (CK) First 64 bits Second 64 bits Third 64 bits Last 64 bits KASUMI KASUMI KASUMI KASUMI KASUMI KASUMI KASUMI KASUMI (IK) (IK) (IK) (IK) (IK) (IK) (IK) (IK) KASUMI KASUMI (IK  ) (IK  ) MAC (left 32 bits) 7 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

So now we can replace A5/1 with A5/3 … Image from http://www.elkomas.lt/ 8 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

Second UMTS algorithms, UEA2 / UIA2 > SNOW 3G – Why not AES? – Why not SNOW 2.0? 9 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

LTE security architecture (part 1) Visited Home network network SIM Authentication RAND SQN and key agreement K AKA algorithm f1 – f5 RAND SQN XRES CK RAND, XRES, CK, IK, K AKA MAC IK SQN, MAC, K ASME RAND, SQN, MAC XRES CK PLMN ID MAC IK RES RES = XRES? Check SQN Check MAC CK, IK K ASME PLMN ID K ASME 10 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

GSM security limitations > Key length > One-way authentication > Unprotected signalling > A5/1, A5/2 > Same key regardless of algorithm choice 11 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

LTE security architecture (part 2) Visited Home network network SIM K ASME K ASME ALG ID ALG ID MOBILITY K α K α SIGNALLING: ALG ID ALG ID ENCRYPT USING K α INTEGRITY PROTECT K β K β USING K β ALG ID ALG ID RADIO RESOURCE Encryption K γ K γ SIGNALLING: algorithm EEA, ALG ID ENCRYPT USING K γ integrity ALG ID INTEGRITY PROTECT algorithm EIA K δ K δ USING K δ ALG ID ALG ID USER PLANE: K ε K ε ENCRYPT USING K ε 12 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

Original LTE algorithms (from day one) > Based on SNOW-3G – 128-EEA1: straightforward stream cipher use – 128-EIA1: polynomial evaluation UHF – Identical to UMTS algorithms > Could have been based on Kasumi or AES; chose AES – 128-EEA2: AES in counter mode – 128-EIA2: AES in CMAC mode 13 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

The designers DACAS: Data Assurance and communication security research center, Chinese Academy of Sciences Dongdai Lin Xiutao Feng 14 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

Plan A Paid expert team Algorithm Public evaluation SAGE acceptance evaluation evaluation (hopefully) May Feb Aug Jan Jun Sep Nov Dec May May Aug Oct Jan Feb Mar Jun Sep Nov Dec Mar Jun Jul Apr Apr Oct Jul Jul 2009 2010 2011 Under NDA 15 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

Plan B Paid expert team Algorithm Public evaluation SAGE acceptance evaluation evaluation (hopefully) Agree and sign NDA May Feb Aug Jan Jun Sep Nov Dec May May Aug Oct Jan Feb Mar Jun Sep Nov Dec Mar Jun Jul Apr Apr Oct Jul Jul 2009 2010 2011 16 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

Take your time Advanced Encryption Standard process From Wikipedia, the free encyclopedia Start of the process On January 2, 1997, NIST announced that they wished to choose a successor to DES to be known as AES …. The result of this feedback was a call for new algorithms on September 12, 1997 Rounds one and two In the nine months that followed, fifteen different designs were created and submitted …. NIST held two conferences to discuss the submissions (AES1, August 1998 and AES2, March 1999), and in August 1999 they announced that they were narrowing the field from fifteen to five …. … AES3 conference in April 2000 …. Selection of the winner On October 2, 2000 , NIST announced that Rijndael had been selected as the proposed AES …. 17 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

Encryption COUNT DIRECTION COUNT DIRECTION BEARER LENGTH BEARER LENGTH KEY KEY EEA EEA KEYSTREAM KEYSTREAM BLOCK BLOCK PLAINTEXT CIPHERTEXT PLAINTEXT BLOCK BLOCK BLOCK Sender Receiver 18 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

Integrity COUNT COUNT DIRECTION MESSAGE DIRECTION MESSAGE BEARER LENGTH BEARER LENGTH KEY EIA KEY EIA MAC-I XMAC-I Sender Receiver 19 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

ZUC – named after Zu Chongzhi 20 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

ZUC One of these words mixed into LFSR during nonlinear initialisation 21 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

Encryption algorithm 128-EEA3 22 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

Integrity algorithm 128-EIA3 Universal Hash Function 23 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

Initial SAGE evaluation > Fit for purpose > Smells OK – Must be not just strong, but free of suspicion 24 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

Plan B Paid expert team Algorithm Public evaluation SAGE acceptance evaluation evaluation (hopefully) Agree and sign NDA May Feb Aug Jan Jun Sep Nov Dec May May Aug Oct Jan Feb Mar Jun Sep Nov Dec Mar Jun Jul Apr Apr Oct Jul Jul 2009 2010 2011 25 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

Plan C Expert team contract Paid expert team Algorithm Public evaluation SAGE acceptance evaluation evaluation (hopefully) Agree and sign NDA May Feb Aug Jan Jun Sep Nov Dec May May Aug Oct Jan Feb Mar Jun Sep Nov Dec Mar Jun Jul Apr Apr Oct Jul Jul 2009 2010 2011 26 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

External expert team evaluation > Codes and Ciphers Limited – Carlos Cid, Sean Murphy, Fred Piper, Matthew Dodd > Alice and Bob Technologies – Lars Knudsen, Bart Preneel, Vincent Rijmen > Several corrections / improvements to existing evaluation > All standard attack types considered – all seem unlikely to succeed > Strength inherited from SNOW-like construction > Some components not fully explained > Like most UHF MACs – not robust against nonce reuse 27 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

Conclusion of the SAGE and paid evaluation > Transparency is vital – nothing suspicious 28 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0

Plan C Expert team contract Paid expert team Algorithm Public evaluation SAGE acceptance evaluation evaluation (hopefully) Agree and sign NDA May Feb Aug Jan Jun Sep Nov Dec May May Aug Oct Jan Feb Mar Jun Sep Nov Dec Mar Jun Jul Apr Apr Oct Jul Jul 2009 2010 2011 29 LTE algorithms, for SKEW 2011 C1 - Unrestricted 17 Feb 2011 Vodafone Group R&D Version 1.0