SNOW V: A new version of SNOW for 5G Patrik Ekdahl 2 , Thomas Johansson 1 , Alexander Maximov 2 , Jing Yang 1 1 Department of Electrical and Information Technology, Lund University 2 Ericsson Research, Ericsson
Outline Motivation • Motivation SNOW V • Stream Ciphers Performance Analysis • SNOW 3G Security Analysis • 5G Requirements Conclusion • SNOW V • Construction • Keystream Generation • AEAD Mode • Performance Analysis • Hardware Implementation Aspects • Software Implementation Aspects • Security Analysis • Conclusion 2/22
Outline Motivation • Motivation SNOW V • Stream Ciphers Performance Analysis • SNOW 3G Security Analysis • 5G Requirements Conclusion • SNOW V • Construction • Keystream Generation • AEAD Mode • Performance Analysis • Hardware Implementation Aspects • Software Implementation Aspects • Security Analysis • Conclusion 3/22
Stream Ciphers Motivation SNOW V Symmetric-key ciphers encrypt/decrypt data digit by digit through XOR operation Performance Analysis Security Analysis p l a i n t e x t Conclusion K K : t h e s e c r e t k e y k e y s t r e a m c i p h e r t e x t S t r e a m I V : a p u b l i c n o n c e I V C i p h e r XOR 4/22
Stream Ciphers Motivation SNOW V Symmetric-key ciphers encrypt/decrypt data digit by digit through XOR operation Performance Analysis Security Analysis p l a i n t e x t Conclusion K K : t h e s e c r e t k e y k e y s t r e a m c i p h e r t e x t S t r e a m I V : a p u b l i c n o n c e I V C i p h e r XOR Often constructed using linear-feedback shift registers (LFSRs) + a Non-Linear Part to disrupt the linearity of LFSR Easy implementation and very fast in hardware environment 4/22
Stream Ciphers Motivation SNOW V Symmetric-key ciphers encrypt/decrypt data digit by digit through XOR operation Performance Analysis Security Analysis p l a i n t e x t Conclusion K K : t h e s e c r e t k e y k e y s t r e a m c i p h e r t e x t S t r e a m I V : a p u b l i c n o n c e I V C i p h e r XOR Often constructed using linear-feedback shift registers (LFSRs) + a Non-Linear Part to disrupt the linearity of LFSR Easy implementation and very fast in hardware environment Popular stream ciphers: Salsa20, Grain, SOBER, SNOW , ZUC, etc. 4/22
SNOW 3G SNOW 1.0 : Proposed by Thomas Johansson & Patrik Ekdahl in 2000, NESSIE candidate Motivation SNOW V SNOW 2.0 : Improved in 2003, included in ISO/IEC 18033-4 standard Performance Analysis SNOW 3G : 2006, one of the three confidentiality/integrity algorithm standards for 3G/LTE Security Analysis Conclusion 5/22
SNOW 3G SNOW 1.0 : Proposed by Thomas Johansson & Patrik Ekdahl in 2000, NESSIE candidate Motivation SNOW V SNOW 2.0 : Improved in 2003, included in ISO/IEC 18033-4 standard Performance Analysis SNOW 3G : 2006, one of the three confidentiality/integrity algorithm standards for 3G/LTE Security Analysis Conclusion L F S R 3 2 - b i t F S M 3 2 - b i t AE S S - b o x + Mi x C o l u mn 3 2 - b i t LFSR (512 bits in total) + Non-linear Part ( FSM, finite state machine) Word-based, hardware-oriented, especially efficient in hardware environment 5/22
SNOW 3G Application Every user has a unique master key K embedded into the SIM card/ stored at HSS(Home Motivation SNOW V Subscriber Server), to generate session keys and distribute to base stations (BSs) and Performance Analysis Mobility Management Entity (MME) Security Analysis Conclusion Session Session K keys keys K Internet Session keys 6/22
SNOW 3G Application Every user has a unique master key K embedded into the SIM card/ stored at HSS(Home Motivation SNOW V Subscriber Server), to generate session keys and distribute to base stations (BSs) and Performance Analysis Mobility Management Entity (MME) Security Analysis SNOW3G IP core is embeded into the physical boards of mobile phones / BS / MME Conclusion User / BS / MME: keystream = SNOW3G( K session , IV) Session Session K keys keys K Internet Session keys 6/22
SNOW 3G Application Every user has a unique master key K embedded into the SIM card/ stored at HSS(Home Motivation SNOW V Subscriber Server), to generate session keys and distribute to base stations (BSs) and Performance Analysis Mobility Management Entity (MME) Security Analysis SNOW3G IP core is embeded into the physical boards of mobile phones / BS / MME Conclusion User / BS / MME: keystream = SNOW3G( K session , IV) Speed is lower than 20Gbps (the expected downlink speed in 5G) Session Session K keys keys K Internet Session keys 6/22
5G Motivation Challenges SNOW V Structure : SDN-based, nodes are virtualized (No specific hardware cores) Performance Analysis Security Analysis Targeted data rate : 20Gbps (downlink) 10Gbps (uplink) Conclusion 7/22
5G Motivation Challenges SNOW V Structure : SDN-based, nodes are virtualized (No specific hardware cores) Performance Analysis Security Analysis Targeted data rate : 20Gbps (downlink) 10Gbps (uplink) Conclusion The speed of SNOW needs to be > 20 Gbps under software environment. 7/22
5G Motivation Challenges SNOW V Structure : SDN-based, nodes are virtualized (No specific hardware cores) Performance Analysis Security Analysis Targeted data rate : 20Gbps (downlink) 10Gbps (uplink) Conclusion The speed of SNOW needs to be > 20 Gbps under software environment. Opportunities SIMD (Single Instruction Multiple Data) structure : CPUs can handle large registers split into blocks of various sizes (8-, 16-, 32-, 64-, 128-, 256-, 512-bits) Intrinsic instructions : e.g., AES-NI set for AES, high speed in software SIMD Structure 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 32 32 32 32 32 32 32 32 64 64 64 64 128 7/22
Outline Motivation • Motivation SNOW V • Stream Ciphers Performance Analysis • SNOW 3G Security Analysis • 5G Requirements Conclusion • SNOW V • Construction • Keystream Generation • AEAD Mode • Performance Analysis • Hardware Implementation Aspects • Software Implementation Aspects • Security Analysis • Conclusion 8/22
Construction Motivation SNOW V 1 6 - b i t Performance Analysis L F S R- A Security Analysis LFSR: 2x256 bits L F S R- B Conclusion FSM: 3x128-bit registers and 2 AES rounds Output: 128-bit keystream 1 2 8 - b i t 1 2 8 - b i t AE S Ro u n d F S M LFSRs LFSR Stages Stage Sizes FSM Register Sizes Output SNOW 3G 1 16 32-bit 32-bit 32-bit SNOW V 2 32 16 -bit 128-bit 128-bit 9/22
LFSR Motivation Circular Construction : Two LFSRs defined on two finite fields feeding to each other SNOW V g A ( x ) = x 16 + x 15 + x 12 + x 11 + x 8 + x 3 + x 2 + x + 1 ∈ � 2 [ x ] , with root α Performance Analysis g B ( x ) = x 16 + x 15 + x 14 + x 11 + x 8 + x 6 + x 5 + x + 1 ∈ � 2 [ x ] , with root β Security Analysis Proven to have a maximum period 2 512 − 1 Conclusion procedure LFSRupdate () for i = 0 .. 7 do a 16 ← b 0 + α a 0 + a 1 + α − 1 a 8 mod g A ( α ) T 2 b 16 ← a 0 + β b 0 + b 3 + β − 1 b 8 mod g B ( β ) A A ← ( a 16 , a 15 ,..., a 1 ) B B ← ( b 16 , b 15 ,..., b 1 ) 1 T 10/22
FSM Motivation SNOW V procedure FSMupdate () Performance Analysis 1 T T 2 ← ( a 7 , a 6 ,..., a 0 ) Security Analysis tmp ← R 2 ⊞ 32 ( R 3 ⊕ T 2 ) Conclusion R 3 ← AES R ( R 2 , C 2 ) R 2 ← AES R ( R 1 , C 1 ) 2 T R 1 ← tmp Two round key constants C 1 and C 2 are set to zero. Note : When used in AEAD mode, the value of C 1 is different (non-zero). 11/22
Keystream Generation Motivation SNOW V Performance Analysis K / I V S e t u p Security Analysis Conclusion 1 6 r o u n d s k e y s t r e a m f e e d s b a c k t o L F S R k e y s t r e a m Initialization is used to fully mix K and IV, after which the output should be random. 12/22
AEAD Mode AEAD : authenticated encryption with associated data, provides confidentiality, integrity, Motivation SNOW V and authenticity assurances on the data Performance Analysis Security Analysis Conclusion 13/22
AEAD Mode AEAD : authenticated encryption with associated data, provides confidentiality, integrity, Motivation SNOW V and authenticity assurances on the data Performance Analysis GMAC (Galois Message Authentication Code) is used to generate authentication tag Security Analysis Conclusion 13/22
AEAD Mode AEAD : authenticated encryption with associated data, provides confidentiality, integrity, Motivation SNOW V and authenticity assurances on the data Performance Analysis GMAC (Galois Message Authentication Code) is used to generate authentication tag Security Analysis Keystream generation process is the same as in the normal mode, except C 1 = 0 x 0024406480 A 4 C 0 E 40420446084 A 0 C 4 E 0 Conclusion 13/22
Recommend
More recommend
