A Bitslice Implementation of Anderson’s Attack on A5/1

Abstract

Abstract:The A5/1 keystream generator is a part of Global System for Mobile Communications (GSM) protocol, employed in cellular networks all over the world. Its cryptographic resistance was extensively analyzed in dozens of papers. However, almost all corresponding methods either employ a specific hardware or require an extensive preprocessing stage and significant amounts of memory. In the present study, a bitslice variant of Anderson's Attack on A5/1 is implemented. It requires very little computer memory and no preprocessing. Moreover, the attack can be made even more efficient by harnessing the computing power of modern Graphics Processing Units (GPUs). As a result, using commonly available GPUs this method can quite efficiently recover the secret key using only 64 bits of keystream. To test the performance of the implementation, a volunteer computing project was launched. 10 instances of A5/1 cryptanalysis have been successfully solved in this project in a single week.

Using Linearizing Sets to Solve Multivariate Quadratic Equations in Algebraic Cryptanalysis

“…This attack can be mounted in reasonable time if one uses specialized computing architectures allowing massive parallelism, such as FPGA or GPU. The corresponding results were presented in [43] and [66] for FPGA, and in [67] for GPU. One can view the Anderson's attack as an attack in which one has to solve simple systems of linear equations over GF (2).…”

State Transition Analysis of GSM Encryption Algorithm A5/1

“…The internal architecture of the two algorithms (i.e, A 3 and A 8 ) in GSM is not described. The operators may additionally adopt the exact configuration of the stream cipher algorithms [2] on their personal. In 1994 the approximate design of A5/1 was disclosed [20].…”

“…Several cryptanalytic techniques were proposed on the A5/1 cipher include Anderson [2], Golic [19] and Babbage [11]. In 2001 Biryukov, Shamir, and Wagner [12], in 2000 Biham and Manuscript received June 4, 2021; revised December 16, 2021.…”

Guess-and-determine attacks and automatic methods for their construction

“…Алгоритм A в этом случае простейший фактически, подстановка значений переменных из B в систему уравнений, описывающую генерацию ключевого потока; результирующая система становится тривиально разрешимой. В дальнейшем атака Андерсона была реализована как с применением специально спроектированной для этой цели ПЛИС-архитектуры [6], так и в распределённой среде, использующей общедоступные GPU [7]. Известно довольно много примеров атак типа угадывай и определяй , в которых алгоритм A это алгоритм решения систем линейных алгебраических уравнений (СЛАУ).…”