Differential Fault Attack on KASUMI Cipher Used in GSM Telephony

Abstract

The confidentiality of GSM cellular telephony depends on the security of A5 family of cryptosystems. As an algorithm in this family survived from cryptanalysis, A5/3 is based on the block cipher KASUMI. This paper describes a novel differential fault attack on KAUSMI with a 64-bit key. Taking advantage of some mathematical observations on the FL, FO functions, and key schedule, only one 16-bit word fault is required to recover all information of the 64-bit key. The time complexity is only 232encryptions. We have practically simulated the attack on a PC which takes only a few minutes to recover all the key bits. The simulation also experimentally verifies the correctness and complexity.

Stealthy Hardware Trojan Based Algebraic Fault Analysis of HIGHT Block Cipher

“…The basic idea of AFA is to convert both the cipher and the injected faults into algebraic equations and recover the secret key with automated solvers such as SAT instead of the manual analysis on fault propagations in DFA, hence making it easier to extend AFA to deep rounds and different ciphers and fault models. AFA has been successfully used to improve DFA on the stream ciphers such as Trivium [19] and Grain [20] and block ciphers such as AES [21], LED [22,23], KASUMI [24], and Piccolo [25].…”

FPGA implementation of an enhanced chaotic-KASUMI block cipher

“…It is very sensitive to initial conditions and presents high recurrences [29]. It is characterized by the following equation set ( 5) [30,31] :…”

“…The strength of the proposed algorithm lies in the additional chaotic generator associated with the regular algorithm. The principle property of this generator is its hight sensitivity to initial conditions (x0, y0, z0, w0) and control parameters (a, b, c, d) defined in the equation set (5). Thereby, the new key space is formed by respecting those eight parameters in addition to the original CK.…”

“…Therefore, the main security algorithm used by those networks is the KASUMI block cipher, which forms the kernel of GSM and UMTS security mechanisms [1,2] widely used in most countries. However, in the last decade KASAUMI security was the object of many cryptanalyzed attacks as mentioned in [3][4][5][6][7][8][9]. But, investigations are still proposed to improve the security and resistance of the KASUMI algorithm [10][11][12].…”

Reducing the time required by KASUMI to generate output by modifying the FL and FI functions

“…Through this attack it was shown that only one 16-bit word fault was enough to perform a successful key recovery attack. Emphasis was made on the last two rounds of KASUMI and was proposed that these two rounds should be specially designed to protect against fault injection [9]. Many algorithms have been proposed and are used for different encryption purposes [10][11][12][13].…”