Initialisation flaws in the A5-GMR-1 satphone encryption algorithm

Abstract

A5-GMR-1 is a synchronous stream cipher used to provide confidentiality for communications between satellite phones and satellites. The keystream generator may be considered as a finite state machine, with an internal state of 81 bits. The design is based on four linear feedback shift registers, three of which are irregularly clocked. The keystream generator takes a 64-bit secret key and 19-bit frame number as inputs, and produces an output keystream of length berween 2 8 and 2 10 bits.Analysis of the initialisation process for the keystream generator reveals serious flaws which significantly reduce the number of distinct keystreams that the generator can produce. Multiple (key, frame number) pairs produce the same keystream, and the relationship between the various pairs is easy to determine. Additionally, many of the keystream sequences produced are phase shifted versions of each other, for very small phase shifts. These features increase the effectiveness of generic time-memory tradeoff attacks on the cipher, making such attacks feasible. CCS Concepts•Security and privacy → Symmetric cryptography and hash functions; Block and stream ciphers; Cryptanalysis and other attacks;

Improved Ciphertext-Only Attack on GMR-1

“…The second method optimizes the row size of M linear to reduce memory complexity. α 63 (= α 48 ) does not influence the cipher owing to the last step in the initialization phase, which sets LSBs of LFSRs to 1 [15]. We define α as a 63 × 1 column vector by excluding α 48 from α and β as a 77 × 1 column vector by excluding the LSBs of Rj from β;…”