The block cipher KASUMI, proposed by ETSI SAGE over 10 years ago, is widely used for security in many synchronous wireless standards nowadays. For instance, the confidentiality and integrity of 3G mobile communications systems depend on the security of KASUMI. Up to now, there is a great deal of cryptanalytic results on KASUMI. However, its security evaluation against the recent zero-correlation linear attacks is still lacking. In this study, combining with some observations on the FL, FO and FI functions, the authors select some special input/output masks to refine the general 5-round zero-correlation linear approximations and propose the 6-round zero-correlation linear attack on KASUMI. Moreover, under the weak key conditions that the second keys of the FL function in rounds 2 and 8 have the same values at 1st–8th and 11th–16th bit-positions, they expand the attack to 7-round KASUMI (2–8). These weak keys take 1/2¹⁴ of the key space. The new zero-correlation linear attack on the 6-round needs about 2¹¹⁸ encryptions with 2^62.9 known plaintexts and 2⁵⁴ bytes memory. For the attack under weak keys conditions on the last 7 rounds, the data complexity is about 2^62.1 known plaintexts, and the time complexity is about 2^110.5 encryptions, and the memory requirement is about 2⁸⁵ bytes.

References

1. 1)
  - 1. Matsui, M.: ‘New block encryption algorithm MISTY’. FSE 1997, 1997 (LNCS, 1267), pp. 54–68.
2. 2)
  - 14. Bogdanov, A., Leander, G., Nyberg, K., et al: ‘Integral and multidimensional linear distinguishers with correlation zero’. AsiaCrypt 2012, 2012 (LNCS, 7658), pp. 24–262.
3. 3)
  - 6. Sugio, N., Aono, H., Hongo, S., et al: ‘A study on higher order differential attack of KASUMI’, IEICE Trans., 2007, 90-A, (1), pp. 14–21 (doi: 10.1093/ietfec/e90-a.1.14).
4. 4)
  - 15. Bogdanov, A., Geng, H., Wang, M., et al: ‘Zero-correlation linear cryptanalysis with FFT and improved attacks on ISO standards Camellia and CLEFIA’. SAC'13, 2013 (LNCS 8282), pp. 306–323.
5. 5)
  - 2. 3rd Generation Partnership Project, Technical Specification Group Services and System Aspects, 3G Security, Specification of the 3GPP Confidentiality and Integrity Algorithms; Document 2: KASUMI Specification, V3.1.1 (2001).
6. 6)
  - 10. Biham, E., Dunkelman, O., Keller, N.: ‘A related-key rectangle attack on the full KASUMI’. ASIACRYPT 2005, 2005 (LNCS, 3788), pp. 443–461.
7. 7)
  - 13. Bogdanov, A., Wang, M.: ‘Zero correlation linear cryptanalysis with reduced data complexity’. FSE 2012, 2012 (LNCS, 7549), pp. 29–48.
8. 8)
  - 25. Wen, L., Wang, M., Bogdanov, A., et al: ‘Multidimensional zero-correlation attacks on lightweight block cipher HIGHT: improved cryptanalysis of an ISO standard’, Inf. Process. Lett., 2014, 114, (6), pp. 322–330 (doi: 10.1016/j.ipl.2014.01.007).
9. 9)
  - 12. Bogdanov, A., Rijmen, V.: ‘Linear hulls with correlation zero and linear cryptanalysis of block ciphers’, Des. Codes Cryptogr., 2012, 70, pp. 1–15.
10. 10)
  - 8. Jia, K., Li, L., Rechberger, C., et al: ‘Improved cryptanalysis of the block cipher KASUMI’. SAC 2012, 2012 (LNCS, 7707), pp. 222–233.
11. 11)
  - 5. Sugio, N., Tanaka, H., Kaneko, T.: ‘A study on higher order differential attack of KASUMI’. 2002 Int. Symp. on Information Theory and its Applications, 2002.
12. 12)
  - 17. Wen, L., Wang, M., Bogdanov, A.: ‘Multidimensional zero-correlation linear cryptanalysis of E2’. Africacrypt'14, 2014 (LNCS 8469), pp. 306–323.
13. 13)
  - 9. Blunden, M., Escott, A.: ‘Related key attacks on reduced round KASUMI’. FSE 2001, 2001 (LNCS, 2355), pp. 277–285.
14. 14)
  - 7. Kühn, U.: ‘Cryptanalysis of reduced-round MISTY’. EUROCRYPT 2001, 2001 (LNCS, 2045), pp. 325–339.
15. 15)
  - 4. Sugio, N., Aono, H., Hongo, S., et al: ‘A study on integral-interpolation attack of MISTY1 and KASUMI’. Computer Security Symp., 2006, pp. 173–178.
16. 16)
  - 11. Dunkelman, O., Keller, N., Shamir, A.: ‘A practical-time related-key attack on the KASUMI cryptosystem used in GSM and 3G telephony’. CRYPTO 2010, 2010 (LNCS, 6223), pp. 393–410.
17. 17)
  - 3. 3rd Generation Partnership Project, Technical Specification Group Services and system Aspects, 3G Security, Specification of the A5/3 Encryption Algorithms for GSM and ECSD, and the GEA3 Encryption Algorithm for GPRS; Document 1: A5/3 and GEA3 Specifications, V6.2.0 (2003).

Multidimensional zero-correlation linear cryptanalysis of the block cipher KASUMI

References

Related content