Security Analysis And Related-Key Attack On Kasumi Algorithm

With the development of mobile communication technology and smart phone technology,mobile communication plays a more and more important role in modern people’s social life.Aspeople frequently use mobile communication for information exchange, how to guarantee thesecurity of the information transmitted in the communication system has become an urgentproblem.The A5/3encryption algorithm for GSM, the GEA3encryption algorithm for GPRS and thef8data encryption algorithm and the f9data integrithy algorithm for WCDMA are both based onthe block cipher Kasumi. These algorithms are used to protect the confidentiality of user data andsignaling data sent over the radio access link between UE and RNC or to authenticate the dataintegrity and data origin of signalling data transmitted between UE and RNC.This paper madesome study on the security analysis and related-key attack of the Kasumi algorithm.The mainresults are as follows:The first part analyzes the constructive principle of the Kasumi algorithm S-boxes S7andS9. We point out that the S7and S9are based on Kasami power function and Gold powerfunction respectively.The paper gives a method to evaluate the theoretical upper bound of theaverage differential probability of the FI function of Kasumi algorithm and gets a conclusion thatthe average differential probablity of FI function is2-14.At last, we establish a model to analyzethe superiority of Kasumi’s FI function. The structure of the FI function can make the upperbound of the average differential probability of the Kasumi algorithm small.Shamir and his coauthors constructed a related-key sandwich distinguisher for7-roundKasumi and proved that the probability of the related-key sandwich distinguisher is2-14. Thepurpose of this paper is to construct some other six distinguishers whose probability is2-14andnine distinguishers whose probability is2-16.We do some experiments to attest that the testingprobability of these distinguishers accords with the theoretical probability.We show an exampleto prove the existence of these distinguishers. Lastly we design a method which uses thedistinguishers had been constructed before to attack the8-round Kasumi algorithm, we canderive the128bit key of the full kasumi by using226data,228bytes of memory and O(233) time.