A Hardware-Assisted Realtime Attack on A5/2 Without Precomputations

Abstract. A5/2 is a synchronous stream cipher that is used for protecting GSM communication. Recently, some powerful attacks [2,10] on A5/2 have been proposed. In this contribution we enhance the ciphertext-only attack [2] by Barkan, Biham, and Keller by designing special-purpose hardware for generating and solving the required systems of linear equations. For realizing the LSE solver component, we use an approach recently introduced in [5,6] describing a parallelized hardware implementation of the Gauss-Jordan algorithm. Our hardware-only attacker immediately recovers the initial secret state of A5/2 - which is sufficient for decrypting all frames of a session - using a few ciphertext frames without any precomputations and memory. More precisely, in contrast to [2] our hardware architecture directly attacks the GSM speech channel (TCH/FS and TCH/EFS). It requires 16 ciphertext frames and completes the attack in about 1 second. With minor changes also input from other GSM channels (e.g...

• Type: Conference
• Year: 2007
• Where: CHES
• Authors: Andrey Bogdanov, Thomas Eisenbarth, Andy Rupp
• Keywords: CHES 2007, Ciphertext Frames, Cryptography, GSM Communication, Synchronous Stream Cipher