Theoretical Linear Cryptanalysis of the 5G Standard Candidate SNOW 5G

• Published in: IACR Transactions on Symmetric Cryptology Vol. 2024; no. 2; pp. 141 - 165
• Main Authors: Liu, Yinuo, Yang, Jing, Tian, Tian
• Format: Journal Article
• Language: English
• Published: Ruhr-Universität Bochum 18.06.2024
• Subjects: divide-and-conquer; linear approximations; linear cryptanalysis; SNOW 5G
• ISSN: 2519-173X; 2519-173X
• DOI: 10.46586/tosc.v2024.i2.141-165

In this paper, we perform linear cryptanalysis of the stream cipher SNOW 5G, which is recommended by the international standardization group (SAGE) as one standard algorithm for 5G confidentiality and integrity protection over the wireless channel. SNOW 5G can be regarded as one member of the SNOW-V family, as it is modified from SNOW-Vi by SAGE with a slight improvement. As an overall contribution, we provide a comprehensive and elaborate theoretical analysis of linear approximations of SNOW 5G and provide the best public cryptanalysis result by far. Specifically, we first theoretically analyze the formats of linear masks of SNOW5G that can introduce high correlations, and then search for high-quality linear masks using a divide-and-conquer method based on the different cases of a critical intermediate linear mask. We find a linear approximation of SNOW 5G with correlation −2−67.67 and further launch a correlation attack against it with complexity 2279.8, improving the existing best correlation attack by a factor of 232.4. Our results are mainly from theoretical analysis, which involve little computation overhead and help to better understand the security of SNOW 5G.