SAT based analysis of LTE stream cipher ZUC

Mobile security is of paramount importance. The security of LTE (long term evolution of radio networks), which is currently widely deployed as a long-term standard for mobile networks, relies upon three cryptographic primitives, among which the stream cipher ZUC. In this paper, we point out that the...

Full description

Saved in:
Bibliographic Details
Published inJournal of information security and applications Vol. 22; pp. 54 - 65
Main Authors Lafitte, Frédéric, Markowitch, Olivier, Van Heule, Dirk
Format Journal Article
LanguageEnglish
Published Elsevier Ltd 01.06.2015
Subjects
128-EEA3
128-EIA3
LTE
SAT solver
Stream cipher
ZUC
ZUC
128-EEA3
SAT solver
LTE
128-EIA3
Stream cipher
Online AccessGet full text

Cover

More Information
Summary:Mobile security is of paramount importance. The security of LTE (long term evolution of radio networks), which is currently widely deployed as a long-term standard for mobile networks, relies upon three cryptographic primitives, among which the stream cipher ZUC. In this paper, we point out that the linear feedback shift register (LFSR) used in ZUC has about 225 encodings of the zero state (i.e. all LFSR variables are 0) due to the fact that operations are performed modulo 231−1 on 32-bit operands. SAT solvers allow us to show that these states are reachable when 64 bits of ZUC's initial state can be chosen (i.e. R1,R2) in reduced round versions of ZUC's initialization. We also use SAT-solvers to disprove the existence of such weak inputs in full round versions or in reduced round versions in which the initial values of R1,R2 are set to zero, as required by the official specifications. Finally, we discuss to what extent the redundancy introduced in ZUC's output function helps mounting SAT-solver based guess-and-determine attacks given a few keystream digits.
ISSN:2214-2126
DOI:10.1016/j.jisa.2014.09.004