![](bg1.png)
ANALYSIS OF SNOW 3G
⊕
RESYNCHRONIZATION MECHANISM
Alex Biryukov, Deike Priemuth-Schmid and Bin Zhang
LACS, University of Luxembourg, Rue Richard Coudenhove-Kalergi 6, Luxembourg, Luxembourg
Keywords:
Stream ciphers, SNOW 3G, Resynchronization attack.
Abstract:
The stream cipher SNOW 3G designed in 2006 by ETSI/SAGE is a base algorithm for the second set of 3GPP
confidentiality and integrity algorithms. This paper is the first attempt of cryptanalysis of this algorithm in the
public literature. We look at SNOW 3G in which two modular additions are replaced by xors, which is called
SNOW 3G
⊕
. We show that the feedback from the FSM to the LFSR is very important, since we can break
a version without such a feedback using a pair of known IVs with practical complexities (2
57
time and 2
33
keystream). We then extend this technique into a differential chosen IV attack on SNOW 3G
⊕
and show how
to break 16 out of 33 rounds with the feedback.
1 INTRODUCTION
The SNOW 3G stream cipher is the core of the 3GPP
confidentiality and integrity algorithms UEA2 and
UIA2, published in 2006 by the 3GPP Task Force
(ETSI1, 2006). Compared to its predecessor, SNOW
2.0 (Ekdahl and Johansson, 2002), SNOW 3G adopts
a finite state machine (FSM) of three 32-bit words
and 2 S-Boxes to increase the resistance against alge-
braic attacks by Billet and Gilbert (Billet and Gilbert,
2005). Full evaluation of the design is not public, but
a survey of this evaluation is given in (ETSI2, 2006).
In (ETSI2, 2006), SNOW 3G
⊕
(in which the two
modular additions are replaced by xors) is defined and
evaluated. It shows that SNOW 3G has remarkable
resistance against linear distinguishing attacks (Ny-
berg and Wall´en, 2006; Watanabe et al., 2004), while
SNOW 3G
⊕
offers much better resistance against al-
gebraic attacks.
In this paper, we presents the first attempt of
cryptanalysis of the resynchronization mechanism of
SNOW 3G
⊕
. We show that the feedback from the
FSM to the LFSR during the key/IV setup phase is vi-
tal for the security of this cipher, since we can break a
version without such a feedback with two known IV’s
in 2
57
time, 2
33
data complexity and for an arbitary
number of the key/IV setup rounds! We then restore
the feedback and study SNOW 3G
⊕
against differen-
tial chosen IV attacks. We show attacks on SNOW
3G
⊕
with 14, 15 and 16 rounds of initialization with
complexity 2
42.7
, 2
92.2
and 2
124.2
respectively.
This paper is organized as follows. We give a de-
scription of SNOW 3G and SNOW 3G
⊕
in Section
2. The known IV attack on SNOW 3G
⊕
without the
FSM to LFSR feedback is presented in Section 3 and
the differential chosen IV attack on SNOW 3G
⊕
with
the feedback is presented in Section 4. Finally, some
conclusions are given in Section 5.
2 DESCRIPTION OF SNOW 3G
AND SNOW 3G
⊕
SNOW 3G is a word-oriented synchronous stream ci-
pher with 128-bit key and 128-bit IV, each consid-
ered as four 32-bit words vector. It consists of a lin-
ear feedback shift register (LFSR) of sixteen 32-bit
words and a finite state machine (FSM) with three
32-bit words, shown in Figure 1. Here ’⊕’ denotes
15
s
14
s
13
s
12
s
11
s
10
s
9
s
8
s
7
s
6
s
5
s
4
s
3
s
2
s
1
s
0
s
1
R
2
R
3
R
1
S
2
S
1−
t
z
Figure 1: Keystream generation of SNOW 3G.
the bit-wise xor and ’⊞’ denotes the addition modulo
2
32
. The feedback word of the LFSR is recursively
327
Biryukov A., Priemuth-Schmid D. and Zhang B. (2010).
ANALYSIS OF SNOW 3G⣸T RESYNCHRONIZATION MECHANISM.
In Proceedings of the International Conference on Security and Cryptography, pages 327-333
DOI: 10.5220/0002926603270333
Copyright
c
SciTePress