ANALYSIS OF SNOW 3G

⊕

RESYNCHRONIZATION MECHANISM

Alex Biryukov, Deike Priemuth-Schmid and Bin Zhang

LACS, University of Luxembourg, Rue Richard Coudenhove-Kalergi 6, Luxembourg, Luxembourg

Keywords:

Stream ciphers, SNOW 3G, Resynchronization attack.

Abstract:

The stream cipher SNOW 3G designed in 2006 by ETSI/SAGE is a base algorithm for the second set of 3GPP

conﬁdentiality and integrity algorithms. This paper is the ﬁrst attempt of cryptanalysis of this algorithm in the

public literature. We look at SNOW 3G in which two modular additions are replaced by xors, which is called

SNOW 3G

⊕

. We show that the feedback from the FSM to the LFSR is very important, since we can break

a version without such a feedback using a pair of known IVs with practical complexities (2

time and 2

keystream). We then extend this technique into a differential chosen IV attack on SNOW 3G

⊕

and show how

to break 16 out of 33 rounds with the feedback.

1 INTRODUCTION

The SNOW 3G stream cipher is the core of the 3GPP

conﬁdentiality and integrity algorithms UEA2 and

UIA2, published in 2006 by the 3GPP Task Force

(ETSI1, 2006). Compared to its predecessor, SNOW

2.0 (Ekdahl and Johansson, 2002), SNOW 3G adopts

a ﬁnite state machine (FSM) of three 32-bit words

and 2 S-Boxes to increase the resistance against alge-

braic attacks by Billet and Gilbert (Billet and Gilbert,

2005). Full evaluation of the design is not public, but

a survey of this evaluation is given in (ETSI2, 2006).

In (ETSI2, 2006), SNOW 3G

⊕

(in which the two

modular additions are replaced by xors) is deﬁned and

evaluated. It shows that SNOW 3G has remarkable

resistance against linear distinguishing attacks (Ny-

berg and Wall´en, 2006; Watanabe et al., 2004), while

SNOW 3G

⊕

offers much better resistance against al-

gebraic attacks.

In this paper, we presents the ﬁrst attempt of

cryptanalysis of the resynchronization mechanism of

SNOW 3G

⊕

. We show that the feedback from the

FSM to the LFSR during the key/IV setup phase is vi-

tal for the security of this cipher, since we can break a

version without such a feedback with two known IV’s

in 2

time, 2

data complexity and for an arbitary

number of the key/IV setup rounds! We then restore

the feedback and study SNOW 3G

⊕

against differen-

tial chosen IV attacks. We show attacks on SNOW

⊕

with 14, 15 and 16 rounds of initialization with

complexity 2

42.7

, 2

92.2

and 2

124.2

respectively.

This paper is organized as follows. We give a de-

scription of SNOW 3G and SNOW 3G

⊕

in Section

2. The known IV attack on SNOW 3G

⊕

without the

FSM to LFSR feedback is presented in Section 3 and

the differential chosen IV attack on SNOW 3G

⊕

with

the feedback is presented in Section 4. Finally, some

conclusions are given in Section 5.

2 DESCRIPTION OF SNOW 3G

AND SNOW 3G

⊕

SNOW 3G is a word-oriented synchronous stream ci-

pher with 128-bit key and 128-bit IV, each consid-

ered as four 32-bit words vector. It consists of a lin-

ear feedback shift register (LFSR) of sixteen 32-bit

words and a ﬁnite state machine (FSM) with three

32-bit words, shown in Figure 1. Here ’⊕’ denotes

⊕

•

1−

•

⊕

Figure 1: Keystream generation of SNOW 3G.

the bit-wise xor and ’⊞’ denotes the addition modulo

. The feedback word of the LFSR is recursively

327

Biryukov A., Priemuth-Schmid D. and Zhang B. (2010).

ANALYSIS OF SNOW 3GâŁ¸T RESYNCHRONIZATION MECHANISM.

In Proceedings of the International Conference on Security and Cryptography, pages 327-333

DOI: 10.5220/0002926603270333

 SciTePress

computed as

= α

−1

· s

t−1

⊕ s

t−1

⊕ α · s

t−1

where α is the root of the GF(2

)[x] polynomial x

+ β

245

+ β

x+ β

239

with β being the root of

the GF(2)[x] polynomial x

+ x

+ 1. The

FSM has two input words s

and s

from the LFSR

and is updated as

= R

t−1

⊞ (R

t−1

⊕ s

t−1

= S

t−1

), R

= S

t−1

with the output word F

= (s

⊞ R

) ⊕ R

, where S

and S

are 32-bit to 32-bit S-boxes deﬁned as com-

positions of 4 parallel applications of two 8-bit to 8-

bit small S-boxes, S

and S

, with a linear diffusion

layer respectively. Here S

is the well known AES S-

box and S

is deﬁned as S

(x) = x⊕ x

⊕ x

⊕

⊕ x

⊕ 0x25 for x ∈ GF(2

) de-

ﬁned by x

+ x

+ 1. If we decompose a

32-bit word B into four bytes B = B

with

being the most and B

the least signiﬁcant bytes,

then for i = 1,2, the S-boxes are

(B) = MC

· (S

),S

))

where MC

is the AES mix-column for S

over

GF(2

) deﬁned by x

+ x

+ x + 1 and MC

the similar operation for S

over GF(2

) deﬁned by

+ x

+ 1.

SNOW 3G is initialized with the key K =

) and the IV = (IV

,IV

, IV

,IV

) as fol-

lows. Let 1 be the all-one word, the LFSR is initial-

ized as follows.

= k

⊕ IV

= k

⊕ IV

= k

⊕ 1 s

= k

⊕ 1⊕ IV

= k

⊕ 1⊕ IV

= k

⊕ 1 s

= k

⊕ 1 s

= k

⊕ 1 s

= k

⊕ 1

= k

⊕ 1 .

The FSM is initialized with R

= R

= 0. Then

run the cipher 32 times with the FSM output F xored

to the feedback of the LFSR and no keystream gen-

erated. After this, the cipher is switched into the

keystream generation mode, but the ﬁrst keystream

word is discarded. Hence, there are 33 initialization

rounds. The keystream word generated at clock t is

= s

⊕ F

. If we replace the two modulo additions

in SNOW 3G by xors, we get SNOW 3G

⊕

3 KNOWN IV ATTACK ON SNOW

⊕

WITHOUT FSM TO LFSR

FEEDBACK

In this section, we consider a known IV attack on

SNOW 3G

⊕

without the FSM to LFSR feedback, in

which the attacker has access to two keystreams cor-

responding to (K,IV

) and (K,IV

), where IV

and

are arbitrary known IVs. This attack works for

any number of key/IV setup rounds.

Let R

i,a

and R

i,b

be the individual values in the

FSM register R

at clock t, then we have

∆R

= R

1,a

⊕ R

1,b

2,a

= S

t−1

1,a

), R

2,b

= S

t−1

1,b

∆R

= R

2,a

⊕ R

2,b

= S

t−1

1,a

) ⊕ S

t−1

1,b

Here we deﬁne a new notation

out

∆

(∆R

t−1

) , S

t−1

1,a

) ⊕ S

t−1

1,b

During the keystream generation, we have the follow-

ing equations for the differences at clock t

∆z

= ∆s

⊕ ∆R

⊕ ∆s

∆R

= ∆R

t−1

⊕ ∆R

t−1

⊕ ∆s

t−1

∆R

out

∆

(∆R

t−1

), ∆R

out

∆

(∆R

t−1

The differences in the LFSR part propagate linearly

and are completely predictable.

The main procedures of our attack are: assume

that at time t we have ∆R

= 0. From the linear evo-

lution of the difference in the LFSR and the keystream

difference equations, we deduce potential differences

in the other FSM registers at different times. Know-

ing the input-output difference for the S-boxes, de-

duce the few possibilities for the actual values of the

FSM registers. Combine the knowledge of the FSM

state with that of the keystream to get linear equations

on the LFSR state. Collect enough equations to get

a solvable linear system which will recover the state

of the LFSR. By the invertibility of the cipher, run it

backwards to ﬁnd the 128-bit secret key K.

Assume ∆R

= 0. If this is not true, we just take

the next clock and so on. If we try this step 2

times,

then it will happen with a good probability. Denote

the time that ∆R

= 0 by t = 1. Then ∆R

= 0, ∆R

0 and ∆R

= 0. From the keystream equation at t = 1,

we know ∆R

; similarly we know ∆R

at t = 2, from

which we can derive ∆R

, as shown below. Hereafter,

we denote the known difference values by ∆k

clock t ∆R

∆R

1 0 ∆k

∆k

2 ∆k

3 0

At t = 3, we have

∆R

⊕ ∆R

= ∆z

⊕ ∆s

By the notations introduced before, we get

out

∆

(∆k

)⊕

out

∆

(∆k

) = ∆k

. (1)

SECRYPT 2010 - International Conference on Security and Cryptography

328

Here we have 2

· 2

= 2

pairs satisfying (1).

(In the two 8-bit S-boxes, there are at most 2

possible

output differences for any ﬁxed input difference.) To

enumerate the possible pairs, we proceed as follows.

First rewrite (1) as







out

∆

(∆k

)

out

∆

(∆k

)

out

∆

(∆k

)

out

∆

(∆k

)













out

∆

(∆k

)

out

∆

(∆k

)

out

∆

(∆k

)

out

∆

(∆k

)







⊕







msb







⊕ MC

−1







∆k







where p

msb

(i = 0,1,2, 3) denotes a byte polynomial

which contains only the most signiﬁcant bits of all the

four

out

∆

values. For a detailed explanation, please

see the Appendix. Thus we can fulﬁll the enumer-

ation byte by byte. For the ﬁrst row, we need the

value of

out

∆

(∆k

), which has 2

possibilities and

three more bits for p

msb

. Then we check whether the

value computed at the right side of the equation is a

correct valuefor

out

∆

(∆k

). This would cost 2

steps

and we will obtain 2

solutions for this equation. For

the next three equations, since we already know the

leading bits, we only have 2

possibilities left in each

byte equation, which yields the same time complex-

ity and 2

solutions. To get the solution of the word

equation, we have to combine the corresponding byte

solutions and get 2

·2

= 2

solutions, which

needs about 2× 2

= 2

words of memory. Now,

the states of the FSM are as follows.

clock t ∆R

∆R

1 0 ∆k

∆k

2 ∆k

0 (2

)

3 (2

) (2

) 0

part

→

reduction

clock t ∆R

∆R

1 0 ∆k

∆k

2 ∆k

0 (2

)

3 (2

) (2

) 0

4 (2

) (2

)

Each possible value of ∆R

results in a possible value

of ∆R

. At t = 4, we have

∆R

⊕ ∆R

= ∆z

⊕ ∆s

Replacing the difference ∆R

with the S-Box repre-

sentation, we receive ∆R

⊕

out

∆

(∆R

) = ∆k

. Let

∆R

= c

, ∆R

= a

. Expanding

this equation to the byte form, we get







out

∆

)

out

∆

)

out

∆

)

out

∆

)







= MC

−1













⊕ MC

−1







∆k







We have to insert all the 2

possible pairs of

(∆R

,∆R

) and verify the value

out

∆

for the sin-

gle bytes. This results in a time complexity of

. There are

·2

= 2

entries satisfy this

equation. This means we have 2

sequences

(∆R

,∆R

) left. For each of them, we

know the input-output difference of S

at clock 2 and

3. Thus, we can recover (2·

126

127

+ 4 ·

127

)

= 16.51

sorted pairs of values for S

. This means that we have

16.51

= 8.255 possible values for ∆R

. Looking at

clock 5, we have ∆R

⊕ ∆R

⊕

out

∆

(∆R

) = ∆k

. We

can rewrite this equation into byte form and check

the 2

remaining sequences by the byte equations.

There are

·8.255·2

≈ 2

19.05

possible sequences left

and the complexity is about 2

· 8.255 = 2

23.05

. This

identiﬁcation of the individual values in the FSM for

both keystreams has to be repeated for the next 9

clocks. Each step will have a lower time complex-

ity than the one before and will reduce the possible

number of differences. The time complexity for all

10 steps together is

∑

i=0

·(

127

)

127

= 2

24.1

and

the number of sequences left is 2

· (

127

)

= 2

10.5

Then we insert the individual values of the FSM into

the keystream generation equations and the FSM up-

date equations to get a linear system of the LFSR

initial states. This would need a time complexity of

10.5

· 2

= 2

20.5

steps. The overall time complexity

· [2

+ 2

∑

i=0

· (

127

)

127

)] = 2

57.1

The memory requirement is 2

words and the

keystream is of length 2

words.

4 DIFFERENTIAL CHOSEN IV

ATTACKS ON REDUCED

ROUND SNOW 3G

⊕

Now we look at the full SNOW 3G

⊕

(with the feed-

back). We consider a differential chosen IV attack

scenario. Assume that we have two 128-bit IVs dif-

fering only in the most signiﬁcant word IV

, which

gives the difference in s

of the LFSR. As mentioned

þÿANALYSIS OF SNOW 3G"• RESYNCHRONIZATION MECHANISM

329

below in Section 4.2 and Section 4.3, we can restrict

the difference to a single byte of IV

in order to reduce

the complexity of our attacks. Denote this difference

by ∆d. Then until round 10, this difference will not

affect the FSM. In round 11, the known ∆d enters the

FSM word R

4.1 Reduced Initialization of 12 Rounds

Since all the differences in the FSM are 0, there are

no differences fed back into the LFSR. Thus the dif-

ferences in the LFSR are all known. Our knowledge

of differences in the FSM is shown below. We try to

compute the unknown values (”?”s) in this table.

round clock t ∆R

∆R

11 −1 ∆d 0 0

12 0 ∆d ? 0

1 ? ?

From the keystream equation ∆z

= ∆s

⊕ ∆R

⊕

∆R

⊕ ∆s

, where ∆R

= ∆d, we get ∆R

, which

gives us immediately ∆R

and also ∆R

from the

next keystream equation. Therefore, we have only

one known sequence (∆R

−1

= ∆d, ∆R

−1

= ∆R

−1

0, ∆R

= ∆d, ∆R

,∆R

= 0, ∆R

,∆R

). Now we

know the input and output difference of S

: ∆R

−1

∆d → S

→ ∆R

. Thus, we switch from the differ-

ences of the FSM words to the individual values of

them, similar to the procedures explained in Section

3. The time complexity is 10 ·

127

= 2

6.4

steps. Af-

terwards we insert the individual values of the FSM

into the keystream generation equations and the FSM

update equations to get a linear system of the LFSR

initial states with a complexity of 2

. We use the

keystream equation of clock 12 to check the candi-

dates. The total time complexity is 2

6.4

+ 2

= 2

10.1

steps, the memory complexity is small and the known

keystream is only 12 words for each IV.

4.2 Reduced Initialization of 13 Rounds

Here we extend the attack above by one more round.

In the 13 round case, since all the differences in the

FSM until now are either 0 or the known ∆d, no un-

known difference was fed back into the LFSR. Thus,

the differences in the LFSR values are known. We

compute ”?”s in the following table as follows.

round clock t ∆R

∆R

11 −2 ∆d 0 0

12 −1 ∆d ? 0

13 0 ? ?

From ∆z

and ∆R

, we have

∆z

= ∆s

⊕ ∆R

−1

⊕ ∆s

−1

⊕ ∆R

⊕ ∆s

which is

∆R

−1

⊕ ∆R

= ∆z

⊕ ∆s

−1

⊕ ∆s

Then we replace the differences at the left side with

their S-Boxes description, denote the known part at

the right side with k

and get the equation

out

∆

(∆d)⊕

out

∆

(∆d) = ∆k

Multiplying by MC

−1

, we get the byte form equation







out

∆

(∆d

)

out

∆

(∆d

)

out

∆

(∆d

)

out

∆

(∆d

)







⊕







out

∆

(∆d

)

out

∆

(∆d

)

out

∆

(∆d

)

out

∆

(∆d

)







= MC

−1







∆k







We can check these four byte equations in

4· 2

= 2

steps. The number of solutions will be

·2

= 2

pairs of (∆R

−1

,∆R

). We have 2

sequences (∆R

−2

= ∆d, ∆R

−2

= ∆R

−2

= 0,∆R

−1

∆d,∆R

−1

,∆R

−1

= 0,∆R

,∆R

). Again, we switch

from the differences of the FSM words to the in-

dividual values of them by using the input and

output difference of S

: ∆R

−2

= ∆d → S1 →

∆R

−1

. The time complexity of this step is

∑

i=0

· (

127

)

127

= 2

28.09

. In the end, we have

· (

127

)

= 2

14.45

difference sequences left. The

memory complexity is 2

· 10· 3 = 2

29.91

words. We

then insert the individual values of the FSM into the

keystream generation equations and the FSM update

equations to get a linear system of the LFSR ini-

tial states. This would need a time complexity of

294

127

· 2

= 2

24.45

. The overall time complexity is

∑

i=0



· (

127

)

127



294

127

· 2

= 2

28.2

steps. The memory complexity is 2

29.91

words and the

keystream is of length 12 words for each IV.

If we restrict the known arbitrary difference ∆d to

a word with three bytes equal to zero and only one non

zero byte, we can reduce our attack complexity con-

siderably. We then have only one pair (∆R

−1

,∆R

)

of difference left, as in the attack on 12 rounds ex-

plained in Section 4.1. In this way, we will have the

same time complexity 2

10.1

and the memory require-

ment is small. The keystream will be of 12 words for

each IV.

4.3 Reduced Initialization of 14 Rounds

Nearly all the differences in the LFSR are known, the

only unknowndifference is ∆R

−2

, which was fed back

SECRYPT 2010 - International Conference on Security and Cryptography

330

into the LFSR, the remaining differences are either 0

or the known ∆d. We guess the individual value R

−3

1,a

for the ﬁrst pair (K,IV

) with complexity of 2

. From

the value R

−3

1,a

, we get with ∆R

−3

= ∆d the value R1

−3

for the second pair (K,IV

). Furthermore we obtain

−2

2,a

−2

2,b

−1

3,a

−1

3,b

. We denote the known difference

∆R

−2

with ∆k

, the linear dependent ∆R

−1

with ∆k

and ∆R

−1

with ∆k

. This gives the following differ-

ences for the FSM.

round clock t ∆R

∆R

11 −3 ∆d 0 0

12 −2 ∆d ∆k

13 −1 ∆k

? ∆k

14 0 ? ?

From

∆z

= ∆s

⊕ ∆R

⊕ ∆s

we insert the update equations for ∆R

and ∆R

and

receive

∆z

= ∆s

⊕

out

∆

(∆d) ⊕ ∆k

⊕ ∆s

−1

⊕

out

∆

(∆k

) ⊕ ∆s

which gives

out

∆

(∆d)⊕

out

∆

(∆k

)

= ∆z

⊕ ∆s

⊕ ∆k

⊕ ∆s

−1

⊕ ∆s

We denote the known right part by ∆k

, multiply the

equation with MC

−1

and rewrite it in byte notation as







out

∆

(∆d

)

out

∆

(∆d

)

out

∆

(∆d

)

out

∆

(∆d

)







⊕







out

∆

(∆k

)

out

∆

(∆k

)

out

∆

(∆k

)

out

∆

(∆k

)







= MC

−1







∆k







Then we check this equation line by line for each

byte in 4 · 2

= 2

steps. The number of solutions

will be

·2

= 2

pairs of (∆R

−1

,∆R

). Again,

we switch from the differences of the FSM words to

the individual values of them by using the input and

output difference of S

: ∆R

−2

→ S

→ ∆R

−1

. Since

we start with 2

sequences, we have completely the

same procedure as in the attack on 13 rounds of ini-

tialization and thus the same complexities. The over-

all time complexity is the same as that in 12 rounds of

initialization for each guess of R1

−3

, which gives

∑

i=0



·(

127

)

127



294

127

·2

60.2

The memory requirement is 2

29.91

words and the

keystream is of length 12 words for each IV.

If we restrict the known difference ∆d to only one

byte in IV

, we can reduce our attack complexity to

42.7

with similar procedures as above. The corre-

sponding memory complexity is 2

words and the

keystream is of 12 words for each IV.

4.4 Reduced Initialization of 15 Rounds

and 16 Rounds

Nearly all the differences in the LFSR are known,

only two unknown differences ∆R

−3

and ∆R

−2

were

fed back into the LFSR, the remaining differences are

either 0 or the known ∆d. We guess the individual

values of R

−4

1,a

and R

−3

1,a

for the ﬁrst pair (K,IV

) with

complexity of 2

. From the value R

−4

1,a

and ∆R

−4

∆d, we get the values of R

−4

1,b

, R

−3

2,a

−3

2,b

, R

−2

3,a

−2

3,b

. De-

note the known difference ∆R

−3

by ∆k

, ∆R

−2

by ∆k

and ∆R

−2

by ∆k

. From R

−3

1,a

and ∆R

−3

= ∆d, we get

the values of R

−3

1,b

−2

2,a

−2

2,b

−1

3,a

−1

3,b

. Again, we de-

note the now known difference ∆R

−2

by ∆k

, ∆R

−1

by ∆k

and ∆R

−1

by ∆k

. This gives the following

differences for the FSM.

round clock t ∆R

∆R

11 −4 ∆d 0 0

12 −3 ∆d ∆k

13 −2 ∆k

∆k

14 −1 ∆k

? ∆k

15 0 ? ?

We have now the same starting point as that of the

attack on 14 initialization rounds. We proceed in the

way as explained there. Since we guessed one more

word in the beginning of the attack, the time complex-

ity becomes

· 2

60.2

= 2

92.2

The memory complexity remains 2

29.91

words and the

keystream is of length 12 words for each IV.

In the 16 rounds case, we guess one more word

and then proceed as that of the attack on 15 rounds.

The time complexity is

· 2

92.2

= 2

124.2

and the memory complexity remains 2

29.91

words and

the keystream is of length 12 words for each IV.

The summary of our results is given in Table 1.

5 CONCLUSIONS

In this paper, we have shown known IV and chosen

IV resynchronization attacks on SNOW 3G

⊕

. We can

attack arbitrary many key/IV setup rounds of SNOW

⊕

if there is no feedback from FSM to LFSR. With

such feedback, we show key recovery attacks up to

16 rounds of initialization by using a few keystream

words. Our results indicate that about half of the ini-

tialization rounds of SNOW 3G

⊕

might succumb to

chosen IV resynchronization attacks. The remaining

þÿANALYSIS OF SNOW 3G"• RESYNCHRONIZATION MECHANISM

331

Table 1: The summary of our results on SNOW 3G

⊕

attack data time memory

SNOW 3G

⊕

57.1

without feedback

SNOW 3G

⊕

with feedback

12 rounds 24 2

10.1

small

13 rounds with 1 24 2

10.1

small

byte difference ∆d

14 rounds with 1 24 2

42.7

byte difference ∆d

15 rounds 24 2

92.2

29.91

16 rounds 24 2

124.2

29.91

security margin however is quite signiﬁcant and thus

these attacks pose no threat to the security of SNOW

3G itself.

REFERENCES

Billet, O. and Gilbert, H. (2005). Resistance of SNOW 2.0

Against Algebraic Attacks. In Topics in Cryptology-

CT-RSA’2005. LNCS vol. 3376, pp. 19-28. Springer-

Verlag 2005.

Ekdahl, P. and Johansson T. (2002). A New Version of

the Stream Cipher SNOW. In Selected Areas in

Cryptography-SAC 2002. LNCS vol. 1233, pp. 37-46.

Springer-Verlag 2002.

ETSI/SAGE. (2006). Speciﬁcation of the 3GPP Conﬁden-

tiality and Integrity Algorithms UEA2 & UIA2. Doc-

ument 2: SNOW 3G Speciﬁcation, version 1.1 In

September 2006. http://www.3gpp.org/ftp/..

ETSI/SAGE (2006). Speciﬁcation of the 3GPP Conﬁden-

tiality and Integrity Algorithms UEA2 & UIA2. Doc-

ument 5: Design and Evaluation Report, version 1.1

In September 2006. http://www.3gpp.org/ftp/.

Nyberg, K. and Wall´en, J. (2006). Improved Linear Distin-

guishers for SNOW 2.0. In Fast Software Encryption-

FSE 2006. LNCS vol. 4047, pp. 144-162. Springer-

Verlag 2006.

Watanabe, D., Biryukov, A., De Canni`ere, Christophe,

(2004). A Distinguishing Attack of SNOW 2.0

with Linear Masking Method. In Selected Areas in

Cryptography-SAC 2003. LNCS vol. 3006, pp. 222-

233. Springer-Verlag 2004.

APPENDIX

We want to simplify the equation

out

∆

(∆k

)⊕

out

∆

(∆k

) = ∆k

The main difﬁculty is that S

and S

use the same

Mix-Column matrix but over two different ﬁelds

GF(2

). At ﬁrst we rewrite this equation in the byte

notation as







out

∆

(∆k

)

out

∆

(∆k

)

out

∆

(∆k

)

out

∆

(∆k

)







⊕ MC







out

∆

(∆k

)

out

∆

(∆k

)

out

∆

(∆k

)

out

∆

(∆k

)













∆k







Then multiplying this equation with the inverse ma-

trix MC

−1

, we get

−1













out

∆

(∆k

)

out

∆

(∆k

)

out

∆

(∆k

)

out

∆

(∆k

)













⊕







out

∆

(∆k

)

out

∆

(∆k

)

out

∆

(∆k

)

out

∆

(∆k

)







= MC

−1







∆k







If we expand the matrix multiplications and have a

look at the byte vectors, it shows that the ﬁrst entry of

the ﬁrst vector contains the byte

out

∆

(∆k

) and a byte

polynomial containing only the most signiﬁcant bits

of all four

out

∆

values. We denote this polynomial

with p

msb

. The other three rows have similar struc-

tures, but with differentpolynomials p

msb

(i = 1, 2,3).

Therefore we can rewrite the equation to







out

∆

(∆k

)

out

∆

(∆k

)

out

∆

(∆k

)

out

∆

(∆k

)













out

∆

(∆k

)

out

∆

(∆k

)

out

∆

(∆k

)

out

∆

(∆k

)







⊕







msb







⊕ MC

−1







∆k







We denote by m

the most signiﬁcant bit of the

value

out

∆

(∆k

) and with m

the most signiﬁcant bit

of the value

out

∆

(∆k

) as well as m

for

out

∆

(∆k

)

and m

for

out

∆

(∆k

). Then the polynomials p

msb

SECRYPT 2010 - International Conference on Security and Cryptography

332

i = 0,. . . ,3 are

msb

=(m

⊕ m

+ (m

⊕ m

+ (m

⊕ m

+ (m

⊕ m

+ (m

⊕ m

+ (m

⊕ m

+ (m

⊕ m

)

msb

=(m

⊕ m

+ (m

⊕ m

+ (m

⊕ m

+ (m

⊕ m

+ (m

⊕ m

+ (m

⊕ m

+ (m

⊕ m

)

msb

=(m

⊕ m

+ (m

⊕ m

+ (m

⊕ m

+ (m

⊕ m

+ (m

⊕ m

+ (m

⊕ m

+ (m

⊕ m

)

msb

=(m

⊕ m

+ (m

⊕ m

+ (m

⊕ m

+ (m

⊕ m

+ (m

⊕ m

+ (m

⊕ m

+ (m

⊕ m

)

þÿANALYSIS OF SNOW 3G"• RESYNCHRONIZATION MECHANISM

333