An Improved SCARE Cryptanalysis Against a Secret A3/A8 GSM Algorithm
An Improved SCARE Cryptanalysis Against a Secret A3/A8 GSM Algorithm
复制标题
DOI：
10.1007/978-3-540-77086-2_11
复制
发表时间：
2007-12
影响因子：
5.2
通讯作者：
Christophe Clavier
中科院分区：
文献类型：
--
作者：
Christophe Clavier
侧信道分析作为一种实用的、强有力的手段，已经被公认为是一种可以揭示已知密码算法的密钥的方法。这种密码分析很少被应用于对专有算法规范的重要部分进行反向工程。在[8]中，Novak描述了如何恢复A3/A8算法（GSM网络的认证和会话密钥生成算法）的秘密实例的一个（两个中的一个）替换表的内容。然而，从实际的观点来看，他的攻击有两个缺点。首先，为了检索一个替换表（T2），攻击者必须知道另一个替换表（T1）的内容。其次，攻击者还必须知道密钥K的值。本文改进了Novak的密码分析，并展示了如何在没有任何关于密钥的先验知识的情况下检索两个替换表（T1和T2）。此外，我们的攻击也恢复的秘密key.With这方面的贡献，我们打算提出一个实际的SCARE（侧通道分析逆向工程）攻击，预计这一新领域的侧通道信号开发越来越大的兴趣，并提醒，如果需要的话，安全性不能实现单独的模糊。
Side-channel analysis has been recognized for several years as a practical and powerful means to reveal secret keys of publicly known cryptographic algorithms. Rarely this kind of cryptanalysis has been applied to reverse engineer a non-trivial part of the specifications of a proprietary algorithm. The target here is no more one’s secret key value but the undisclosed specifications of the cryptographic algorithm itself.In [8], Novak described how to recover the content of one (out of two) substitution table of a secret instance of the A3/A8 algorithm, the authentication and session key generation algorithm for GSM networks. His attack presents however two drawbacks from a practical viewpoint. First, in order to retrieve one substitution table (T2), the attacker must know the content of an other one (T1). Second, the attacker must also know the value of the secret keyK.In this paper, we improve on Novak’s cryptanalysis and show how to retrievebothsubstitution tables (T1andT2)without any prior knowledge about the secret key. Furthermore, our attack also recovers the secret key.With this contribution, we intend to present a practical SCARE (Side Channel Analysis for Reverse Engineering) attack, anticipate a growing interest for this new area of side-channel signal exploitation, and remind, if needed, that security cannot be achieved by obscurity alone.