Tech-invite  3GPPspace  IETFspace
◀  ▶  21  22  23  24  25  26  27  28  29  31  32  33  34  35  36  37  38  4‑5x
Top   in Index   Prev   Next

TR 33.909
3G Security; Report on the design and evaluation of the MILENAGE algorithm set;
Deliverable 5: an example algorithm for the 3GPP authentication and key generation functions

3GPP‑Page   ETSI‑search
V4.0.1 (Wzip)  2001/07  30 p.
Rapporteur:
Prof. Walker, Michael

full Table of Contents for  TR 33.909  Word version:  4.0.1

1Scope  p. 6
2References  p. 6
3Abbreviations  p. 7
4Structure of this report  p. 8
5Background to the design and evaluation work  p. 8
6Summary of algorithm requirements  p. 9
6.1General requirements for 3GPP cryptographic functions and algorithms  p. 9
6.2Authentication and key agreement functions  p. 9
6.2.1Implementation and operational considerations  p. 9
6.2.2Type of algorithm  p. 9
6.2.2.1f1  p. 9
6.2.2.2f1*  p. 10
6.2.2.3f2  p. 10
6.2.2.4f3  p. 10
6.2.2.5f4  p. 10
6.2.2.6f5  p. 10
6.2.2.7f5*  p. 10
7Design criteria  p. 11
7.1Cryptographic Criteria  p. 11
7.2Implementation Criteria  p. 11
7.3The need for an Operator Variant Algorithm Configuration Field  p. 11
7.4Criteria for the cryptographic kernel  p. 11
7.4.1Implementation and operational considerations  p. 12
7.4.2Functional requirements  p. 12
7.4.3Types and parameters for the kernel  p. 12
8The 3GPP MILENAGE algorithms  p. 13
9Rationale for the chosen design  p. 13
9.1Block ciphers vs. hash functions  p. 13
9.2The choice of Rijndael  p. 14
9.3The MILENAGE architecture  p. 15
9.3.1Use of OP  p. 15
9.3.2Rotations and constants  p. 15
9.3.3Protection against side-channel attacks  p. 15
9.3.4The number of kernel operations  p. 15
9.3.5Mode of operation  p. 15
10Evaluation  p. 16
10.1Evaluation criteria  p. 16
10.2Operational Context  p. 17
10.3Analysis  p. 17
10.3.1A formal proof of the soundness of the f2-f5* construction  p. 17
10.3.2On the f1-f1* construction and its separation from f2-f5*  p. 19
10.3.2.1Soundness of the f1-f1* construction  p. 19
10.3.2.2Separation between f1-f1* and f2-f5*  p. 19
10.3.3Investigation of forgery or distinguishing attacks with 264 queries  p. 20
10.3.3.1An internal collision attack against f1 (or f1*)  p. 20
10.3.3.2Forgery or distinguishing attacks against combinations of several modes  p. 21
10.3.3.2.1Attacks against combinations of f2-f5  p. 21
10.3.3.2.2Attacks against combinations of f1-f1* and f2-f5*  p. 21
10.3.3.3Conclusion about the identified forgery or distinguishing attacks  p. 22
10.4Statistical evaluation  p. 22
10.5Published attacks on Rijndael  p. 22
10.6Complexity evaluation  p. 23
10.6.1Complexity of draft Rijndael implementation  p. 23
10.6.2Estimate complexity of modes:  p. 23
10.6.3Estimate of total MILENAGE  p. 23
10.6.4SPA/DPA, Timing attack countermeasures  p. 24
10.6.5Conclusion on algorithm complexity  p. 24
10.7External complexity evaluations  p. 24
10.8Evaluation of side channel attacks  p. 25
10.8.1Evaluation of the kernel algorithm  p. 25
10.8.1.1Timing Attacks  p. 25
10.8.1.2Simple Power Analysis  p. 25
10.8.1.3Differential Power Analysis  p. 26
10.8.1.4Other side channels  p. 26
10.8.2Evaluation of the f1-f5 modes  p. 26
10.8.2.1Operator Constants (OP or OPc)  p. 26
10.8.2.2Rotations and constants  p. 27
10.8.3Conclusion on side channel attacks  p. 27
11Conclusions  p. 27
$Change history  p. 28

Top