KASUMI is a block cipher used in UMTS, GSM, and GPRS mobile communications systems. In UMTS, KASUMI is used in the confidentiality (f8) and integrity algorithms (f9) with names UEA1 and UIA1, respectively.^[1] In GSM, KASUMI is used in the A5/3 key stream generator and in GPRS in the GEA3 key stream generator.

KASUMI was designed for 3GPP to be used in UMTS security system by the Security Algorithms Group of Experts (SAGE), a part of the European standards body ETSI.^[2] Because of schedule pressures in 3GPP standardization, instead of developing a new cipher, SAGE agreed with 3GPP technical specification group (TSG) for system aspects of 3G security (SA3) to base the development on an existing algorithm that had already undergone some evaluation.^[2] They chose the cipher algorithm MISTY1 developed^[3] and patented^[4] by Mitsubishi Electric Corporation. The original algorithm was slightly modified for easier hardware implementation and to meet other requirements set for 3G mobile communications security.

KASUMI is named after the original algorithm MISTY1 — 霞み (hiragana かすみ, romaji kasumi) is the Japanese word for "mist".

In January 2010, Orr Dunkelman, Nathan Keller and Adi Shamir released a paper showing that they could break Kasumi with a related-key attack and very modest computational resources; this attack is ineffective against MISTY1.^[5]

Description

KASUMI algorithm is specified in a 3GPP technical specification.^[6] KASUMI is a block cipher with 128-bit key and 64-bit input and output. The core of KASUMI is an eight-round Feistel network. The round functions in the main Feistel network are irreversible Feistel-like network transformations. In each round the round function uses a round key which consists of eight 16-bit sub keys derived from the original 128-bit key using a fixed key schedule.

Key schedule

The 128-bit key K is divided into eight 16-bit sub keys K_i:

${\displaystyle K=K_{1}\|K_{2}\|K_{3}\|K_{4}\|K_{5}\|K_{6}\|K_{7}\|K_{8}\,}$

Additionally a modified key K', similarly divided into 16-bit sub keys K'_i, is used. The modified key is derived from the original key by XORing with 0x123456789ABCDEFFEDCBA9876543210 (chosen as a "nothing up my sleeve" number).

Round keys are either derived from the sub keys by bitwise rotation to left by a given amount and from the modified sub keys (unchanged).

The round keys are as follows:

${\displaystyle {\begin{array}{lcl}KL_{i,1}&=&{\rm {ROL}}(K_{i},1)\\KL_{i,2}&=&K'_{i+2}\\KO_{i,1}&=&{\rm {ROL}}(K_{i+1},5)\\KO_{i,2}&=&{\rm {ROL}}(K_{i+5},8)\\KO_{i,3}&=&{\rm {ROL}}(K_{i+6},13)\\KI_{i,1}&=&K'_{i+4}\\KI_{i,2}&=&K'_{i+3}\\KI_{i,3}&=&K'_{i+7}\end{array}}}$

Sub key index additions are cyclic so that if i+j is greater than 8 one has to subtract 8 from the result to get the actual sub key index.

The algorithm

KASUMI algorithm processes the 64-bit word in two 32-bit halves, left (${\displaystyle L_{i}}$) and right (${\displaystyle R_{i}}$). The input word is concatenation of the left and right halves of the first round:

${\displaystyle {\rm {input}}=R_{0}\|L_{0}\,}$.

In each round the right half is XOR'ed with the output of the round function after which the halves are swapped:

${\displaystyle {\begin{array}{rcl}L_{i}&=&F_{i}(KL_{i},KO_{i},KI_{i},L_{i-1})\oplus R_{i-1}\\R_{i}&=&L_{i-1}\end{array}}}$

where KL_i, KO_i, KI_i are round keys for the i^th round.

The round functions for even and odd rounds are slightly different. In each case the round function is a composition of two functions FL_i and FO_i. For an odd round

${\displaystyle F_{i}(K_{i},L_{i-1})=FO(KO_{i},KI_{i},FL(KL_{i},L_{i-1}))\,}$

and for an even round

${\displaystyle F_{i}(K_{i},L_{i-1})=FL(KL_{i},FO(KO_{i},KI_{i},L_{i-1}))\,}$.

The output is the concatenation of the outputs of the last round.

${\displaystyle {\rm {output}}=R_{8}\|L_{8}\,}$.

Both FL and FO functions divide the 32-bit input data to two 16-bit halves. The FL function is an irreversible bit manipulation while the FO function is an irreversible three round Feistel-like network.

Function FL

The 32-bit input x of ${\displaystyle }$Zdroj:https://en.wikipedia.org?pojem=KASUMI_(block_cipher)
>Text je dostupný pod licencí Creative Commons Uveďte autora – Zachovejte licenci, případně za dalších podmínek. Podrobnosti naleznete na stránce Podmínky užití.