# A5/2: Ciphertext Only Attack

A5/2 could be attacked with cipher-text only, using the Error Correction Code, in order to retrieve the session key.

For the purpose of simplicity suppose that the error correction code copy the plaintext 4 time. e.g., for $𝑚=1010101$ we will encrypt the following bits: $1010101 \space 1010101 \space 1010101 \space 1010101 \space 1010101$.

Here's an example of a message and a corresponding cipher:

$𝑚'= 1010101 \space 1010101 \space 1010101 \space 1010101 \space 1010101$ $𝑐= 0110100 \space 1000001 \space 1101111 \space 0000101 \space 1010111$

Bold bits are from the same bit in plaintext.

How can I find the session key this way?

I guess I need to make some linear functions, such as:

$p_0 \oplus k_0 = 0$,

$p_0 \oplus k_8 = 1$,

etc...

But I can't really find the key this way.

$\qquad\qquad\mathbf{H} \mathbf{v} = \mathbf{H} (\mathbf{m} \oplus \mathbf{k}) = \mathbf{H}\mathbf{k}$.
In the case of a ${1}/{5}$ repetition code, this could correspond to adding even number of (bold) codeword symbols together (since it is a repetition code they should be equal, right?), forming linear equations containing only keystream bits. Then, by exhaustively trying all $2^{16}$ starting states, it is possible to mount an attack (for each starting state) consisting of Guassian elimination, solving for the session key.