A5/2 could be attacked with cipher-text only, using the Error Correction Code, in order to retrieve the session key.

For the purpose of simplicity suppose that the error correction code copy the plaintext 4 time. e.g., for $𝑚=1010101$ we will encrypt the following bits: $1010101 \space 1010101 \space 1010101 \space 1010101 \space 1010101$.

Here's an example of a message and a corresponding cipher:

$𝑚'= 1010101 \space 1010101 \space 1010101 \space 1010101 \space 1010101$ $𝑐= 0110100 \space 1000001 \space 1101111 \space 0000101 \space 1010111$

Bold bits are from the same bit in plaintext.

How can I find the session key this way?

I guess I need to make some linear functions, such as:

$p_0 \oplus k_0 = 0$,

$p_0 \oplus k_8 = 1$,


But I can't really find the key this way.


1 Answer 1


The idea in [1] (disregarding reception errors) is to first remove the impact of the message. This is done by computing the syndrome

$\qquad\qquad\mathbf{H} \mathbf{v} = \mathbf{H} (\mathbf{m} \oplus \mathbf{k}) = \mathbf{H}\mathbf{k}$.

In the case of a ${1}/{5}$ repetition code, this could correspond to adding even number of (bold) codeword symbols together (since it is a repetition code they should be equal, right?), forming linear equations containing only keystream bits. Then, by exhaustively trying all $2^{16}$ starting states, it is possible to mount an attack (for each starting state) consisting of Guassian elimination, solving for the session key.

I found a reference implemenation at [2], which you might want to check out.

[1] http://www.cs.technion.ac.il/users/wwwb/cgi-bin/tr-get.cgi/2006/CS/CS-2006-07.pdf

[2] http://www.npag.fr/project-a52hacktool

  • $\begingroup$ I've look at 2, but I still can't understand the basic flow of the attack. 1. Is creating the linear equations is in the manner I showed in the question? 2. What is acutually done when guessing all the starting states? Let's say we guessed 16 bits of some starting state. Now I can calculate the state of the other registers and see what key they outputted. Now I put this in the equations, insert them into matrices and perform Gaussian elimination? $\endgroup$
    – Jjang
    Jun 28, 2016 at 16:21
  • $\begingroup$ Well, yes. It will be a combination of key bits. A certain state will clock the three internal LFSRs in one way, and another state differently. See Fig 1 in [1]. Note that I have omitted details that also can be found in [1], I suggest you read the KPA part (Sect 3) in detail. $\endgroup$ Jun 30, 2016 at 10:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.