I have read the Wikipedia article that states Dunkelman, Keller and Shamir managed in 2010 to mount a related-key attack in a pretty decent time (2hrs) with a Core 2 Duo.

Why was Kasumi breakable in 2G (A5/3), but not in 3G?

  • $\begingroup$ Wikipedia is very widely used, but it is not authoritative. Anyone can become a contributor to Wikipedia, so keep that in mind when you read their articles. $\endgroup$
    – Patriot
    Jun 26, 2018 at 11:41
  • 1
    $\begingroup$ @Patriot That is why you always check the references. $\endgroup$
    – forest
    Dec 20, 2018 at 23:01

1 Answer 1


KASUMI is not "broken in 2G". In fact it is not even used in 2G. 2G systems use algorithms A5/1 and/or A5/2, which are unrelated to KASUMI (which is A5/3).

The 2010 attack is a "related-key attack": it is a rather esoteric kind of attack in which the attacker obtains plaintext/ciphertext pairs that are encrypted with different keys, but such that the keys differ in a specific and attacker-known way. In that kind of setup, Dunkelman, Keller and Shamir can rebuild the key after some computations (the two hours worth of computation time). However, this still relies on the exact situation with the keys that differ by known amounts; such a situation does not arise in 3G networks. In fact, related-key attacks almost never apply in practice, and in general we don't care much about them (e.g. they were not part of the AES selection criteria); they still count as noteworthy, at least academically speaking, because an ideal cipher, defined as a uniform selection of the cipher among the whole set of possible permutations over the space of block values, should not have even related-key attacks.

  • 3
    $\begingroup$ ... Also they usually rule ciphers out when it comes to building hash functions from them... $\endgroup$
    – SEJPM
    Jun 25, 2018 at 17:13
  • 4
    $\begingroup$ A5/3 is used in 2G voice as an option, along GPRS and EDGE. See 3GPP S3-000362. It has been deployed by operators. $\endgroup$
    – user71659
    Jun 25, 2018 at 17:55
  • 1
    $\begingroup$ Isn't A5/3 only 64 bits repeated twice to form the full 128-bit key for KASUMI, whereas A5/4 uses the full 128 bits?¹ If so, that would make it A5/3 effectively broken irrespective of related-key attacks. $\endgroup$
    – forest
    Jun 26, 2018 at 23:08
  • $\begingroup$ @forest That deserves to be an answer instead of a comment $\endgroup$ Jun 27, 2018 at 11:18
  • 2
    $\begingroup$ @forest Yes, A5/3 and GEA3 is 64 bits (see 3GPP TS 55.216 Table 3 Note 1 Pg 10). This is to allow compatibility with the 64-bit A5/1. $\endgroup$
    – user71659
    Jun 28, 2018 at 6:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.