I have read the Wikipedia article that states Dunkelman, Keller and Shamir managed in 2010 to mount a related-key attack in a pretty decent time (2hrs) with a Core 2 Duo.
Why was Kasumi breakable in 2G (A5/3), but not in 3G?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.Sign up to join this community
KASUMI is not "broken in 2G". In fact it is not even used in 2G. 2G systems use algorithms A5/1 and/or A5/2, which are unrelated to KASUMI (which is A5/3).
The 2010 attack is a "related-key attack": it is a rather esoteric kind of attack in which the attacker obtains plaintext/ciphertext pairs that are encrypted with different keys, but such that the keys differ in a specific and attacker-known way. In that kind of setup, Dunkelman, Keller and Shamir can rebuild the key after some computations (the two hours worth of computation time). However, this still relies on the exact situation with the keys that differ by known amounts; such a situation does not arise in 3G networks. In fact, related-key attacks almost never apply in practice, and in general we don't care much about them (e.g. they were not part of the AES selection criteria); they still count as noteworthy, at least academically speaking, because an ideal cipher, defined as a uniform selection of the cipher among the whole set of possible permutations over the space of block values, should not have even related-key attacks.