10

I have been doing research on the available encryption algorithms used by commercial mobile providers worldwide, and would like to know if the following list is complete:

Algorithms for voice encryption:

  • A5/1: the "original" unweakened GSM encryption algorithm
  • A5/2: the "export variant" weakened version of A5/1
  • A5/3: KASUMI, in use in 3G networks, stronger than A5/1
  • A5/4: SNOW 3G, in use in 4G LTE networks
  • A5/0: no encryption (doesn't count as encryption, here for sake of completeness only)

Algorithms for packet data encryption:

  • GEA/0: no encryption, here for sake of completeness.
  • GEA/1: used for GSM GPRS/EDGE/3G/4G, 64-bit keylength, 96-bit state, proprietary stream cipher. Broken, can use gprsdecode for decryption.
  • GEA/2: used for GSM GPRS/EDGE/3G/4G, 64-bit keylength, 125-bit state, proprietary stream cipher. Broken, as with GEA/1 can be decoded with gprsdecode.
  • GEA/3: used for GSM GPRS/EDGE/3G/4G, 64-bit keylength, 128-bit state, based off KASUMI. Limited break, as with A5/3.
  • GEA/4: used for GSM GPRS/EDGE/3G/4G, 128-bit keylength, 128-bit state, based off KASUMI.

This list covers only global implementations of "2G", "3G" and "4G" mobile networks, and does not include TETRA and IDEN. Help and corrections to this list would be very appreciated.

Additional sources:

StackzOfZtuff
  • 17,783
  • 1
  • 50
  • 86
Nasrus
  • 1,250
  • 12
  • 13
  • @drewbenn yes. Basically all commercially used and widely available cellular encryption algorithms used worldwide, starting from GPRS and GSM. – Nasrus Sep 05 '15 at 02:45
  • @drewbenn: Thanks for the links. So to clarify, CMEA/ORYX is used for 2G CDMA (and relatively unsafe), and for 3G and 4G CDMA AES is used in their Enhanced Privacy Algorithm (Seems like AES-128...so relatively safe right?). Is this correct? Or are there any "reduced strength" algorithms used in CDMA, as in GSM's A5/2? – Nasrus Sep 06 '15 at 07:45
  • @Nasrus Your research is available somewhere? Im doing kind of the same research. – rew1nd Jun 07 '17 at 11:41
  • @rew1nd Sorry for the delayed reply. Actually, the above information is a sort of compilation of cellular encryption algorithms in use globally, and my open sources are at the bottom of the question. The research in the sources is not by me, but by others. – Nasrus Jun 21 '17 at 07:31

1 Answers1

3

You have the other comments already. As a minor point, the list isn't quite correct in two areas:

  1. A5/4 isn't Snow 3G - it is a full length 128-bit key version of A5/3 using the Kasumi algorithm. See 3GPP TS 55.226. The Kasumi algorithm applied to GSM uses a 64 bit key bulked out to 128 bits for algorithm input. A5/4 extended that to using the full 128 bits

  2. LTE confidentiality algorithms. Yes, EEA-1 with a 128 bit key, based on SNOW 3G is available, but 128-bit AES EEA-2 is also available. More recently, EEA-3 has become available, based on the ZUC stream cipher. See, for instance [1] ETSI/SAGE Specification, Specification of the 3GPP Confidentiality and Integrity Algorithms 128-EEA3 & 128-EIA3. Document 1: 128-EEA3 and 128-EIA3 Specification; Version: 1.6, (2011). [2] ETSI/SAGE Specification, Specification of the 3GPP Confidentiality and Integrity Algorithms 128-EEA3 & 128-EIA3. Document 2: ZUC Specification, Version: 1.6, (2011)

Kit Kilgour
  • 31
  • 3