1. Kingdom Special Operations SJS-KW
A5 GSM Encryption Ki
Kingdom Special Operations
SJS-KW

2. Encryption key words Symmetric algorithms Public key algorithmsKi
Symmetric algorithms
Block ciphers
Stream ciphers
Public key algorithms
One-way hash functions

3. GSM Security Features Distribution of security features SIM= MS= BS=
A3 & A8 IMSI Ki TMSI/LAI Kc/CKSN
MS= A5
BS=
A5 Kc [TMSI/IMSI = VLR] MS
SIM BS
MSC

4. GSM Security Features AuthenticationKi
Authentication
MS and network compute SRES from RAND
Network [VLR] compares results
RAND BS MS
SRES = A3(RAND , Ki)
SRES = A3(RAND , Ki) =?
Fail
Authentication
Successful

5. GSM Security Features Key generation Kc is computed from RAND Ki Kc KcBS MS
Kc = A8(RAND , Ki)
Kc = A8(RAND , Ki) Kc Kc A5 A5
TDMA
frame
DATA
TDMA
frame

6. How A5 GSM Encryption runKi
Three clock controlled LFSRs
Feedback polynomials have degree 19,23, and 22 (their sum is 64)
The 64-bit cipher key initializes the LFSRs
22-bit TDMA frame number is fed in
Two 114-bit key streams (uplink and downlink)

7. A5 GSM Encryption of dataKi
REG_FILE
9x16 Bit
LFSR
data
cip_key:86
A5 mode
done
start
ld_key
clk_en
cip_bit
sel
CONTROL
clk
AT MS*
AT BTS*
reset
data wr
sel
add
cip_add
CIP_SEQ_RAM
30x8 Bit
cip_data

8. A5 GSM x3 register EncryptionKi
LFSRs
R1 : 19
Out
Func
R2 : 23
R3 : 22
Clock Control
Kc : 64
Frame: 22

9. A5 GSM Encryption FSM CONTROL Ki idle load key roll 100 blk_1 blk_2
done

10. A5 GSM Encryption Registers TMDA Frame number 22Bits Kc Cipher Key 64Ki
Registers
TMDA Frame number 22Bits
Kc Cipher Key 64

11. A5.1 vs. A5.2 Export restrictions Implementation Differences A5.1 A5.2Ki
Export restrictions
A5.1 algorithm is not exportable to designated countries [Only In Europe]
A5.2 algorithm modified for export
Implementation Differences A5.1 A5.2
Output function
Clock control
Control unit