Search

We present two efficient and simple fault attacks on the shrinking generator. In a first case if the attacker can stop control generator for some small number of steps and observe the output, then with high probability he can deduce the full control sequence, and so the other input bitstream. The second method assumes that the attacker can disturb the control sequence (in an unpredictable and random way) and observe many samples of such experiments. Then he can reconstruct a certain sequence that agrees with the input sequence of the generator on a large fraction of bits. [ABSTRACT FROM AUTHOR]

We consider distribution of encryption keys for "pay-per-view" broadcasting systems with a dynamic set of users. We assume that the active recipients in such a system (i.e. those who pay for the current transmission) obtain a key necessary for decoding the transmission. If the set of recipients changes, the system has to update the key and inform the legitimate users about the change. Communication medium we consider here is an ad hoc network of users organized in the same way as GSM or UMTS: the service area is divided into cells, each cell serves a limited number of users. Communication with the users in a cell is through a shared communication channel of this cell. We present a procedure for distributing a new key to a new set of active users. We pursue three goals: communication volume related to a change of the encryption key should be kept as small as possible, the energy cost for each legitimate user should be low, the update process should not reveal any information about users behavior. Our scheme is based on balanced allocation algorithms. It is simple, easy to implement, preserves anonymity. It has small communication overhead and low energy cost for the users. It works very well for a practical parameter size. Keywords: Data broadcast, anonymity, balanced allocation. [ABSTRACT FROM AUTHOR]

A5/1 pseudo-random bit generator, known from GSM networks, potentially might be used for different purposes, such as secret hiding during cryptographic hardware testing, stream encryption in piconets and others. The main advantages of A5/1 are low cost and a fixed output ratio. We show that a hardware implementation of A5/1 and similar constructions must be quite careful. It faces a danger of a new kind of attack, which significantly reduces possible keyspace, allowing full recovery of A5/1 internal registers' content. We use "fault analysis" strategy: we disturb the A5/1 encrypting device (namely, clocking of the LFSR registers) so it produces an incorrect keystream, and through error analysis we deduce the state of the internal registers. If a secret material is used to initialize the generator, like in GSM, this may enable recovering the secret. The attack is based on unique properties of the clocking scheme used by A5/1, which is the basic security component of this construction. The computations that have to be performed in our attack are about 100 times faster than in the cases of the previous fault-less cryptanalysis methods. Keywords: fault cryptanalysis, A5/1, GSM, LFSR. [ABSTRACT FROM AUTHOR]