UMTS Security

Valtteri Niemi received a PhD degree in Mathematics from the University of Turku, Finland in 1989. After serving in various positions at University of Turku, he became an Associate Professor in Mathematics at the University of Vaasa, Finland, during 1993-97. He joined Nokia Research Center, Helsinki in 1997 where he has contributed in several roles for Nokia research in the wireless security area, including cryptological aspects. In 2008, he moved to the new NRC laboratory in Lausanne, Switzerland, where his main focus is on privacy-enhancing technologies. He was nominated as a Nokia Fellow in January 2009. He has participated to the 3GPP SA3 standardization group from the beginning. During 2003-2009 he was the chairman of the group. Before 3GPP, Niemi took part in ETSI SMG 10 for GSM security work. He has published more than 40 scientific articles and he is a co-author of three books.Kaisa Nyberg is the author of UMTS Security, published by Wiley.

• Preface xiPART I: SECURITY ARCHITECTURE FOR UMTS 11 Introduction to Security and to UMTS 31.1 Security in Telecommunications 31.1.1 General security principles 41.1.2 GSM security 71.2 The Background to 3G 111.3 The 3G Partnership Project (3GPP) 121.4 3GPP Network Architecture 141.4.1 Elements in the architecture 151.4.2 Protocols in the 3GPP system 181.5 WCDMA Radio Technology 201.5.1 CDMA: an example 221.5.2 Basic facts of WCDMA 231.5.3 Handovers 251.5.4 Power control 252 UMTS Security Features in Release 1999 292.1 Access Security to UMTS 292.1.1 Mutual authentication 302.1.2 Temporary identities 422.1.3 UTRAN encryption 442.1.4 Integrity protection of RRC signalling 542.1.5 Set-up of UTRAN security mechanisms 592.1.6 Summary of access security in the CS and PS domains 632.2 Interworking with GSM 632.2.1 Interworking scenarios 652.2.2 Cases with SIM 662.2.3 Cases with USIM 672.2.4 Handovers from one system to another 682.3 Additional Security Features in Release 1999 692.3.1 Ciphering indicator 692.3.2 Identification of the UE 692.3.3 Security for Location Services (LCs) 702.3.4 User-to-USIM authentication 702.3.5 Security in the USIM application toolkit 702.3.6 Mobile Execution Environment (MExE) 702.3.7 Lawful interception 713 Security Features in Releases 4 and 5 733.1 Network Domain Security 733.1.1 MAPsec 743.1.2 IPsec 813.1.3 IPsec-based mechanisms in UMTS 843.1.4 Role of firewalls 863.2 IMS Security 873.2.1 Basics of SIP 873.2.2 IMS architecture 903.2.3 Architecture for securing access to the IMS 913.2.4 Principles for IMS access security 933.2.5 Use of HTTP Digest AKA 953.2.6 Security mode set-up 1003.2.7 Integrity protection with ESP 1013.2.8 Error case handling 1043.3 Other Security Systems 1063.3.1 Higher layer security systems 1063.3.2 Link layer security systems 108PART II: CRYPTOGRAPHIC ALGORITHMS 1114 Introduction to Cryptography 1134.1 The Science of Cryptology 1134.1.1 Cryptographic systems 1134.1.2 Security and vulnerability 1154.1.3 Developing cryptology into a publicly available science 1164.1.4 Public cryptographic development efforts 1184.2 Requirements and Analysis of Cryptographic Algorithms 1194.2.1 Block ciphers 1204.2.2 Stream ciphers 1254.2.3 Message authentication codes 1275 3GPP Algorithm Specification Principles 1316 Confidentiality and Integrity Algorithms 1356.1 Requirements for the Confidentiality Algorithm 1356.1.1 Functional requirements 1356.1.2 Algorithm operation 1366.1.3 Interfaces to the algorithm 1376.2 Requirements for the Integrity Algorithm 1396.2.1 Overview 1396.2.2 Interface 1406.3 Design Task Force 1426.4 Getting Started 1426.4.1 SAGE contribution to SA3 1436.4.2 Modes around MISTY1 1436.4.3 Particular security criteria 1446.5 Design Process 1446.5.1 The teams 1456.5.2 Design documentation 1456.5.3 Conclusion of evaluation 1486.6 Confidentiality Algorithm 1496.6.1 The f8 stream cipher mode 1496.6.2 Description of f8 1496.6.3 Security 1516.7 Extension of the UMTS Confidentiality Algorithm 1526.7.1 Background 1526.7.2 List of variables 1536.7.3 Core function KGCORE 1546.7.4 A5/3 algorithm for GSM encryption 1576.7.5 A5/3 algorithm for ECSD encryption 1586.7.6 GEA3 algorithm for GPRS encryption 1606.7.7 Specification of the 3GPP confidentiality algorithm f8 1616.7.8 Summary of the confidentiality functions 1626.8 Integrity Algorithm 1636.8.1 The f9 MAC mode 1636.8.2 Description 1646.8.3 Security 1656.9 Implementation 1686.9.1 Length of data 1686.10 IPR Issues and Exportability 1696.10.1 IPR issues 1696.10.2 Exportability 1697 Kernel Algorithm KASUMI 1717.1 Introduction 1717.2 MISTY Block Cipher Algorithms 1727.2.1 Design principles of MISTY1 1727.2.2 Security of MISTY 1767.3 Changes between MISTY1 and KASUMI 1787.3.1 Changes to the data encryption part 1787.3.2 Changes to the key-scheduling part 1797.4 Description of KASUMI 1797.4.1 General structure 1797.4.2 KASUMI encryption function 1817.4.3 Key schedule 1877.5 Mathematical Analysis of KASUMI by the Task Force 1887.5.1 Properties of components 1887.5.2 Differential cryptanalysis 1927.5.3 Truncated differentials 1957.5.4 Linear cryptanalysis 1967.5.5 Higher order differential attacks 1967.6 Public Research on KASUMI 1977.7 Implementation issues 1987.7.1 Parallel operation 1987.7.2 Implementation attacks 1998 Authentication and Key Generation Algorithm 2018.1 Design Task Force 2018.2 Requirements 2028.2.1 Authentication specification 2028.2.2 Functional requirements for UMTS authentication 2058.2.3 General requirements 2098.2.4 Additional requirements from SA3 2098.3 Design Process 2108.3.1 Work plan 2108.3.2 SAGE’s contribution to the UMTS security architecture 2128.3.3 Cryptographic requirements 2138.3.4 Operator-variant algorithm configuration field 2148.3.5 Criteria for the cryptographic kernel 2148.4 Description of the Modes 2168.4.1 The algorithm framework 2168.4.2 Notation 2168.4.3 Specification of the modes 2178.5 The MILENAGE Architecture 2198.5.1 Use of OP 2208.5.2 Rotation and offset constants 2208.5.3 Protection against side-channel attacks 2208.5.4 The number of kernel operations 2208.5.5 Modes of operation 2218.6 Kernel Algorithm 2218.6.1 Block ciphers versus hash functions 2218.6.2 The kernel of MILENAGE 2238.7 Customization Options 2248.7.1 Operator variant parameter 2248.7.2 Kernel algorithm 2258.7.3 Rotation and offset parameters 2258.7.4 Length of RES 2268.8 Conversion to and Compatibility with A3/A8 2268.8.1 Conversion rules 2278.8.2 GSM–MILENAGE 2288.9 Security analysis of MILENAGE 2308.9.1 Assumptions and security claims 2308.9.2 Operational context 2318.9.3 The soundness of the f2–f5* construction 2328.9.4 Soundness of the f1–f1* construction and its cryptographic separation from the other modes 2348.9.5 Investigation of forgery or distinguishing attacks with 264 queries 2368.9.6 Conclusions 240Notation of Parameters, Sets and Functions 243Abbreviations 249References 257Index 267

"... perfectly described by its title... well structured... definitive and highly recommended...." (The IEE Communications Engineer, June/July 2004)