= A5-GMR-1 Cipher =

Description

The cipher is heavily inspired from A5/2 and is based on 4 LFSR that are irregularely clocked and whose output is combined through a non linear function. See the schema below :

Image(a5-gmr-1.png, 50%)

• M is the majority function
• Clocking is entirely controlled by R4. The 3 clock bits are compared to their majority and if they match, the corresponding register is clocked. * Bit 15 for R1 * Bit 6 for R2 * Bit 1 for R3

The initialization of the cipher from the Key and Frame number. Basically the frame number bits are xored with the key, then the cipher is forcefully clocked for 64 cycles, each time xoring one bit of the (Key xor FN) with each of the feedback path of the LFSR.

Then comes the mixing stage where the cipher is run normally for 250 cycles, just discarding the output.

And finally keystream is ready to be produced. First for the downlink and then for the uplink. Actual length depends on channel type but for FACCH3 for example you'd produce 96 bits for the downlink direction (Sat -> Phone) and then 96 bits for the uplink direction (Phone -> Sat). Note that the role of uplink and downlink can be reversed when dealing with "Terminal-to-Terminal" calls.

Credits goes to Benedikt Driessen, Ralf Hund, Carsten Willems, Christof Paar, and Thorsten Holz for their reversing work, extracting this from the Thuraya_SO2510 firmware.

Implementation

You can find the actual implementation here : http://cgit.osmocom.org/cgit/osmo-gmr/tree/src/l1/a5.c

Cryptanalysis

=== RUB Attack on TCH3 ===

=== FACCH3 known plaintext ===