Bitstream Modification Attack on SNOW 3G
Michail Moraitisa and Elena Dubrovab
Department of Electronics, Royal Institute of Technology (KTH) Electrum 229, 196 40 Stockholm, Sweden
amicmor@kth.se
bdubrova@kth.se
ABSTRACT
SNOW 3G is one of the core algorithms for confidentiality and integrity in several 3GPP wireless communication standards, including the new Next Generation (NG) 5G. It is believed to be resistant to classical cryptanalysis. In this paper, we show that SNOW 3G can be broken by a fault attack based on bitstream modification. By changing the content of some look-up tables in the bitstream, we reduce the non-linear state updating function of SNOW 3G to a linear one. As a result, it becomes possible to recover the key from a known plaintext-ciphertext pair. To our best knowledge, this is the first successful bitstream modification attack on SNOW 3G.
Keywords: SNOW 3G, Stream cipher, Fault attack, FPGA, Bitstream modification, Reverse engineering.
