Best Known Fast Correlation Attack on SNOW 3G Based on a New Insight

Abstract

The well-known SNOW 3G stream cipher serves as the core of 3GPP confidentiality and integrity algorithms UEA 2 and UIA2 for universal mobile telecommunications system (UMTS) and long term evolution (LTE) networks. Recently, Gong and Zhang gave two linear approximations of SNOW 3G with correlation 2^−20.48, and then proposed a fast correlation attack on the cipher with time/data/memory/precomputation complexities all upper bounded by 2^174.16. In this paper, a more accurate calculation method of the linear approximation correlations is proposed. It treats the inversion function of the 32-bit Sbox used in SNOW 3G as the parallel composition of four 8-bit Sboxes, and the correlation calculation of the noise variables as the correlation calculation of the addition modulo 2³² with two inputs. Based on this new insight, we improve the correlation of the best linear approximation of SNOW 3G from 2^−20.48 to 2^−18.91. The new result is substituted into a new fast correlation attack on SNOW 3G, whose time/data/memory/precomputation complexities are all improved compared with the existing attacks. To the best of our knowledge, this is the best cryptanalytic result of SNOW 3G up to now.