1.1  References  p. 8

2.1  Introduction  p. 9

2.2  Notation  p. 9

2.2.1  Radix  p. 9

We use the prefix 0x to indicate hexadecimal numbers.

2.2.2  Conventions  p. 9

We use the assignment operator '=', as used in several programming languages. When we write

• <variable> = <expression>

we mean that <variable> assumes the value that <expression> had before the assignment took place. For instance,

x = x + y + 3

means

(new value of x) becomes (old value of x) + (old value of y) + 3.

2.2.3  Bit/Byte ordering  p. 9

All data variables in this specification are presented with the most significant bit (or byte) on the left hand side and the least significant bit (or byte) on the right hand side. Where a variable is broken down into a number of sub-strings, the left most (most significant) sub-string is numbered 0, the next most significant is numbered 1 and so on through to the least significant.

For example an n-bit MESSAGE is subdivided into 64-bit substrings MB₀, MB₁… MB_i so if we have a message:

• 0x0123456789ABCDEFFEDCBA987654321086545381AB594FC28786404C50A37…

we have:

• MB₀ = 0x0123456789ABCDEF
• MB₁ = 0xFEDCBA9876543210
• MB₂ = 0x86545381AB594FC2
• MB₃ = 0x8786404C50A37…

In binary this would be:

• 000000010010001101000101011001111000100110101011110011011110111111111110…

with

• MB₀ = 0000000100100011010001010110011110001001101010111100110111101111
• MB₁ = 1111111011011100101110101001100001110110010101000011001000010000
• MB₂ = 1000011001010100010100111000000110101011010110010100111111000010
• MB₃ = 1000011110000110010000000100110001010000101000110111…

2.2.4  List of Symbols  p. 10

=

The assignment operator.

⊕

The bitwise exclusive-OR operation.

||

The concatenation of the two operands.

KASUMI[x]k

The output of the KASUMI algorithm applied to input value x

using the key k.

X[i]

The ith bit of the variable X. (X = X[0] || X[1] || X[2] || ….. ).

Yi

The ith block of the variable Y. (Y = Y0 || Y1 || Y2 || …. ).

2.3  List of Variables  p. 10

3.1  Introduction  p. 11

3.2  Inputs and Outputs  p. 11

3.3  Components and Architecture  p. 11

3.4  Initialisation  p. 11

3.5  Keystream Generation  p. 12

3.6  Encryption/Decryption  p. 12

4.1  Introduction  p. 12

4.2  Inputs and Outputs  p. 12

4.3  Components and Architecture  p. 13

4.4  Initialisation  p. 13

4.5  Calculation  p. 13

A.1  Figures of the f8 and f9 Algorithms  p. 16

A.2  Simulation Program Listing  p. 18

Header file
/*---------------------------------------------------------
 *   Kasumi.h
 *---------------------------------------------------------*/
typedef unsigned  char   u8;
typedef unsigned short  u16;
typedef unsigned  long  u32;
/*----- a 64-bit structure to help with endian issues -----*/
typedef union {
 u32 b32[2];
 u16 b16[4];
 u8  b8[8];
} REGISTER64;
/*------------- prototypes --------------------------------*/
void KeySchedule( u8 *key );
void Kasumi( u8 *data );
u8 * f9( u8 *key,int count,int fresh, int dir,u8 *data,int length );
void f8( u8 *key,int count,int bearer,int dir,u8 *data,int length );
Function f8
/*-------------------------------------------------------------------
 *   F8 - Confidentiality Algorithm
 *-------------------------------------------------------------------
 *
 *  A sample implementation of f8, the 3GPP Confidentiality algorithm.
 *
 *  This has been coded for clarity, not necessarily for efficiency.
 *
 *  This will compile and run correctly on both Intel (little endian)
 *  and Sparc (big endian) machines. (Compilers used supported 32-bit ints)
 *
 *  Version 1.0  05 November  1999
 *
 *-------------------------------------------------------------------*/
#include "kasumi.h"
#include <stdio.h>
/*---------------------------------------------------------
 * f8()
 *  Given key, count, bearer, direction,  data,
 *  and bit length  encrypt the bit stream
 *---------------------------------------------------------*/
void f8( u8 *key, int count, int bearer, int dir, u8 *data, int length )
{
 REGISTER64 A;  /* the modifier   */
 REGISTER64 temp;  /* The working register */
 int i, n;
 u8  ModKey[16];  /* Modified key  */
 u16 blkcnt;   /* The block counter */
 /* Start by building our global modifier */
 temp.b32[0]  = temp.b32[1]  = 0;
 A.b32[0]     = A.b32[1]     = 0;
 /* initialise register in an endian correct manner*/
 A.b8[0]  = (u8) (count>>24);
 A.b8[1]  = (u8) (count>>16);
 A.b8[2]  = (u8) (count>>8);
 A.b8[3]  = (u8) (count);
 A.b8[4]  = (u8) (bearer<<3);
 A.b8[4] |= (u8) (dir<<2);
 /* Construct the modified key and then "kasumi" A */
 for( n=0; n<16; ++n )
  ModKey[n] = (u8)(key[n] ^ 0x55);
 KeySchedule( ModKey );
 Kasumi( A.b8 ); /* First encryption to create modifier */
 /* Final initialisation steps */
 blkcnt = 0;
 KeySchedule( key );
 /* Now run the block cipher */
 while( length > 0 )
 {
  /* First we calculate the next 64-bits of keystream */
  /* XOR in A and BLKCNT to last value */
  temp.b32[0] ^= A.b32[0];
  temp.b32[1] ^= A.b32[1];
  temp.b8[7] ^= (u8)  blkcnt;
  temp.b8[6] ^= (u8) (blkcnt>>8);
  /* KASUMI it to produce the next block of keystream */
  Kasumi( temp.b8 );
  /* Set <n> to the number of bytes of input data *
   * we have to modify.  (=8 if length <= 64)  */
  if( length >= 64 )
   n = 8;
  else
   n = (length+7)/8;
  /* XOR the keystream with the input data stream */
  for( i=0; i<n; ++i )
   *data++ ^= temp.b8[i];
  length -= 64; /* done another 64 bits */
  ++blkcnt;  /* increment BLKCNT  */
 }
}
/*-----------------------------------------------------------
 *   e n d    o f    f 8 . c
 *-----------------------------------------------------------*/
Function f9
/*-------------------------------------------------------------------
 *    F9 - Integrity Algorithm
 *-------------------------------------------------------------------
 *
 * A sample implementation of f9, the 3GPP Integrity algorithm.
 *
 * This has been coded for clarity, not necessarily for efficiency.
 *
 * This will compile and run correctly on both Intel (little endian)
 *  and Sparc (big endian) machines. (Compilers used supported 32-bit ints)
 *
 * Version 1.1  05 September  2000
 *
 *-------------------------------------------------------------------*/
#include "kasumi.h"
#include <stdio.h>
/*---------------------------------------------------------
 * f9()
 *  Given key, count, fresh, direction, data,
 *  and message length, calculate the hash value
 *---------------------------------------------------------*/
u8 *f9( u8 *key, int count, int fresh, int dir, u8 *data, int length )
{
 REGISTER64 A; /* Holds the CBC chained data   */
 REGISTER64 B; /* Holds the XOR of all KASUMI outputs */
 u8  FinalBit[8] = {0x80, 0x40, 0x20, 0x10, 8,4,2,1};
 u8  ModKey[16];
 static u8 mac_i[4]; /* static memory for the result */
 int i, n;
 /* Start by initialising the block cipher */
 KeySchedule( key );
 /* Next initialise the MAC chain.  Make sure we *
  * have the data in the right byte order.   *
  * <A> holds our chaining value...    *
  * <B> is the running XOR of all KASUMI o/ps  */
 for( n=0; n<4; ++n )
 {
  A.b8[n]   = (u8)(count>>(24-(n*8)));
  A.b8[n+4] = (u8)(fresh>>(24-(n*8)));
 }
 Kasumi( A.b8 );
 B.b32[0] = A.b32[0];
 B.b32[1] = A.b32[1];
 /* Now run the blocks until we reach the last block */
 while( length >= 64 )
 {
  for( n=0; n<8; ++n )
   A.b8[n] ^= *data++;
  Kasumi( A.b8 );
  length -= 64;
  B.b32[0] ^= A.b32[0]; /* running XOR across */
  B.b32[1] ^= A.b32[1]; /* the block outputs  */
 }
 /* Process whole bytes in the last block */
 n = 0;
 while( length >=8 )
 {
  A.b8[n++] ^= *data++;
  length -= 8;
 }
 /* Now add the direction bit to the input bit stream *
  * If length (which holds the # of data bits in the *
  * last byte) is non-zero we add it in, otherwise  *
  * it has to start a new byte.      */
 if( length )
 {
  i = *data;
  if( dir )
   i |= FinalBit[length];
 }
 else
  i = dir ? 0x80 : 0;
 A.b8[n++] ^= (u8)i;
 /* Now add in the final '1' bit.  The problem here *
  * is if the message length happens to be n*64-1.  *
  * If so we need to process this block and then  *
  * create a new input block of 0x8000000000000000. */
 if( (length==7) && (n==8 ) ) /* then we've filled the block */
 {
  Kasumi( A.b8 );
  B.b32[0] ^= A.b32[0]; /* running XOR across */
  B.b32[1] ^= A.b32[1]; /* the block outputs */
  A.b8[0] ^= 0x80;   /* toggle first bit */
  i = 0x80;
  n = 1;
 }
 else
 {
  if( length == 7 )  /* we finished off the last byte */
   A.b8[n] ^= 0x80;  /* so start a new one.....  */
  else
   A.b8[n-1] ^= FinalBit[length+1];
 }
 Kasumi( A.b8 );
 B.b32[0] ^= A.b32[0]; /* running XOR across */
 B.b32[1] ^= A.b32[1]; /* the block outputs  */
 /* Final step is to KASUMI what we have using the *
  * key XORd with 0xAAAA.....      */
 for( n=0; n<16; ++n )
  ModKey[n] = (u8)*key++ ^ 0xAA;
 KeySchedule( ModKey );
 Kasumi( B.b8 );
 /* We return the left-most 32-bits of the result */
 for( n=0; n<4; ++n )
  mac_i[n] = B.b8[n];
 return( mac_i );
}
/*-----------------------------------------------------------
 *   e n d    o f    f 9 . c
 *-----------------------------------------------------------*/