Content for TR 35.909 Word version: 18.0.0
2 References
3 Abbreviations
4 Structure of this report
5 Background to the design and evaluation work
6 Summary of algorithm requirements
7 Design criteria
8 The 3GPP MILENAGE algorithms
9 Rationale for the chosen design
10 Evaluation
11 Conclusions
$ Change History
2 References p. 6
3 Abbreviations p. 7
4 Structure of this report p. 8
5 Background to the design and evaluation work p. 8
6 Summary of algorithm requirements p. 9
6.1 General requirements for 3GPP cryptographic functions and algorithms p. 9
6.2 Authentication and key agreement functions p. 9
6.2.1 Implementation and operational considerations p. 9
6.2.2 Type of algorithm p. 9
6.2.2.1 f1 p. 9
6.2.2.2 f1* p. 10
6.2.2.3 f2 p. 10
6.2.2.4 f3 p. 10
6.2.2.5 f4 p. 10
6.2.2.6 f5 p. 10
6.2.2.7 f5* p. 10
7 Design criteria p. 11
7.1 Cryptographic Criteria p. 11
7.2 Implementation Criteria p. 11
7.3 The need for an Operator Variant Algorithm Configuration Field p. 11
7.4 Criteria for the cryptographic kernel p. 11
8 The 3GPP MILENAGE algorithms p. 13
9 Rationale for the chosen design p. 13
9.1 Block ciphers vs. hash functions p. 13
9.2 The choice of Rijndael p. 14
9.3 The MILENAGE architecture p. 15
10 Evaluation p. 16
10.1 Evaluation criteria p. 16
10.2 Operational Context p. 17
10.3 Analysis p. 17
10.3.1 A formal proof of the soundness of the f2-f5* construction p. 17
10.3.2 On the f1-f1* construction and its separation from f2-f5* p. 19
10.3.2.1 Soundness of the f1-f1* construction p. 19
10.3.2.2 Separation between f1-f1* and f2-f5* p. 19
10.3.3 Investigation of forgery or distinguishing attacks with 264 queries p. 20
10.3.3.1 An internal collision attack against f1 (or f1*) p. 20
10.3.3.2 Forgery or distinguishing attacks against combinations of several modes p. 20
10.3.3.2.1 Attacks against combinations of f2-f5 p. 21
10.3.3.2.2 Attacks against combinations of f1-f1* and f2-f5* p. 21
10.3.3.3 Conclusion about the identified forgery or distinguishing attacks p. 21
10.4 Statistical evaluation p. 22
10.5 Published attacks on Rijndael p. 22
10.6 Complexity evaluation p. 23
10.6.1 Complexity of draft Rijndael implementation p. 23
10.6.2 Estimate complexity of modes p. 23
10.6.3 Estimate of total MILENAGE p. 23
10.6.4 SPA/DPA, Timing attack countermeasures p. 23
10.6.5 Conclusion on algorithm complexity p. 24
10.7 External complexity evaluations p. 24
10.8 Evaluation of side channel attacks p. 25
11 Conclusions p. 27
$ Change History p. 28
