For the purposes of this specification, the definitions given in GSM 02.60 apply.

In addition to those mentioned below, abbreviations used in this specification are listed in GSM 01.04. ANSI FCS GPRS LLC SAGE SGSN

The algorithm shall only be used for providing GPRS security features, as described in GSM 02.60 and GSM 03.60. The use of the algorithm is as follows:

• the algorithm is used to provide confidentiality and integrity protection of GPRS user data used for Point-to-Point (PTP) mobile originated and mobile terminated data transmission;
• the algorithm is used to provide data confidentiality and integrity protection of GPRS user data used for Point-to-Multipoint Group (PTM-G) mobile terminated data transmission.
• the algorithm is restricted to the MS - SGSN encryption.

The algorithm is installed in the Serving GPRS Support Node (SGSN) and Mobile Station (MS). The MS may consist of Terminal Equipment (TE), Terminal adaptation (TA) and Mobile Equipment (ME). The MS may also be a stand alone device. The GPRS ciphering algorithm may reside in the ME, TA, TE. Legal restrictions on the use or export of equipment containing cryptographic features that are enforced by various European Governments may prevent the use of equipment in certain countries.

An algorithm with minimal restrictions on export when licensed and managed as described in clause 5, is desired because of the global use of GSM. The preferred method for implementing the algorithm is in hardware as a single chip device . In the case of a software implementation of the algorithm, legal restrictions on its export and, in certain countries, on its use is expected to be more stringent than for a hardware implementation.

The algorithm and all copyright to the algorithm and test data specifications shall be owned exclusively by ETSI. The design authority for the algorithm shall be ETSI SAGE. The algorithm specification shall not be published as an ETSI standard or otherwise made publicly available, but shall be provided to organizations that need and are entitled to receive it subject to a licence and confidentiality agreement. The licence and confidentiality agreement shall require recipient of the specification not to attempt to patent the algorithm or otherwise register an Intellectual Property Right (IPR) relating to the algorithm or its use.

The algorithm specification may be made available to the following types of organizations:

• the service providers, including network operators, entitled to use the algorithm in the network side;
• those who need the algorithm specification in order to build equipment or components which embody the algorithm.

Users of the algorithm, and users and recipients of the algorithm specification, shall be required to sign a licence and confidentiality agreement. Appropriate licence and confidentiality agreements shall be drawn up by ETSI. Licences shall be royalty free. However, the algorithm custodian may impose a small charge to cover administrative costs involved in issuing the licences. It is envisaged that there shall be two types of licence and confidentiality agreement: one for service provider of GPRS services entitled to use the algorithm, and one for organizations who need the algorithm specification in order to build equipment or components which embody the algorithm, as defined in subclause 5.2. The licence and confidentiality agreement signed by a service provider of GPRS services shall require that organization to comply with the restrictions on the use of the algorithm. The licence and confidentiality agreement signed by an organization that needs the algorithm specification in order to build equipment or components which embody the algorithm, shall require that organization to adopt measures to ensure that its implementations of the algorithm are commensurate with the need to maintain confidentiality of the algorithm.

The distribution procedure for the algorithm specification shall be specified by ETSI. SAGE is expected to design the appropriate procedure for the distribution of the algorithm after consulting ETSI SMG 10 and the GSM MoU Security group. The outline procedure is as follows:

• ETSI shall appoint a custodian for administration of the algorithm specification;
• a service provider of GPRS services may request copies of the algorithm specification (and test data) and a licence to use the algorithm from the custodian;
• if the service provider of GPRS services is entitled to use the algorithm, the custodian shall issue the requested algorithm specifications subject to the GPRS service provider signing a licence and confidentiality agreement;
• a service provider of GPRS services who is licensed to use the algorithm may request ETSI to provide copies of the algorithm specification to an organization which intends to build equipment or components that embody the algorithm. Such an organization shall then be required by ETSI to sign a licence and confidentiality agreement before receiving the algorithm specifications from the custodian.

The algorithm is to be a symmetric stream cipher. The inputs are the Key (Kc), the frame dependent input (INPUT), and transfer direction (DIRECTION). The output of the ciphering algorithm is the output string (OUTPUT). Relation of the input and output parameters is illustrated in Figure 1.

The parameters of the algorithms are to be as follows:

Kc	64 bits
INPUT	32 bits
DIRECTION	1 bit
OUTPUT	1600 octets

The following interfaces to the algorithm are defined:

• Kc :
  K[0], K[1], ..........., K[63]
  where K[i] is the Kc bit with label i;
• INPUT :
  X[0], X[1], ..........., X[31]
  where X[i] is the INPUT bit with label i;
• DIRECTION :
  Z[0]
  where Z[0] is the DIRECTION bit with label 0;
• OUTPUT :
  W[0], W[1], ..........., W[1599]
  where W[i] is the data output octet with label i.

Uplink and downlink transfers are independent. Hence ciphering for uplink and downlink shall be independent from each other. This contrasts to algorithm A5 where keystreams for both directions are generated from the same input.

The GPRS performance requirements are specified in GSM 02.60. Requirements refer to an MS, which admits only 1 timeslot GPRS communication (see note 1), and to an MS, which admits GPRS communication over the maximum number of timeslots (see note 2). The performance requirements, on the GPRS ciphering algorithm, as used in scenario 1, are expected to be similar to the performance of the existing A5 algorithm. It is also expected that the performance increases linearly depending on the number of timeslots, the MS is able to use for GPRS.

The algorithm needs to be designed with a view to its continuous use for a period of at least 10 years. The security shall provide at least comparable protection as the baseline security provided by the GSM encryption algorithms. ETSI SAGE are required to design the algorithm to a strength which reflects the above qualitative requirements.

An unambiguous specification of the algorithm needs to be provided which is suitable for use by implementors of the algorithm. The specification shall include an annex which provides simulation code for the algorithm written in ANSI C. The specification may also include an annex containing illustrations of functional elements of the algorithm.

Design conformance test data is required to allow implementors of the algorithm to test their implementations. The design conformance test data needs to be designed to give a high degree of confidence in the correctness of implementations of the algorithm. The design conformance test data shall be designed so that significant points in the execution of the algorithm may be verified.

Algorithm input/output test data is required to allow users of the algorithm to test the algorithm as a "black box" function. The input/output test data shall allow users of the algorithm to perform tests for the modes of operation defined in subclause 6.3. The input/output test data shall consist solely of data passed across the interfaces to the algorithm.

The specification of the algorithm shall be produced on paper, and provided only to the ETSI appointed custodian (see subclause 5.4). The document shall be marked "Strictly ETSI confidential" and carry the warning "This information is subject to a licence and confidentiality agreement". The design conformance test data shall be produced on paper, and provided only to the ETSI appointed custodian. The document shall be marked "Strictly ETSI confidential" and carry the warning "This information is subject to a licence and confidentiality agreement". The algorithm input/output test data shall be produced on paper and on magnetic disc. The document and disc shall be provided to the ETSI appointed custodian. Special markings or warnings are not required.

Prior to its release to the ETSI custodian, the algorithm needs to be approved as meeting the technical requirements specified in clause 6 by all members of ETSI SAGE.

Prior to delivery of the algorithm specification, two independent simulations of the algorithm needs to be made using the specification, and confirmed against test data designed to allow verification of significant points in the execution of the algorithm. Design conformance and algorithm input/output test data needs to be generated using a simulation of the algorithm produced from the specification and confirmed as above. The simulation used to produce this test data needs to be identified in the test data deliverables and retained by ETSI SAGE.

The design and evaluation report is intended to provide evidence to potential users of the algorithm, specification and test data that appropriate and adequate quality control has been applied to their production. The report shall explain the following:

• the algorithm and test data design criteria;
• the algorithm evaluation criteria;
• the methodology used to design and evaluate the algorithm;
• the extent of the mathematical analysis and statistical testing applied to the algorithm;
• the principal conclusions of the algorithm evaluation;
• the quality control applied to the production of the algorithm specification and test data.

The report shall confirm that all members of ETSI SAGE have approved the algorithm, specification and test data. The report shall not contain any information about the algorithm, such as design techniques used, mathematical analysis or statistical testing of components of the algorithm, which might reveal part or all of the structure or detail of the algorithm.