Cryptanalysis of the DECT Standard Cipher

Abstract

Abstract. The DECT Standard Cipher (DSC) is a proprietary 64-bit stream cipher based on irregularly clocked LFSRs and a non-linear output combiner. The cipher is meant to provide confidentiality for cordless telephony. This paper illustrates how the DSC was reverse-engineered from a hardware implementation using custom firmware and information on the structure of the cipher gathered from a patent. Beyond disclosing the DSC, the paper proposes a practical attack against DSC that recovers the secret key from 2 15 keystreams on a standard PC with a success rate of 50% within hours; somewhat faster when a CUDA graphics adapter is available.

System-Level Methods to Prevent Reverse-Engineering, Cloning, and Trojan Insertion

“…But on various occasions, older designs have been exposed with much lower technology tools. For instance, -CRYPTO1, the encryption algorithm of the NXP MyFare card [21], and -DSC, the encryption algorithm of the DECT [22], have between disclosed by the observation of the chip and the reconstruction of its netlist (open source software tools exist for this final step [24]). Incidentally, those algorithms have been cryptanalysed almost as soon as they were known, which is a brilliant example of the danger of security by obscurity mechanisms.…”

FPGA Implementation of an Improved Attack against the DECT Standard Cipher

“…The equation systems must be transformed beforehand for this purpose, such that the dependent bits are described as a function of the independent bits. The DSC keystream generator can be implemented straight-forward as described in [4].…”

“…Even if encryption is used and long-term and session keys are generated in a secure manner, it is still possible to decipher phone calls. In 2009, the DECT Standard Cipher was reverse-engineered and a correlation attack on the cipher was published [4] by Nohl, Tews and Weinmann (NTW-attack). With 2 15 available keystreams generated with different initialization vectors (IVs), it is possible to recover the session key within minutes to hours on a fast PC or Server.…”

“…The optimizations are of general nature and can be used in conjunction with optimized implementations of the attack for CUDA graphics cards or the PS3 cell processor [4] or any other kind of parallel processing hardware. In the second part of the paper we present an optimized FPGA implementation of our optimized NTW-attack, which is currently the most cost-efficient way of searching through the remaining key space the NTW-attack determines.…”

“…The DECT Standard Cipher (DSC) is a proprietary stream cipher used for enciphering payload of DECT transmissions such as cordless telephone calls. The algorithm was kept secret, but a team of cryptologists reverse-engineered it and published a way to reduce the key space when enough known keystreams are available [4]. The attack consists of two phases: At first, the keystreams are analyzed to build up an underdetermined linear equation system.…”