ZUC-256算法草案中文版.pdf

ZUC-2566 6— è Á‡ • Aé5GÏ&† þf—èž“ 5 § ©JÑZUC-2566— è"ZUC-2566—è´3GPPÅ—5† 5Ž{128-EEA3Ú128-EIA3¥ æ^ ZUC-1286—è 256 'A— ,?‡ §†ZUC-1286—èpÝ oN…äk # OA:"ZUC-256 6—è O8I´Jø5GA^ ‚¸e 256'AS 5¶Ù@yÜ©3Ð©•þØŒE^ ^‡e|± õ«I\•Ý" '… c yÀƒŽ{§6—è§256'AS 1 5 Úó ¯¤±•§3GPPÅ—5† 5Ž{128-EEA3Ú128-EIA3 [1] Ø % ´ZUC-1286 — è " ‘ X Ï & † O Ž E â u Ð § é ™ 55GA^‚¸eŒJø256'AS 5 #.6—èkX½ƒ I¦" ©‰ÑZUC-2566—è £ã§3 ±†ZUC-1286— èpÝoN Ä:þ§Óž÷v5G A^‚¸"†ZUC-1286— èƒ'§ZUC-2566—è3Ð©z ã!žE@yè(MAC§•¡ @yI\½öI\))¤ ãæ^ # O•Y±÷v5G A^ ˆ«I¦" ©( Xe"Äk31 !‰ÑZUC-2566—è £ ã§•¹ Ð©z ã!— 6)¤ ã9žE@yè)¤ ã¶1n!o( ©" 2 Ž{£ã !‰ÑZUC-2566—è £ã"Äk ½e ÎÒ" - P ê 232 \{•§=éu0 ≤ x < 232 †0 ≤ y < 232 §x yÒ´mod 232 ê\{$Ž¶ 31 - P ê (2 − 1)\{•(x + y) mod (231 − 1)§Ù¥1 ≤ x ≤ 231 − 1§…1 ≤ y ≤ 231 − 1¶ - P'A? É½öŠ•⊕¶ 2 mod  231  1 215 s15 217 s14 s15H s14L s13 s12 s11 s10 s11L s9H 1+28 2 20 2 21 s9 s8 s7 s6 s5 s4 s3 s1 s2 s2 L s7 L s5H s0 s0H   Z  ã 1. ZUC-2566—è — 6)¤ ã - P'AG ë öŠ•k¶ - P'A? Ü6½$Ž•|¶ - -K = (K31 , K30 , ..., K2 , K1 , K0 )•ZUC-2566—èæ^ 256-' A— §Ù¥Ki (0 ≤ i ≤ 31)•8-'Ai!¶ - -IV = (IV24 , IV23 , ..., IV17 , IV16 , IV15 , . . . , IV1 , IV0 )•ZUC-2566 —èæ^ 184-'AÐ©•þ§Ù¥IVi (0 ≤ i ≤ 16)•8-'A i!¶IVi (17 ≤ i ≤ 24)•6-'A• 'AG§Óâ˜‡i! $6 ¶ - -di (0 ≤ i ≤ 15)•ZUC-2566—èæ^ 7-'A~ê¶ - P64-'AöŠê •†Ì‚£ •≪§x ≪ n=•((x n) | (x (64 − n)))§Ù¥†©O•ƒAöŠê Ü6†£† Ü6m£" Xã1†ã2¤«§ZUC-2566—èd3Ü©|¤: Äk´˜‡496'A• ‚5‡"£ M•ì(LFSR)§TLFSR½Â3•GF(231 − ZUC-2566—è 3 mod  231  1 215 s15 217 s14 s15H s14L s13 221 s12 s11 s10 1+28 220 s9 s8 s7 s11L s9 H s6 s5 s7 L s5H s4 s3 s1 s2 s2 L s0 s0H >> 1   ã 2. ZUC-2566—è Ð©z ã 1)þ§d16‡31-'AM•ìü (s15 , s14 , · · · , s2 , s1 , s0 ) ¤§ù ü þ ½ Â 3 “ L 8 Ü{1, 2, · · · , 231 − 1}þ ¶ Ù g ´ ˜ ‡ ' A - | (BR)§ § Ì ‡ ^ 5 lLFSR¥ Ä ˜ • ; S N § ¿ © ¤4‡32-'Ai(X0 , X1 , X2 , X3 )§^ue¡ k•G gÄ Å(FSM)ÚÑÑ?n¶• ´FSM §•¹2‡32-'AiR1 †R2 Š •FSM¥ PÁü " ZUC-2566—è — /Ð©•þC1L§Xe" s0 = K0 k d0 k K21 k K16 s1 = K1 k d1 k K22 k K17 s2 = K2 k d2 k K23 k K18 s3 = K3 k d3 k K24 k K19 4 s4 = K4 k d4 k K25 k K20 s5 = IV0 k (d5 | IV17 ) k K5 k K26 s6 = IV1 k (d6 | IV18 ) k K6 k K27 s7 = IV10 k (d7 | IV19 ) k K7 k IV2 s8 = K8 k (d8 | IV20 ) k IV3 k IV11 s9 = K9 k (d9 | IV21 ) k IV12 k IV4 s10 = IV5 k (d10 | IV22 ) k K10 k K28 s11 = K11 k (d11 | IV23 ) k IV6 k IV13 s12 = K12 k (d12 | IV24 ) k IV7 k IV14 s13 = K13 k d13 k IV15 k IV8 s14 = K14 k (d14 | (K31 )4H ) k IV16 k IV9 s15 = K15 k (d15 | (K31 )4L ) k K30 k K29 Ù¥(K31 )4H ´i!K31 p4 § W¿~êdi (0 ≤ i ≤ 15)Xe" (K31 )4L ´K31 d0 = 0100010 d1 = 0101111 d2 = 0100100 d3 = 0101010 d4 = 1101101 d5 = 1000000 d6 = 1000000 d7 = 1000000 d8 = 1000000 d9 = 1000000 d10 = 1000000 d11 = 1000000 d12 = 1000000 d13 = 1010010 d14 = 0010000 d15 = 0110000 $4 §¤¦^ ZUC-2566—è ZUC-2566—è e" Ð©z ã 5 k32 + 1 = 33Ó§ÙäN£ãX 1. UXþ¤ãò— !Ð©•þ9~êC1 LFSRˆü 2. Ð©zPÁü •R1 = R2 = 0 3. for i = 0 to 31 do – Bitreorganization( ) – W = F (X0 , X1 , X2 ) – LFSRWithInitializationMode(W 1) 4. – Bitreorganization( ) – W = F (X0 , X1 , X2 )§ ïW – LFSRWithworkMode() e¡§·‚Å˜‰Ñˆ‡ƒ'f§S £ã" LFSRWithInitializationMode(u) 1. v = (215 ·s15 +217 ·s13 +221 ·s10 +220 ·s4 +(1+28 )·s0 ) mod(231 −1) 2. ev = 0§K-v = 231 − 1 3. s16 = (v + u) mod(231 − 1) 4. es16 = 0§K-s16 = 231 − 1 5. (s16 , s15 , · · · , s2 , s1 ) → (s15 , s14 , · · · , s1 , s0 )§Ù¥→L«DŠö Š LFSRWithworkMode() 1. s16 = (215 · s15 + 217 · s13 + 221 · s10 + 220 · s4 + (1 + 28 ) · s0 ) mod(231 − 1) 2. es16 = 0§K-s16 = 231 − 1 3. (s16 , s15 , · · · , s2 , s1 ) → (s15 , s14 , · · · , s1 , s0 ) Bitreorganization() 1. X0 = s15H k s14L 2. X1 = s11L k s9H 3. X2 = s7L k s5H 4. X3 = s2L k s0H Ù¥siH •M•ìü si F (X0 , X1 , X2 ) 1. W = (X0 ⊕ R1 ) R2 p16 § sjL •M•ìü sj $16 " 6 2. W1 = R1 X1 3. W2 = R2 ⊕ X2 4. R1 = S(L1 (W1L k W2H )) 5. R2 = S(L2 (W2L k W1H )) Ù¥S = (S0 , S1 , S0 , S1 )•4‡¿˜ S-Ý§ù˜Ü©†ƒcZUC1286—è Ó˜Ü‡ ƒÓ¶ L1 †L2 •´ZUC-1286—èæ ^ ü‡MDSÝ "ZUC-2566—èz˜!û )˜‡32-'Ai Š•ÑÑ— 6" KeystreamGeneration() 1. Bitreorganization( ) 2. Z = F (X0 , X1 , X2 ) ⊕ X3 3. LFSRWithworkMode() 35GA^‚¸¥§ZUC-2566—èz˜v )20000-'A 232 ' A• — 6§½=z˜v )625 227 ‡— 6i¶‘ ?1˜ g— /Ð©•þ 2ÓÚL§§3ù˜L§¥ ±— /~êØ C§ Ð©•þKüC•˜‡#Š" ZUC-2566—è MAC)¤ n†ZUC-1286—è MAC)¤ nƒÓ§äNL§Xe"-M = (m0 , m1 , · · · , ml−1 ) •˜ãl-' A• ²©žE§Ù@yI\•ÝtŒ •32, 649128'A" MAC Generation(M ) 1. $1ZUC-2566—è )˜ã•¹L = d 32l e + 2 · 32t ‡i — 6"PT— 6 S •z0 , z1 , · · · , z32·L−1 §Ù¥z0 ´1˜ ‡— 6i •p z31 ´Ti •$ " 2. Ð©zT ag = (z0 , z1 , · · · , zt−1 ) 3. for i = 0 to l − 1 do – -Wi = (zt+i , · · · , zi+2t−1 ) – emi = 1§KT ag = T ag ⊕ Wi 4. Wl = (zl+t , · · · , zl+2t−1 ) 5. T ag = T ag ⊕ Wl 6. ˆ£T ag éuØÓ•Ý ~êXe" @yI\§• “Ž–EôÂ§ˆ•Ý¤æ^ ZUC-2566—è 1. éu32-'A I\•Ý§¤æ^ ~êXe" d0 = 0100010 d1 = 0101111 d2 = 0100101 d3 = 0101010 d4 = 1101101 d5 = 1000000 d6 = 1000000 d7 = 1000000 d8 = 1000000 d9 = 1000000 d10 = 1000000 d11 = 1000000 d12 = 1000000 d13 = 1010010 d14 = 0010000 d15 = 0110000 2. éu64-'A I\•Ý§¤æ^ ~êXe" d0 = 0100011 d1 = 0101111 d2 = 0100100 d3 = 0101010 d4 = 1101101 d5 = 1000000 d6 = 1000000 d7 = 1000000 d8 = 1000000 7 8 d9 = 1000000 d10 = 1000000 d11 = 1000000 d12 = 1000000 d13 = 1010010 d14 = 0010000 d15 = 0110000 3. éu128-'A I\•Ý§¤æ^ ~êXe" d0 = 0100011 d1 = 0101111 d2 = 0100101 d3 = 0101010 d4 = 1101101 d5 = 1000000 d6 = 1000000 d7 = 1000000 d8 = 1000000 d9 = 1000000 d10 = 1000000 d11 = 1000000 d12 = 1000000 d13 = 1010010 d14 = 0010000 d15 = 0110000 ZUC-2566—è kXeÿÁ•þ" ÿÁ•þXe"Äkéu— 6)¤ ã§ 1. -— Ki = 0x00§éu0 ≤ i ≤ 31§ Ð©•þIVi = 0x00§ éu0 ≤ i ≤ 24§KÞ20‡— 6i• – 58d03ad6,2e032ce2,dafc683a,39bdcb03,52a2bc67, – f1b7de74,163ce3a1,01ef5558,9639d75b,95fa681b, – 7f090df7,56391ccc,903b7612,744d544c,17bc3fad, ZUC-2566—è 9 – 8b163b08,21787c0b,97775bb8,4943c6bb,e8ad8afd 2. -— Ki = 0xff§éu0 ≤ i ≤ 31§ Ð©•þIVi = 0xff§ é0 ≤ i ≤ 169IVi = 0x3f§é17 ≤ i ≤ 24§KÞ20‡— 6i • – 3356cbae,d1a1c18b,6baa4ffe,343f777c,9e15128f, – 251ab65b,949f7b26,ef7157f2,96dd2fa9,df95e3ee, – 7a5be02e,c32ba585,505af316,c2f9ded2,7cdbd935, – e441ce11,15fd0a80,bb7aef67,68989416,b8fac8c2 ÙgéužE@yè)¤ ã§kXeÿÁ•þ" 1. -— Ki = 0x00§éu0 ≤ i ≤ 31§ Ð©•þIVi = 0x00§ éu0 ≤ i ≤ 24§l = 400-'A žE•M = 0x 00, · · · , 00§K | {z } 100 ƒA 32-'AI\§64-'AI\†128-'AI\©OXe – 32-'A@yI\•9b972a74 – 64-'A@yI\•673e5499 0034d38c – 128-'A@yI\•d85e54bb cb960096 7084c952 a1654b26 2. -— Ki = 0x00§éu0 ≤ i ≤ 31§ Ð©•þIVi = 0x00§ éu0 ≤ i ≤ 24§l = 4000-'A žE•M = 0x 11, · · · , 11§K | {z } 1000 ƒA 32-'AI\§64-'AI\†128-'AI\©OXe – 32-'A@yI\•8754f5cf – 64-'A@yI\•130dc225 e72240cc – 128-'A@yI\•df1e8307 b31cc62b eca1ac6f 8190c22f 3. -— Ki = 0xff§éu0 ≤ i ≤ 31§ Ð©•þIVi = 0xff§ éu0 ≤ i ≤ 169IVi = 0x3f§éu17 ≤ i ≤ 24§l = 400-' A žE•M = 0x 00, · · · , 00§K32-'AI\§64-'AI\ | {z } 100 †128-'AI\©OXe – 32-'A@yI\•1f3079b4 – 64-'A@yI\•8c71394d 39957725 – 128-'A@yI\•a35bb274 b567c48b 28319f11 1af34fbd 4. -— Ki = 0xff§éu0 ≤ i ≤ 31§ Ð©•þIVi = 0xff§ éu0 ≤ i ≤ 169IVi = 0x3f§éu17 ≤ i ≤ 24§l = 4000-' A žE•M = 0x 11, · · · , 11§K32-'AI\§64-'AI\ | {z } 1000 †128-'AI\©OXe 10 – 32-'A@yI\•5c7c8b88 – 64-'A@yI\•ea1dee54 4bb6223b – 128-'A@yI\•3a83b554 be408ca5 494124ed 9d473205 ZUC-2566—è S 58I´Jø5GA^‚¸e 256'A S 5"éu@yÜ© –EôÂ§ZUC-2566—èŒJøƒ u I\•Ý S 5§ùpAOrN§3ZUC-2566—è¥§Ð©• þØŒE^¶3@yI\ y”}ž§ØŒ )?Û ÑÑ" 3 (åŠ 3 ©¥§·‚‰Ñ ZUC-2566—è éZUC-2566—è?1—è©Û" £ã§•H;[Æö ë•©z 1. Specification of the 3GPP Confidentiality and Integrity Algorithms 128-EEA3 and 128-EIA3, Document 4: Design and Evaluation Reprot. http://www.gsmworld.com/documents/EEA3_EIA3_Design_Evaluation_v1_1.pdf. A © F“ 25-01-2018 3‚úÙ version 1.0 15-04-2018 •#ã1†ã2 version 1.1