Multidimensional zero‐correlation linear cryptanalysis of the block cipher KASUMI

The block cipher KASUMI, proposed by ETSI SAGE over 10 years ago, is widely used for security in many synchronous wireless standards nowadays. For instance, the confidentiality and integrity of 3G mobile communications systems depend on the security of KASUMI. Up to now, there is a great deal of cryptanalytic results on KASUMI. However, its security evaluation against the recent zero‐correlation linear attacks is still lacking. In this study, combining with some observations on the FL , FO and FI functions, the authors select some special input/output masks to refine the general 5‐round zero‐correlation linear approximations and propose the 6‐round zero‐correlation linear attack on KASUMI. Moreover, under the weak key conditions that the second keys of the FL function in rounds 2 and 8 have the same values at 1st–8th and 11th–16th bit‐positions, they expand the attack to 7‐round KASUMI (2–8). These weak keys take 1/2 14 of the key space. The new zero‐correlation linear attack on the 6‐round needs about 2 118 encryptions with 2 62.9 known plaintexts and 2 54 bytes memory. For the attack under weak keys conditions on the last 7 rounds, the data complexity is about 2 62.1 known plaintexts, and the time complexity is about 2 110.5 encryptions, and the memory requirement is about 2 85 bytes.