View source for COMP128

{{short description|Implementations of the A3 and A8 functions of the GSM standard}}
{{multiple issues|
{{more citations needed|date=April 2019}}
{{unreliable sources|date=April 2019}}
{{external links|date=April 2019}}
}}
The '''COMP128''' algorithms are implementations of the A3 and A8 functions defined in the [[GSM]] standard. A3 is used to [[authentication|authenticate]] the mobile station to the network. A8 is used to generate the [[session key]] used by A5 to encrypt the data transmitted between the mobile station and the [[Base Transceiver Station|BTS]].
There are three versions of COMP128. They were originally confidential. A partial description of the first version was leaked in 1997 and completed via [[reverse engineering]]. This led to a full publication in 1998.<ref name="code" /> The second and third versions were obtained via reverse engineering of software which verifies SIM cards compliance.<ref name="comp128v3" />
==Introduction==
For details on the way A3 and A8 are used see [[Network switching subsystem#Authentication center (AuC)|Authentication Center]].
A3 and A8 both take a 128-bit key (''K<sub>i</sub>'') and a 128-bit [[challenge–response authentication|challenge]] (''RAND'') as inputs. A3 produces a 32-bit response (''SRES'') and A8 produces a 64-bit session key (''K<sub>c</sub>''). A3/A8 is the combined function with ''K<sub>i</sub>'' and ''RAND'' as inputs and ''SRES'' and ''K<sub>c</sub>'' as outputs.
As A3 and A8 are not further specified, operators can freely choose the concrete algorithms used for A3 and A8.
==COMP128 algorithms==
The COMP128 algorithms implement the A3/A8 function. There are three of them:
* COMP128-1 – original algorithm with known weaknesses
* COMP128-2 – stronger algorithm which still clears the 10 rightmost bits of ''K<sub>c</sub>''
* COMP128-3 – same algorithm as COMP128-2 with all 64 bits of ''K<sub>c</sub>'' generated
All of them are built around a [[One-way compression function|compression function]] with two 128 bits inputs and one 128 bits output, hence their names. ''K<sub>i</sub>'' and ''RAND'' are used as the inputs of the compression function. Bits from its output are then used to fill ''SRES'' and ''K<sub>c</sub>''.
==COMP128-1 description==
COMP128-1 uses a compression function with eight rounds which is based on a butterfly structure with five stages. ''SRES'' is filled with the first 32 bits of the output. ''K<sub>c</sub>'' is filled with the last 54 bits of the output followed by ten zeroes.
For a full description of the algorithm, the reader can view the [http://git.osmocom.org/libosmocore/tree/src/gsm/comp128.c OsmocomBB implementation].
==COMP128-2/3 description==
The implementation of COMP128-2 and COMP128-3 is noticeably more complex than COMP128-1. For a full description of the algorithm, the reader can view the [http://git.osmocom.org/libosmocore/tree/src/gsm/comp128v23.c OsmocomBB implementation] or [https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/src/modules/rlm_eap/libeap/comp128.c FreeRADIUS implementation], both based on the [[Python (programming language)|Python code]] from the Secrets of Sim<ref name="comp128v3" /> article. COMP128-2 is identical to COMP128-3 except for the fact that at the end, it clears the 10 rightmost bits of ''K<sub>c</sub>''.
==Security==
The COMP128-1 hash function is considered weak because there is insufficient [[Confusion and diffusion|diffusion]] of small changes in the input. Practical attacks have been demonstrated that can recover the subscriber key from the SIM.<ref name="brumley" />
The session keys produced by COMP128-1 and COMP128-2 intentionally have only 54 bits of entropy. This significantly weakens the A5 or A6 encryption.
==References==
<references>
<ref name="brumley">{{Citation |last=Brumley |first=Billy |year=2004 |title=A3/A8 & COMP128 |url=http://www.tcs.hut.fi/Studies/T-79.514/slides/S5.Brumley-comp128.pdf}}</ref>
<ref name="code">{{Citation |last1=Briceno |first1=Marc |last2=Goldberg |first2=Ian |last3=Wagner |first3=David |year=1998 |title=Implementation of COMP128 |archivedate=2009-03-18|archiveurl=https://web.archive.org/web/20090318143444/http://www.scard.org/gsm/a3a8.txt|url=http://www.scard.org/gsm/a3a8.txt}}</ref>
<ref name="comp128v3">{{Citation |last=Tamas |first=Jos |year=2013 |title=Secrets of the SIM |url=http://www.hackingprojects.net/2013/04/secrets-of-sim.html |access-date=2014-12-24 |archive-url=https://web.archive.org/web/20141224034734/http://www.hackingprojects.net/2013/04/secrets-of-sim.html# |archive-date=2014-12-24 |url-status=dead }}</ref>
</references>
==External links==
* {{Citation |last1=Briceno |first1=Marc |last2=Goldberg |first2=Ian |year=1998 |title=GSM Cloning |url=http://www.isaac.cs.berkeley.edu/isaac/gsm-faq.html}}
* {{Citation |last1=Handschuh |first1=Helena |last2=Paillier |first2=Pascal |year=2000 |title=Reducing the Collision Probability of Alleged Comp128 |citeseerx=10.1.1.141.1033}}
[[Category:GSM standard]]