TSG-SA WG3 (Security) meeting #7		TSGS-WG3#5(99)366
Den Haag, 26-27 October, 1999	
Source:	Vodafone (Tim Wright)
Title:	Report of TIA TR45 AHAG, San Juan (PR), 12-13/10/99
Document for:	Information 
Agenda Item:	5.4

This report gives the details of the straw poll and other points of interest.  Note that I suggested a joint S3/AHAG meeting in week 10-14 April (S3 meeting is scheduled for 11-13).  We will need to discuss inter-operability and other issues, but I think there is value merely in meeting, and they are willing to come over here.
Summary
•	As requested by TR45 plenary, a “straw poll” of the AHAG members was taken to indicate to the other TR45 sub-committees the view on the ESA proposals within AHAG.  Results were 3GPP mechanism – 6; Lucent LESA – 2; CipherIT – 1, and there were 4 abstentions.  ESA stands for Enhanced Subscriber Authentication and is the TR45 program to develop a 3G authentication mechanism.  Certicomm had withdrawn its ESA proposal, EPAC, prior to the straw poll.  The poll was anonymous but you can probably guess how many of the voters (listed later on) went.
•	3GPP-IS41 inter-operability solutions developed by Siemens and Vodafone were presented to the meeting and were reasonably well received, though with much questioning.  The consensus view was that inter-operability is possible and not too difficult to achieve
•	The AHAG ESP (enhanced subscriber protection, the TR45 project to develop a ciphering algorithm for 3G) is scheduled to make its recommendations in November.  As some of the algorithms have only just been presented in their final forms to the rest of AHAG, doubt was cast within the group as to whether AHAG will be ready in November to make its recommendation.  It may recommend all 5 of the candidates and leave the air interface groups to (separately) make the choice.  There is therefore the chance of multiple 3G ciphering algorithms in 3G TR45.
Questions/next steps
•	The positive result of the straw poll is significant but the other TR45 sub-committees, especially 45.2, .3 and .5 still need to be persuaded that the 3GPP mechanism is the best choice.  Among these, the carriers are said to probably require the most convincing.  Can those infrastructure suppliers active in North America try and lobby their customers?
•	The GTE AHAG representative, Chris Carrol said that GTE had concerns with 3GPP over the use of sequence numbers, the amount of HE-SN SS7 traffic that the 3GPP mechanism required and whether or not the TR45 would have adequate representation within 3GPP S3 if the 3GPP mechanism were adopted by TR45.  Gunther has offered to produce a paper on sequence numbers for the next AHAG.  Has anyone produced any calculations of signalling load for the 3GPP mechanism?  If they have, could they share them?  A key figure will be the number (really duration, if the frame counter is used for triggering an authentication update) of calls that can be made with the same key pair.
Details of meeting 
Enhanced Subscriber Authentication (ESA) discussion
Straw poll
The AHAG chair had decided that only those AHAG members that had attended at least 4 times in 1999 or were an ESA proponent, could vote.  This gave 13 voters.  3GPP “won” the straw poll with 6 votes to Lucent’s two and CipherIT’s one (CipherIT has apparently been ruled out within 45.2).  The 13 voters are given below, with votes that were publicly declared listed (I assume Lucent and CipherIT voted for themselves).
	3GPP	LESA	CipherIT	Abstain	
3GPP	1				
Lucent		1			
CipherIT			1		
Certicomm				1	
GTE					
Ericsson					
Motorola					
Nokia					
Qualcomm				1	
Denzo					
NSA				1	
AWS		1			
ICO					
	6	2	1	4	
Tdoc 6, Vodafone-Airtouch, IPR status of 3GPP mechanism.  This document was designed to try and clarify the IPR status (it is free from IPR) to AHAG.  However, as no legal assurances of IPR freedom could be given, the document did not really succeed in its aim.  TIA and ETSI lawyers are in conversation on the topic.  It is hoped that the TIA lawyer will be able to assure TR45 that they have no fear over accepting our mechanism.
Tdoc 5, 3GPP-IS41 interoperation, Siemens/Vodafone-Airtouch.  This document described ideas on how 3GPP-IS41 inter-operation could work. It was generally received well though with close questioning from Lucent.  The proposals need more work, particularly with regard to implicit registration (an IS-41 feature which allows a roaming user to be given service immediately, before the HE has been contacted and the user properly authenticated) and also with regard to IS-41 users roaming to 3GPP.  It is a requirement of the ESA that it should allow 2G users (with a dual band phone) to roam onto 3G networks.  There does not seem to be the concern within AHAG with allowing 2G users onto a 3G network that there is in 3GPP with regard to the user of GSM SIMs as 3G access modules.  We should therefore work to make our proposal for IS-41 roaming to 3G simpler.  Lucent suggested taking 3GPP/3GPP2 inter-operation into the Global Harmonisation Group.
End of straw poll details.

Enhanced Subscriber Privacy (ESP) discussion
The final ESP candidates are : Sober t16, Shastream (both Qualcomm), Shazam, SCEMA (both Lucent) and SSC-2 (GTE).  Twofish and E2 are excluded as the originators have not provided source code and other required documentation.
CC said that AHAG will provide a recommendation at the next AHAG meeting which might be that all remaining 5 are acceptable from a security point of view.  Each air interface group will then choose a winner and a backup.  CC reckoned that .3 and .5 tend to work independently and cannot be guaranteed to choose the same two.  It therefore seems likely that there will be multiple acceptable 3G ciphering algorithms – not good.  Can Airtouch affect matters here?
Tdoc 20, Qualcomm, introducing t16.  There are no major differences between s16 and t16.  High byte lookup table is from SKIPJACK and low byte is from QUT.  Making s box entirely key dependent does not completely frustrate Guess and Determine (G&D) attacks.  Key dependent word is added to non-linear function and seems to add 16 bits of security, vs. G&D attacks.  Stuttering adds c.17 bits of security, and is designed to counter correlation attacks. (Qualcomm pointed out that SOBER was designed to have 64 bit strength.  Submitted version is t16 and it is SOBER s16 (both designed to have 128 bit strength), and not SOBER, that has been on the AHAG table for the last year.)
Tdoc 21, Qualcomm, bounding the encryption time for stuttering.  Stuttering function means that bit is not produced every clock but stutters.  Problem with this is that the time to produce keystream is therefore variable and theoretically could be infinite.  Doc proposes that the stuttering is cut off and output produced if the wait reaches a particular value.  Cut off will only be adopted 1 in 10^4 calls to the cipher stream generator.
Tdoc 13, Qualcomm, extended G&D attacks against t16.  EG&D attacks exploit additional linearities in the cipher beyond that in the feedback function.
Tdoc 19, Qualcomm, on keying in t16.  Claims that BPM (Bliechenbacher, Patel and Meier) paper is wrong in saying that there are no bounds on the period of the algorithm.  Two words in the initial state are linearly related, doc admits this but says that all the non-linear mixing and stuttering afterwards means that no attacks can exploit the linear relation.  Extending length of “FOLD” to 17 means all words in the register are now dependent on all the other words in the register, and not on a subset of the register (all words were always dependent on all parts of the key).
Tdoc 22, SSC-2 description, GTE labs.  SSC-2 is the GTE ESP candidate.  Added 16 bit rotation to output of Fibonacci generator to eliminate Bleichenbacher attack on generator which repeated for long (10^12 word) known plaintext.  GR pointed out that the proof of the security of the algorithm relied on the assumption that the contents of the Fibonacci generator and filter generator are mutually independent and this is apparently not the case.
Tdoc 23, Comments on the ESP candidates, Qualcomm.  
Conclusion is that AHAG is not ready to recommend one of the candidates, as new versions of all have appeared in recent times having been broken previously.  CC worried that if AHAG does not recommend something in the required timescales then the air interface groups will just choose something themselves.
Tdoc 15, Qualcomm, comments on Shazam.  FQ said all comments addressed by delivery of source code to the AHAG by Lucent. Shazam does not use SHA-1 but uses a variant of it.  A ‘1’ and then a 64 bit field giving the length of the block to be hashed is not appended after the block that is hashed, as is required by SHA-1 as in FIPS180.  Also, Shazam does not use the fixed IV prescribed in FIPS180.  Therefore the proofs of the security of Shazam that rest on assumptions regarding SHA-1 do not hold.
Other Business
Mark Morrison (NSA) is investigating the export of 3GPP2 algorithms to countries participating in 3GPP2 (Korea, Japan, China). He will be at the SF AHAG to answer questions on export.
Liaisons
TR45 plenary.  45.2, .3, .5 chairs specifically requested that the ESA proponents present the ESA candidates to their sub-committees. (Bart Vinck of Siemens presented the 3GPP mechanism to 45.2 and .5 on October 12.)  Chris Carrol requested that each sub-committee review and come back with comments and possibly a recommendation.  John Marinho (chair TR45) said if there was consensus by December then TR45 would adopt that proposal and ask AHAG to begin development with the other sub-committees.  If there was not consensus the decision will be taken by vote at the December plenary.  Tdoc 10 contains the summary of July-August AHAG meetings submitted to September 1-2 TR45 plenary
TR45.1 (Analogue).  No 45.1 meetings since last AHAG.  45.1 have created a Location Services group within 45.1.1, chaired by Lucent.  45.1 intend to use the OTA transport protocols for sending GPS information.  More people in the 45.1 working groups than in the plenary.
TR45.2 (Core network).  45.2 has an authentication focus group chaired by Terry Jacobsen, Lucent.
TR45.4 (Base station to switch interface).  Mobile IP has been selected over L2TP as the RP interface tunnelling protocol.
TR45.5 (CDMA).  ESP has been given the placeholder General Encryption Algorithm within 45.5 draft 3G specifications.  Work is well under way on the integration of ciphering into their 3G specifications.  Speech ciphering could be anywhere between layer 3 and MAC as speech does not use upper layer 2 services (i.e. retransmission as provided by the RLC layer).  For RLP, data will be encrypted at the RLP layer.  Signalling and control data will be encrypted at layer 3 using a 32 bit counter for synchronisation, bottom 8 bits will be sent with each message.  This is the same for 3GPP except for the encryption of signalling and control data (presumably not RLC signalling) at layer 3.
Re-synch of ciphering at call setup without authentication and following mid-session loss of cipher sync is achieved by the user sending the lower 24 bits of the 32 bit cipher counter with an 8 bit digital signature using the session key to defeat cipher stream repeat attacks.  It was generally felt that the addition of the “digital signature” was overkill and would only be required if the channel was very asymmetric and a large amount of data could be sent to the MS without return messages (which could not be produced by the intruder) from the MS.  But this problem should be considered within 3GPP S3 to ensure that S3 are satisfied their method of cipher restart without authentication does not need the “digital signature”.
There was a question from 45.5 whether private/public long code mask should be used along with ESP.  Their concern was whether this would impact export restrictions.  CC said that the use of the masks would be considered as “scrambling” and so not restricted.  FQ said use of public and or long term private long code mask gave no value.  He suggested the use of the Qualcomm/Globalstar procedure where a single call long code mask is assigned at call setup.
Future meetings
I suggested a joint S3/AHAG meeting in week 10-14 April (S3 meeting is scheduled for 11-13)
AHAG:	16-18 November, San Francisco.  The December AHAG meeting has been moved to November 29-30 immediately before the TR45 plenary on December 1-2.  Both meetings are in Hawaii.  Tim Wright should be attending the TR45 plenary to answer any questions on the 3GPP mechanism.
45.2/45.3:	8-12 November, Colorado.  Tim Wright should be attending this to present the 3GPP mechanism to 45.3.  Can relevant Airtouch delegates attend this meeting to discuss the 3GPP mechanism with Tim?
Attendance
Attendance: GTE (Chris Carrol, chair) Qualcomm (Frank Quick, Greg Rose), Motorola (Lily Chen, Dan Brown), Ericsson (Bob Slocum), Denzo (Dan Robertson), Nokia (Harry Herlin), Vodafone-Airtouch/3GPP S3 (Tim Wright)