In trying to verify the setup, the following test was run repeatedly: a) Generate a random Kc and 4 successive frame numbers b) Use the Kc and frame number to generate the downlink and uplink keystreams for 4 bursts. c) Feed the uplink keystreams to Kraken and find_kc to determine success
This produced a success rate of about 40% (or 67 % for two messages) When the same procedure was repeated except using downlink keystreams, it gave a success rate of 85% for two messages. Would you anticipate differences between the success probability on uplink versus downlink? Might it be caused by differences in Rainbow table coverage? If so, could rainbow tables of the same size be generated in a manner that favors the uplink? -Todd On Tue, Sep 13, 2011 at 11:50 PM, Karsten Nohl <[email protected]> wrote: > Hi, > > On Sep 14, 2011, at 2:34 AM, T wrote: > >> Thanks for the info. >> >> On Mon, Sep 12, 2011 at 11:01 PM, Karsten Nohl <[email protected]> wrote: >>> On Sep 12, 2011, at 11:21 PM, T wrote: >>>> Why are only some bursts able to be cracked? >>> The coverage of all tables combined is 0.04%. >>>> What percentage of bursts is expected to be cracked? >>> Each burst gives you 114-63 tries with 0.04% success probability each. >>>> Should at least one of the four bursts in a message always be cracked? >>> Four burst are cracked with 92% success. >> >> How do you get to the 92% success rate for four bursts? >> >> If I assume a 0.04% success rate for each try, I get: >> p=0.04e-2; >> Probability of success = 1 - (1-p)^(4*(114-63)) = 7.8% > > The calculation is not quiet as simple as the A5/1 state space is not > uniformly distributed. > > But you are right, there was a little inconsistency in my calculation: I was > assuming 8 bursts, ie. 2 full messages. > >> Also, how does that compare to the success rate quoted here: >> https://media.blackhat.com/bh-ad-10/Nohl/BlackHat-AD-2010-Nohl-Attacking-Phone-Privacy-wp.pdf >> "Given two encrypted known plaintext messages (ie. Cipher mode complete and a >> System Information message), the table set finds a secret key with >> almost 90% probability." > > 2 messages => 92% success. > > Cheers, > > -Karsten _______________________________________________ A51 mailing list [email protected] http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
