Cellular Message Encryption Algorithm - Revision history

Iamwikipedian12 at 16:57, 27 September 2024

2024-09-27T16:57:50Z

← Previous revision		Revision as of 16:57, 27 September 2024
Line 14:		Line 14:
	\| cryptanalysis = 338 chosen plaintexts break all block sizes, 40-80 known plaintexts break 24-bit blocks, and 4 known plaintexts break 16-bit blocks		\| cryptanalysis = 338 chosen plaintexts break all block sizes, 40-80 known plaintexts break 24-bit blocks, and 4 known plaintexts break 16-bit blocks
	}}		}}
	In [[cryptography]], the '''Cellular Message Encryption Algorithm''' ('''CMEA''') is a [[block cipher]] which was used for securing [[mobile phone]]s in the [[United States]]. CMEA is one of four cryptographic primitives specified in a [[Telecommunications Industry Association]] (TIA) standard, and is designed to [[encrypt]] the control channel, rather than the voice data. In 1997, a group of cryptographers published attacks on the [[cipher]] showing it had several weaknesses which give it a trivial effective strength of a 24-bit to 32-bit cipher.<ref name="crypto97_cmea">{{cite conference		In [[cryptography]], the '''Cellular Message Encryption Algorithm''' ('''CMEA''') is a [[block cipher]] which was used for securing [[mobile phone]]s in the [[United States]]. CMEA is one of four [[Cryptography\|cryptographic]] primitives specified in a [[Telecommunications Industry Association]] (TIA) standard, and is designed to [[encrypt]] the control channel, rather than the voice data. In 1997, a group of cryptographers published attacks on the [[cipher]] showing it had several weaknesses which give it a trivial effective strength of a 24-bit to 32-bit cipher.<ref name="crypto97_cmea">{{cite conference
	\| author = [[David A. Wagner\|David Wagner]], [[Bruce Schneier]], [[John Kelsey (cryptanalyst)\|John Kelsey]]		\| author = [[David A. Wagner\|David Wagner]], [[Bruce Schneier]], [[John Kelsey (cryptanalyst)\|John Kelsey]]
	\| title = Cryptanalysis of the Cellular Message Encryption Algorithm		\| title = Cryptanalysis of the Cellular Message Encryption Algorithm

JCW-CleanerBot: /* top */task, replaced: Advances in Cryptology - → Advances in Cryptology –

2023-07-05T04:09:20Z

top: task, replaced: Advances in Cryptology - → Advances in Cryptology –

← Previous revision		Revision as of 04:09, 5 July 2023
Line 17:		Line 17:
	\| author = [[David A. Wagner\|David Wagner]], [[Bruce Schneier]], [[John Kelsey (cryptanalyst)\|John Kelsey]]		\| author = [[David A. Wagner\|David Wagner]], [[Bruce Schneier]], [[John Kelsey (cryptanalyst)\|John Kelsey]]
	\| title = Cryptanalysis of the Cellular Message Encryption Algorithm		\| title = Cryptanalysis of the Cellular Message Encryption Algorithm
	\| conference = Advances in Cryptology - [[CRYPTO]] '97, 17th Annual International Cryptology Conference		\| conference = Advances in Cryptology – [[CRYPTO]] '97, 17th Annual International Cryptology Conference
	\| pages = 526–537		\| pages = 526–537
	\| date = August 1997		\| date = August 1997

Sammi Brie: Adding local short description: "Block cipher", overriding Wikidata description "severely insecure block cipher, designed to encrypt the control channel (rather than the voice data) for cellular telephone communication in the United States" (Shortdesc helper)

2021-03-09T19:18:27Z

Adding local short description: "Block cipher", overriding Wikidata description "severely insecure block cipher, designed to encrypt the control channel (rather than the voice data) for cellular telephone communication in the United States" (Shortdesc helper)

← Previous revision		Revision as of 19:18, 9 March 2021
Line 1:		Line 1:
			{{Short description\|Block cipher}}
	{{Infobox block cipher		{{Infobox block cipher
	\| name = CMEA		\| name = CMEA

Monkbot: Task 18 (cosmetic): eval 2 templates: del empty params (2×); hyphenate params (1×);

2020-12-22T05:10:46Z

Task 18 (cosmetic): eval 2 templates: del empty params (2×); hyphenate params (1×);

← Previous revision		Revision as of 05:10, 22 December 2020
Line 22:		Line 22:
	\| url = http://www.schneier.com/paper-cmea.html		\| url = http://www.schneier.com/paper-cmea.html
	\| format = [[PDF]]/[[PostScript]]		\| format = [[PDF]]/[[PostScript]]
	\| ~~accessdate~~ = 2007-02-07 }}		\| access-date = 2007-02-07 }}
	</ref>		</ref>
	Some accusations were made that the [[NSA]] had pressured the original designers into crippling CMEA, but the NSA has denied any role in the design or selection of the algorithm. The [[ECMEA]] and [[SCEMA]] ciphers are derived from CMEA.		Some accusations were made that the [[NSA]] had pressured the original designers into crippling CMEA, but the NSA has denied any role in the design or selection of the algorithm. The [[ECMEA]] and [[SCEMA]] ciphers are derived from CMEA.
Line 30:		Line 30:
	CMEA is severely insecure. There is a [[chosen-plaintext attack]], effective for all block sizes, using 338 chosen plaintexts. For 3-byte blocks (typically used to encrypt each dialled digit), there is a [[known-plaintext attack]] using 40 to 80 known plaintexts. For 2-byte blocks, 4 known plaintexts suffice.		CMEA is severely insecure. There is a [[chosen-plaintext attack]], effective for all block sizes, using 338 chosen plaintexts. For 3-byte blocks (typically used to encrypt each dialled digit), there is a [[known-plaintext attack]] using 40 to 80 known plaintexts. For 2-byte blocks, 4 known plaintexts suffice.

	The "improved" CMEA, CMEA-I, is not much better: chosen-plaintext attack of it requires less than 850 plaintexts in its adaptive version.<ref name="url_eprint_2008_445">{{cite web \|url=http://eprint.iacr.org/2008/445.pdf \|format=PDF\|title=Cryptanalysis of the Improved Cellular Message Encryption Algorithm ~~\|work= \|accessdate=~~ \|author1=Thomas Chardin \|author2=Raphaël Marinier }}</ref>		The "improved" CMEA, CMEA-I, is not much better: chosen-plaintext attack of it requires less than 850 plaintexts in its adaptive version.<ref name="url_eprint_2008_445">{{cite web \|url=http://eprint.iacr.org/2008/445.pdf \|format=PDF\|title=Cryptanalysis of the Improved Cellular Message Encryption Algorithm \|author1=Thomas Chardin \|author2=Raphaël Marinier }}</ref>

	==See also==		==See also==

Cherkash at 21:35, 23 September 2020

2020-09-23T21:35:43Z

← Previous revision		Revision as of 21:35, 23 September 2020
Line 8:		Line 8:
	\| derived to =		\| derived to =
	\| key size = 64 bits		\| key size = 64 bits
	\| block size = ~~16-64~~ bits		\| block size = 16–64 bits
	\| structure =		\| structure =
	\| rounds = 3		\| rounds = 3

Foia req at 18:09, 22 November 2017

2017-11-22T18:09:19Z

← Previous revision		Revision as of 18:09, 22 November 2017
Line 26:		Line 26:
	Some accusations were made that the [[NSA]] had pressured the original designers into crippling CMEA, but the NSA has denied any role in the design or selection of the algorithm. The [[ECMEA]] and [[SCEMA]] ciphers are derived from CMEA.		Some accusations were made that the [[NSA]] had pressured the original designers into crippling CMEA, but the NSA has denied any role in the design or selection of the algorithm. The [[ECMEA]] and [[SCEMA]] ciphers are derived from CMEA.

	CMEA is described in {{US patent\|5159634}}. It is [[byte-oriented]], with variable [[block size (cryptography)\|block size]], typically 2 to 6 bytes. The [[key size]] is only 64 bits. Both of these are unusually small for a modern cipher. The algorithm consists of only 3 passes over the data: a non-linear left-to-right diffusion operation, an unkeyed linear mixing, and another non-linear diffusion that is in fact the inverse of the first. The non-linear operations use a keyed [[lookup table]] called the ''T-box'', which uses an unkeyed lookup table called the ''CaveTable''. The algorithm is self-inverse; re-encrypting the ciphertext with the same key is equivalent to decrypting it.		CMEA is described in {{US patent\|5159634}}. It is [[byte-oriented]], with variable [[block size (cryptography)\|block size]], typically 2 to 6 bytes. The [[key size]] is only 64 bits. Both of these are unusually small for a modern cipher. The algorithm consists of only 3 passes over the data: a non-linear left-to-right diffusion operation, an unkeyed linear mixing, and another non-linear diffusion that is in fact the inverse of the first. The non-linear operations use a keyed [[lookup table]] called the ''T-box'', which uses an unkeyed lookup table called the ''CaveTable''. The algorithm is [[Involution (mathematics)\|self-inverse]]; re-encrypting the ciphertext with the same key is equivalent to decrypting it.

	CMEA is severely insecure. There is a [[chosen-plaintext attack]], effective for all block sizes, using 338 chosen plaintexts. For 3-byte blocks (typically used to encrypt each dialled digit), there is a [[known-plaintext attack]] using 40 to 80 known plaintexts. For 2-byte blocks, 4 known plaintexts suffice.		CMEA is severely insecure. There is a [[chosen-plaintext attack]], effective for all block sizes, using 338 chosen plaintexts. For 3-byte blocks (typically used to encrypt each dialled digit), there is a [[known-plaintext attack]] using 40 to 80 known plaintexts. For 2-byte blocks, 4 known plaintexts suffice.

InternetArchiveBot: Rescuing 1 sources and tagging 0 as dead. #IABot (v1.5beta)

2017-08-01T19:34:02Z

Rescuing 1 sources and tagging 0 as dead. #IABot (v1.5beta)

← Previous revision		Revision as of 19:34, 1 August 2017
Line 42:		Line 42:
	==External links==		==External links==
	* [http://www.schneier.com/cmea.html The attack on CMEA]		* [http://www.schneier.com/cmea.html The attack on CMEA]
	* [https://web.archive.org/web/20040617095418/http://www.snapshield.com~~:80~~/www_problems/United_States/New_Digital.htm Press release and the NSA response]		* [https://web.archive.org/web/20040617095418/http://www.snapshield.com/www_problems/United_States/New_Digital.htm Press release and the NSA response]
	* [http://www.cs.berkeley.edu/~daw/papers/cmea-crypto97-www/paper10.html Cryptanalysis of the Cellular Message Encryption Algorithm David Wagner Bruce Schneier 1997]		* [http://www.cs.berkeley.edu/~daw/papers/cmea-crypto97-www/paper10.html Cryptanalysis of the Cellular Message Encryption Algorithm David Wagner Bruce Schneier 1997]

InternetArchiveBot: Rescuing 1 sources and tagging 0 as dead. #IABot (v1.2.7.1)

2016-11-17T23:47:33Z

Rescuing 1 sources and tagging 0 as dead. #IABot (v1.2.7.1)

← Previous revision		Revision as of 23:47, 17 November 2016
Line 42:		Line 42:
	==External links==		==External links==
	* [http://www.schneier.com/cmea.html The attack on CMEA]		* [http://www.schneier.com/cmea.html The attack on CMEA]
	* [http://www.snapshield.com/www_problems/United_States/New_Digital.htm Press release and the NSA response]		* [https://web.archive.org/web/20040617095418/http://www.snapshield.com:80/www_problems/United_States/New_Digital.htm Press release and the NSA response]
	* [http://www.cs.berkeley.edu/~daw/papers/cmea-crypto97-www/paper10.html Cryptanalysis of the Cellular Message Encryption Algorithm David Wagner Bruce Schneier 1997]		* [http://www.cs.berkeley.edu/~daw/papers/cmea-crypto97-www/paper10.html Cryptanalysis of the Cellular Message Encryption Algorithm David Wagner Bruce Schneier 1997]

Dcirovic: /* top */clean up using AWB

2016-05-28T21:00:18Z

top: clean up using AWB

← Previous revision		Revision as of 21:00, 28 May 2016
Line 30:		Line 30:
	CMEA is severely insecure. There is a [[chosen-plaintext attack]], effective for all block sizes, using 338 chosen plaintexts. For 3-byte blocks (typically used to encrypt each dialled digit), there is a [[known-plaintext attack]] using 40 to 80 known plaintexts. For 2-byte blocks, 4 known plaintexts suffice.		CMEA is severely insecure. There is a [[chosen-plaintext attack]], effective for all block sizes, using 338 chosen plaintexts. For 3-byte blocks (typically used to encrypt each dialled digit), there is a [[known-plaintext attack]] using 40 to 80 known plaintexts. For 2-byte blocks, 4 known plaintexts suffice.

	The "improved" CMEA, CMEA-I, is not much better: chosen-plaintext attack of it requires less than 850 plaintexts in its adaptive version.<ref name="url_eprint_2008_445">{{cite web \|url=http://eprint.iacr.org/2008/445.pdf \|format=PDF\|title=Cryptanalysis of the Improved Cellular Message Encryption Algorithm \|work= \|accessdate= \|~~author~~=		The "improved" CMEA, CMEA-I, is not much better: chosen-plaintext attack of it requires less than 850 plaintexts in its adaptive version.<ref name="url_eprint_2008_445">{{cite web \|url=http://eprint.iacr.org/2008/445.pdf \|format=PDF\|title=Cryptanalysis of the Improved Cellular Message Encryption Algorithm \|work= \|accessdate= \|author1=Thomas Chardin \|author2=Raphaël Marinier }}</ref>
	Thomas Chardin, Raphaël Marinier}}</ref>

	==See also==		==See also==

Maryhit: /* External links */

2014-08-27T08:01:45Z

External links

← Previous revision		Revision as of 08:01, 27 August 2014
Line 44:		Line 44:
	* [http://www.schneier.com/cmea.html The attack on CMEA]		* [http://www.schneier.com/cmea.html The attack on CMEA]
	* [http://www.snapshield.com/www_problems/United_States/New_Digital.htm Press release and the NSA response]		* [http://www.snapshield.com/www_problems/United_States/New_Digital.htm Press release and the NSA response]
			* [http://www.cs.berkeley.edu/~daw/papers/cmea-crypto97-www/paper10.html Cryptanalysis of the Cellular Message Encryption Algorithm David Wagner Bruce Schneier 1997]

	{{Cryptography navbox \| block}}		{{Cryptography navbox \| block}}