The Political Economy of Decentralisation in Pakistan

Description

• exposé

The Political Economy of Decentralisation in Pakistan Transversal Theme Decentralisation and Social Movements Working Paper No. 1 S. Akbar Zaidi 2005

• wider context
• decentralisation
• property relations
• local government system
• devolution
• pakistan
• context
• state
• power

Sujets

• Exposé
• Cheema
• National Reconstruction Bureau
• Géiser
• Lahore University of Management Sciences
• Zurich University of Applied Sciences
• Sustainable Development Policy Institute
• Asian Development Bank
• Punjab

Informations

• Publié par: urka
• Nombre de lectures: 18
• Langue: English

Extrait

European Congress on Computational Methods in Applied Sciences and Engineering
ECCOMAS 2004
P. Neittaanm aki, T. Rossi, S. Korotov, E. Onate,~ J. Periaux, and D. Kn orzer (eds.)
Jyv askyl a, 24{28 July 2004
CRYPTOGRAPHIC ALGORITHMS FOR UMTS
Kaisa Nyberg
Nokia Research Center
P.O. Box 407, FIN-00045 Nokia Group, Finland
e-mail: [e-mail]
Key words: cellular security, GSM, UMTS, modes of operation, stream cipher, block
cipher, message authentication code, f8, f9, KASUMI, MILENAGE
Abstract. The cryptographic algorithms of GSM have received a lot of interest and
activity from thegraphic research community and some potential points of failure
have been identi ed. These include secret designs of cryptographic algorithms and weak
integrity protection over the air interface. The objective of this talk is to discuss the design
strategies for the cryptographic algorithms in the third generation cellular networks. In
particular, we consider how the problems found in GSM were addressed in the design of
the 3GPP speci cations for the Universal Mobile Telecommunications System (UMTS)
networks. We also present an overview of the results achieved by researchers within the
cryptographic community. In addition to the topics of the talk this paper gives also an
introduction to the main concepts of the UMTS security architecture. The presentation of
the paper is to large extent based on [25], where a more comprehensive treatment of this
subject can be found.
1Kaisa Nyberg
1 INTRODUCTION
The Global System for Mobile Communications (GSM) is the largest second generation
mobile system. Its security system formed the starting point of the development of security
features for subsequent generations. The fundamental goal of the standard GSMy was to ensure correct billing of the phone calls. Previous incidents from the analog
mobile phone systems had shown how easy it is to impersonate a legitimate subscriber
if no secure authentication mechanism is applied. Subscriber authentication in GSM is
based on a secret key stored in the SIM card that is placed inside the mobile phone.
A cryptographic algorithm is used to protect authentication of the subscriber. Another is used to protect the phone call over the air interface so that the
communication resources are used only for transmitting calls to and from the subscriber
that was identi ed at the beginning of the call. The GSM security system has performed
quite well in ful lling this fundamental requirement of correct billing. The losses due to
SIM cloning are negligible compared with the losses due to credit card fraud, for example,
where about one third of all losses are due to counterfeit cards. GSM subscribers still
trust the billing information of the basic voice and data services given in their phone
bills. However, even if performing quite well in practice, GSM security system is far from
being perfect. Since designed to ensure secure billing, the architecture is too simple to
satisfy the growing needs of various services that are being developed on top of GSM. Also
as technology advances, the attacks that were not present and could not be foreseen as
realistic at the time of development are gradually becoming a reality. Such attacks include
advanced cryptanalytic tools, e cient false base stations, real-time computer analysis, etc.
Although the GSM security architecture has many weak points, it has one excellent
feature: it is almost invisible to the user. If the security relies on some user action,
it is almost certain that at least one of the users will cause a security failure. Human
errors cannot be avoided. In GSM, after the user has activated the phone and the SIM, no
security related action is required from the user other than the intuitive one, keeping good
hold of your phone. The same basic architecture was adopted for the third generation
cellular systems. In addition, several enhancements and changes were made to it in order
to meet the growing telecommunication system’s new needs to secure not only voice
communication, but also a growing variety of other services.
The cryptographic algorithms of GSM have received a lot of interest and activity from
the research community and many points of failure were identi ed. These
include secret designs of cryptographic algorithms and weak integrity protection over
the air interface. The objective of this talk is to discuss the design strategies for the
cryptographic algorithms in the third generation cellular networks. In particular, we take
a look how well these algorithms have resisted the public cryptanalytic e orts during the
rst ve four of their existence.
In this paper we present an extended version of the talk by including some background
information about the general security architecture of the GSM and UMTS systems. The
2Kaisa Nyberg
presentation is based on [25], where a more comprehensive treatment of this subject can
be found. Some recent updates have been added. The rest of the paper is organised as
follows. In Section 2 we give an overviev of the GSM security system. In Section 3 the
main features of the UMTS security architecture is presented. The security of the 3GPP
authentication and key agreement algorithms is discussed in Section 4. The encryption
algorithm f8 and its kernel block cipher KASUMI are discussed in Section 5 and the
integrity algorithm f9 in Section 6.
2 GSM SECURITY
2.1 The GSM system
In the beginning of 1990s, the second-generation mobile systems were introduced. The
most successful of them has been GSM, which had more than 800 million users worldwide
in the beginning of the year 2003. In the United States, the leading second generation
technology has been the TDMA, and in Japan, the PDC system. The most important new
feature in the second generation was the introduction of digital information transmission
in the radio interface between the mobile phone and the base station. In all of the
afore-mentioned systems, the multiple access technology is TDMA. The most immediate
advantages of the second generation over its predecessor were increased capacity of the
network (due to more e ective use of radio resources), better speech quality (due to digital
coding techniques) and the possibility for communicating data much more easily. Also,
it was now possible to enhance security of the system signi cantly.
2.2 Security goals
The goal of the security design for GSM system was clear: the security has to be as
good as that of wireline systems. On the other hand, mechanisms introduced were not
allowed to reduce the usability of the system. The most important security features in
the GSM system are:
authentication of the user,
encryption of communication in radio interface, and
protecting user privacy by using temporary identities.
The success of GSM also emphasised nally the limitations of its security. A popular
technology becomes a very tempting target for attackers. The properties of GSM that
have been most criticised on the security front are the following:
active attacks towards the network are possible (in principle),
sensitive control data such as authentication triplets containing keys used for radio
interface ciphering, are sent between di erent networks without protection, and
3Kaisa Nyberg
some essential parts of the security architecture are kept secret. This does not create
trust on them in the long run because they are not available for analysis by novel
methods. Also global secrets tend to be revealed eventually.
2.3 Authentication of the subscriber in GSM
There exists a permanent secret keyK for each user. This key is stored in two locations:i
in the users Subscriber Identity Module (SIM) card, and
in the Authentication Centre (AuC).
The key K never leaves either of these two locations. The user is authenticated basedi
on this secret in user’s mobile equipment. The authentication is a standard challenge-
response mechanism based on a one-way function [13]. The network sends to the mobile a
challenge, which typically contains a randomly generated value, but may also be based on
a sequence number or time-stamp. The main requirement is that the challenge is fresh,
non-repeating and unpredictable. When the mobile equipment receives the challenge, it
gives it to the SIM module, which computes a response as an output from the one-way
function under the control of the secret keyK . The response is sent to the network. Thei
network has computed its own copy of the response, also called as the expected response.
When the network receives mobile’s response it compares it with the expected response.
If these two values are equal, the mobile has been correctly authenticated.
Unfortunately, this authentication paradigm has a fundamental aw. Assume that an
active attacker has access to some network node that is situated in the middle of the
communication channel between the mobile and the network. Simply by relaying the
challenges and responses, the attacker can pretend to be the end of the communication
channel, where the mobile is expecting the correct base station to be. The problem is well
understood, at least in this basic scenario. One common solution to handle this problem
is that, in addition to the response values, the mobile and the network also compute
a cryptographic key value that is used to protect the subsequent communication. The
man-in-the-middle is still