Prediction of Plaintext in GSM Network using SDCCH Logical Channel

GSM cellular standard is still widely used worldwide. In this standard, A5 ciphering algorithms are employed for protecting user data. A5/1 and A5/3 are two variants of A5 ciphering algorithms that are proven to be very powerful. Most known attacks on these ciphering algorithms assume some known plaintext data. In this paper, for the first time, a method of plaintext prediction is proposed for SDCCH logical channel. Four possible downlink SDCCH packets, which are RR, UA, SABM, and UI Fill frames, are considered. The matrices of the occurrence positions and probabilities of these packets are learned by observing the network traffic. Four matrices are considered corresponding to four different types of sessions. Experiments on a real-world network show that we can correctly predict on average 2.94 plaintexts for each session. Moreover, the average position of the first correct plaintext in all predicted plaintexts is equal to 1.24. So, the required time for cipher cracking is around 25% more than the time required by an ideal plaintext prediction system