A Single Key Attack on Reduced-round KASUMI-based f9 Algorithm

An attack on f9 algorithm based on 4-round KASUMI is given with a single-key method. The meet-in -the-middle thought is applied into the attack and the based key set and the exhaustive key set are chosen. Then f9 algorithm is attacked with the linear relationship between plaintext and K3. At the same time, collision properties and table-lookups are applied to reduce the time complexity. As a result, with 232 plaintexts with the corresponding MACs, the attack needs 2125.85 f9 calculations with 236 memory to recovery all the key.