ORYX

ORYX is an encryption algorithm used in cellular communications in order to protect data traffic. It is a stream cipher designed to have a very strong 96-bit key strength with a way to reduce the strength to 32-bits for export. However, due to mistakes the actual strength is a trivial 16-bits and any signal can be cracked after the first 25–27 bytes.^[1]

It is one of the four cryptographic primitives standardized by TIA's for use in their digital cellular communications standards TDMA and CDMA.^[1]

ORYX is a simple stream cipher based on binary linear-feedback shift registers (LFSRs) to protect cellular data transmissions (for wireless data services).

The cipher ORYX has four components: three 32-bit LFSRs which labeled as LFSRA, LFSRB and LFSRK, and an S-box containing a known permutation P of the integer values 0 to 255.

The feedback function for LFSRK is defined as:
Lt + 32 = Lt + 28 ⊕ Lt + 19 ⊕ Lt + 18 ⊕ Lt + 16 ⊕ Lt + 14 ⊕ Lt + 11 ⊕ Lt + 10 ⊕ Lt + 9 ⊕ Lt + 6 ⊕ Lt + 5 ⊕ Lt + 1 ⊕ Lt

The feedback functions for LFSRA are defined as:
Lt + 32 = Lt + 26 ⊕ Lt + 23 ⊕ Lt + 22 ⊕ Lt + 16 ⊕ Lt + 12 ⊕ Lt + 11 ⊕ Lt + 10 ⊕ Lt + 8 ⊕ Lt + 7 ⊕ Lt + 5 ⊕ Lt + 4 ⊕ Lt + 2 ⊕ Lt + 1 ⊕ Lt

and
Lt + 32 = Lt + 27 ⊕ Lt + 26 ⊕ Lt + 25 ⊕ Lt + 24 ⊕ Lt + 23 ⊕ Lt + 22 ⊕ Lt + 17 ⊕ Lt + 13 ⊕ Lt + 11 ⊕ Lt + 10 ⊕ Lt + 9 ⊕ Lt + 8 ⊕ Lt + 7 ⊕ Lt + 2 ⊕ Lt + 1 ⊕ Lt

The feedback function for LFSRB is:
Lt + 32 = Lt + 31 ⊕ Lt + 21 ⊕ Lt + 20 ⊕ Lt + 16 ⊕ Lt + 15 ⊕ Lt + 6 ⊕ Lt + 3 ⊕ Lt + 1 ⊕ Lt

• A5/1, used in the GSM cellular telephone standard.
• CMEA, Cellular Message Encryption Algorithm.

• Brief description at Kremlinencrypt.com
• Cryptanalysis of Mobile Phone Cryptology