Real-Time Cryptanalytic Break of GSM A5/2 Export Cipher (Barkan, Biham & Keller)

A5/2, the deliberately weakened export variant of A5/1, uses four linear feedback shift registers, one of which (R4) controls the irregular clocking of the other three. Because GSM applies error-correction coding before encryption, the ciphertext carries known linear redundancy; the researchers turned this into a system of linear equations solvable from ciphertext alone, recovering the key in under a second. Since GSM derives the same session key Kc for A5/1, A5/2, A5/3 and GPRS, they also described an active man-in-the-middle that forces a handset to use A5/2, recovers Kc, and then reuses it against traffic protected by the stronger ciphers.