SNOW
SNOW is a family of word-based synchronous stream ciphers, and at its heart sits a 512-bit linear feedback shift register. Thomas Johansson and Patrik Ekdahl built it at Lund University. The first version was submitted to a European cryptography competition and then rejected, because evaluators found weaknesses in it. What followed was not abandonment but reinvention. How does a cipher that fails its first audition end up encrypting calls on cellular networks? Why did its creators keep rebuilding the same core idea across four major versions? And what changed when one of those versions had to keep pace with 5G?
The 512-bit linear feedback shift register is followed by a non-linear output state machine that carries a few additional words of state. That pairing defines every member of the SNOW family. In the earliest design, the register feeds the next-state function of a finite-state machine, so the two halves are tightly coupled rather than running in parallel. SNOW 1.0, SNOW 2.0, and SNOW 3G all share one register layout. They use sixteen 32-bit words and a 32-bit add-rotate-XOR output transformation, carrying 2 or 3 words of state. Each iteration advances the shift register by 32 bits and produces 32 bits of output. The cipher works on 32-bit words and supports both 128- and 256-bit keys. It has a short initialization phase, which sets up how quickly the cipher can begin producing output once a key is loaded.
During evaluation, weaknesses were discovered, and SNOW was not included in the European suite of algorithms it had been submitted to. The authors did not stop there. They developed version 2.0, which solves those weaknesses and improves performance over the original. A later round of evaluation pushed the design further still. To increase resistance against algebraic attacks, engineers modified it again, and the result was named SNOW 3G. Even these hardened versions are not beyond scrutiny. Researchers found that related keys exist for both SNOW 2.0 and SNOW 3G, and those related keys allow attacks against SNOW 2.0 in the related-key model. The cipher carries no known intellectual property or other restrictions, leaving it open for anyone to study and deploy.
SNOW 3G was chosen as the stream cipher behind two cellular security algorithms, known as UEA2 and UIA2. That placed the family inside the machinery of mobile communications. SNOW 2.0 is one of the stream ciphers selected for an international standard, ISO/IEC 18033-4, which formalized it for broad use. The family also served a quieter role as a measuring stick. SNOW was used in a European cryptography project as a reference cipher for performance evaluation, the yardstick other designs were timed against. From a competition reject to a standardized algorithm, the same core machine kept finding new homes.
SNOW-V arrived in 2019 as an extensive redesign, built to match 5G cellular network speeds by generating 128 bits of output per iteration. That target speed reshaped the internals. SNOW-V and SNOW-Vi use a shift register of thirty-two 16-bit words, designed to be implemented as 4 128-bit SIMD registers, and advanced by 16 bits per iteration. Eight register iterations can run at once using SIMD operations, after which a single output transformation step produces 128 bits of output. The output transformation here borrows from elsewhere in cryptography. It uses the Advanced Encryption Standard round function, commonly implemented in hardware on recent processors, and maintains 2 additional 128-bit words of state. SNOW-Vi was tweaked for even higher speed through small changes to the register, while its output transformation stays identical to SNOW-V.
Common questions
Who developed the SNOW stream cipher family?
SNOW was developed by Thomas Johansson and Patrik Ekdahl at Lund University. It is a family of word-based synchronous stream ciphers.
What is the SNOW cipher used for in cellular networks?
SNOW 3G is chosen as the stream cipher for the 3GPP encryption algorithms UEA2 and UIA2. SNOW-V was a 2019 redesign built to match 5G cellular network speeds.
Why was the original SNOW cipher rejected from the NESSIE project?
During evaluation, weaknesses were discovered in SNOW, and as a result it was not included in the NESSIE suite of algorithms. The authors then developed version 2.0 to solve those weaknesses and improve performance.
What is the difference between SNOW 2.0 and SNOW 3G?
SNOW 3G is a further modification of the design made during ETSI SAGE evaluation to increase resistance against algebraic attacks. Related keys have been found for both SNOW 2.0 and SNOW 3G, allowing attacks against SNOW 2.0 in the related-key model.
How does SNOW-V achieve high speed for 5G?
SNOW-V uses a shift register of 32 16-bit words implemented as 4 128-bit SIMD registers, performing 8 LFSR iterations simultaneously and producing 128 bits of output per iteration. Its output transformation uses the Advanced Encryption Standard round function commonly implemented in hardware on recent processors.
What standards include the SNOW cipher?
SNOW 2.0 is one of the stream ciphers chosen for the ISO/IEC 18033-4 standard. SNOW has also been used in the ESTREAM project as a reference cipher for performance evaluation.