General  

Designers  James A. Reeds III 
First published  1991 
Cipher detail  
Key sizes  64 bits 
Block sizes  1664 bits 
Rounds  3 
Best public cryptanalysis  
338 chosen plaintexts break all block sizes, 4080 known plaintexts break 24bit blocks, and 4 known plaintexts break 16bit blocks 
In cryptography, the Cellular Message Encryption Algorithm (CMEA) is a block cipher which was used for securing mobile phones in the United States. CMEA is one of four cryptographic primitives specified in a Telecommunications Industry Association (TIA) standard, and is designed to encrypt the control channel, rather than the voice data. In 1997, a group of cryptographers published attacks on the cipher showing it had several weaknesses.^{[1]} Some accusations were made that the NSA had pressured the original designers into crippling CMEA, but the NSA has denied any role in the design or selection of the algorithm. The ECMEA and SCEMA ciphers are derived from CMEA.
CMEA is described in U.S. Patent 5,159,634. It is byteoriented, with variable block size, typically 2 to 6 bytes. The key size is only 64 bits. Both of these are unusually small for a modern cipher. The algorithm consists of only 3 passes over the data: a nonlinear lefttoright diffusion operation, an unkeyed linear mixing, and another nonlinear diffusion that is in fact the inverse of the first. The nonlinear operations use a keyed lookup table called the Tbox, which uses an unkeyed lookup table called the CaveTable. The algorithm is selfinverse; reencrypting the ciphertext with the same key is equivalent to decrypting it.
CMEA is severely insecure. There is a chosenplaintext attack, effective for all block sizes, using 338 chosen plaintexts. For 3byte blocks (typically used to encrypt each dialled digit), there is a knownplaintext attack using 40 to 80 known plaintexts. For 2byte blocks, 4 known plaintexts suffice.
The "improved" CMEA, CMEAI, is not much better: chosenplaintext attack of it requires less than 850 plaintexts in its adaptive version.^{[2]}
