An experimental security analysis of two satphone standards

Abstract

General purpose communication systems such as GSM and UMTS have been in the focus of security researchers for over a decade now. Recently also technologies that are only used under more specific circumstances have come into the spotlight of academic research and the hacker scene alike. A striking example of this is recent work [Driessen et al. 2012] that analyzed the security of the over-the-air encryption in the two existing ETSI satphone standards GMR-1 and GMR-2. The firmware of handheld devices was reverseengineered and the previously unknown stream ciphers A5-GMR-1 and A5-GMR-2 were recovered. In a second step, both ciphers were cryptanalized, resulting in a ciphertext-only attack on A5-GMR-1 and a known-plaintext attack on A5-GMR-2.In this work, we extend the afore-mentioned results in the following ways: First, we improve the proposed attack on A5-GMR-1 and reduce its average case complexity from 2 32 to 2 21 steps. Second, we implement a practical attack to successfully record communications in the Thuraya network and show that it can be done with moderate effort for approx. $5 000. We describe the implementation of our modified attack and the crucial aspects to make it practical. Using our eavesdropping setup, we recorded 30 seconds of our own satellite-to-satphone communication and show that we are able to recover Thuraya session keys in half an hour (on average). We supplement these results with experiments designed to highlight the feasibility of also eavesdropping on the satphone's emanations.The purpose of this paper is threefold: Develop and demonstrate more practical attacks on A5-GMR-1, summarize current research results in the field of GMR-1 and GMR-2 security, and shed light on the amount of work and expertise it takes from setting out to analyze a complex system to actually break it in the real world.

Initialisation flaws in the A5-GMR-1 satphone encryption algorithm

“…Firstly, we describe attacks in the existing public literature: a guess and determine attack presented as the preliminary cryptanalysis of the keystream [3], and an improved version in [4] that uses keystreams from multiple frames. Then we discuss the application of a generic time-memory attack to the cipher.…”

“…Initialisation using K and E must be performed before a keystream segment of the required length can be generated and used for encryption or decryption of the frame. An outline of the initialisation process is provided in [3] with additional detail given in [4]. A good initialisation process should ensure that each (K,E) pair generates a distinct and unpredictable keystream sequence, and that multiple sequences produced with the same key but different frame numbers appear unrelated.…”

“…In this paper, we consider the description of A5-GMR-1 gleaned from [3] and [4]. We investigate vulnerabilities introduced by poor design choices in the initialisation process.…”

Design and Implementation to Authentication over a GSM System Using Certificate-Less Public Key Cryptography (CL-PKC)

“…The Authentication process lies before the ciphering process, and it is a most important process in the GSM security, because it is ensured that the ciphering scheme achieved for the right party. There are many works took GSM security, some of them are only analytic study, and some of these studies are improvements of GSM security, and in the following section the most important related works are posted [4] and described the attacks over the IP networks and their suggested solutions to counter measures for the attacks in 2.5G and 3G Cellular IP Networks. Forsgren et al [5] Proposed Security and Trust of Public Key Cryptography Options for Host Identity Protocol to give verified identities to host using public key certificates and certificate-less public key cryptography (CL-PKC).…”

“…* The inverse of a point (x, y) is (x, −y), where −y is the additive inverse of y. For example, if we have a curve y 2 = x 3 − 4x, and p = 13, the inverse of (4, 2)is (4,11). Because 2+11 mod 13 = 0 * ECDLP: is a "hard" problem, equivalent to solving the discrete logarithm: • Q = k P, where Q, P belong to a prime curve.…”