Vulnerabilities in TETRA radio networks
cryptomuseum.com
cryptomuseum.com
I don't know whether the backdoor allegation is correct, but unfortunately we should treat opaque ostensible security with skepticism.
By their nature, such things often can be used for our protection at the same time they are secretly used against us.
"under the guise of protecting trade secrets and swear words in the code, the code encryption actually protects crappy code stuffed with vulnerabilities (i.e. future entry points available to the right friends and foes) and backdoors (some forgotten and some very much not)". And in this case "future" was a while ago.
> The algorithm was developed in 1996/97 at Philips Crypto BV in Eindhoven (Netherlands) as a consultancy job for ETSI-SAGE. As the algorithm is secret, it has never been submitted for peer-review or in-depth security analysis. Instead it was evaluated by other ETSI-SAGE members before being submitted as a formal ETSI standard. All members of the TEA family, use an 80-bit key, but in the case of TEA1 it is effectively reduced to 32 bits, which makes it vulnerable to a brute-force attack. According to one of the developers, this was mandatory to get the algorithm approved for export. It was part of the ETSI specification and was clearly visible in the code [3].
Take, for example, this old article discussing French law in the late 1900s: https://web.archive.org/web/20000118230559/http://www.opengr...
French cryptography exports required authorisation if the key strength was higher than 40 bits. With its 80 bit keys, the TETRA key space would've been too big to qualify for free exports.
As TETRA is part of an ETSI standard, it seems pretty likely to me that one of the European countries had a 32 bit restriction, and TETRA might as well pick the lowest common denominator when it comes to selecting a backdoor.
/s
For example, hiding the fact that your data is encrypted with AES doesn’t make an attacker any more likely to be able to break AES. Similarly, hiding the fact that you use a weak encryption algorithm doesn’t keep an attacker from breaking it.
Obviously you can debate wether having it 'appear' secure for longer before someone publishes details of the flaw is more important or not...
Main goal of security through obscurity is the hindrance. Make it slower and harder to to detect possible vulnerabilities.
So indeed, there is something to debate.
But I guess it helps only against those with limited resources, not against nation states.
Because the academic/opensource communities famously don't have many hours to dedicate to the cause.
People in academics dedicate their lifes for this. Who has more time?
No, the main goal is to obfuscate just how incompetent the authors of the spec are, and how clearly they illustrate Dunning-Kruger.
If you agree that it obfuscates the meaning of the author’s work, then it also slows down other things recursively…
We don't know how many intelligence agencies have found some of these and are happily listening in on "secure" communication, concealing that fact successfully.
I mean, this is embarrassing - but who cares if the secret police are spying on the regular police?
Is it more concerning if it’s the Russian secret police spying on the Kyiv police?
Some other brands end up being used like cobham or bendix but those are usually for aviation.
Tetra isn’t used by us LE. There are military encryption schemes, some of which are classified or controlled occasionally used by feds. Mostly tho you're looking at encrypted voice over data using mobile phones tho. Cellcrypt Inc, for example. Not many investigators lug around a radio to call agents in the field unless they need interoperability with other agencies or tactical communications using local infrastructure.
During the Obama inauguration the Thales liberty triband was used with AES. I think most agencies dumped the Thales Libntry for Harris tri band radios or Motorola now, which is sad because as a result the liberty is basically a dead end platform
What do you mean lasted? If it is an intentional backdoor, it was vulnerable (to those who knew the backdoor) from day 1, so it was never secure let alone 30 years.
I know some group had it pwned at least 2010-ish. But won't elaborate.
And I'm sure they weren't the first, nor the only ones.
> kz (interviewer): How did it go about meeting those requirements, because that's the one they're saying has a backdoor in it. Was that the condition for export?
> BM (ETSI): Backdoor can mean a couple of things I think. Something like you'd stop the random number generator being random, for instance. [But] what I think was revealed [by the researchers] was that TEA1 has reduced key-entropy. So is that a backdoor? I don't know. I'm not sure it's what I would describe as a backdoor, nor would the TETRA community I think.
...
> KZ: People ... believe they're getting an 80-bit key and they're not.
> BM: Well it is an 80-bit long key. [But] if it had 80 bits of entropy, it wouldn't be exportable.
...
> kz: You're saying 25 years ago 32 bit would have been secure?
> BM: I think so. I can only assume. Because the people who designed this algorithm didn't confer with what was then EP-TETRA [ETSI Project-TETRA is the name of the working group that oversaw the development of the TETRA standard]. We were just given those algorithms. And the algorithms were designed with some assistance from some government authorities, let me put it that way.
...
> bm: That's what we now know yeah - that it did have a reduced key length.
> KZ: What do you mean we now know? SAGE created this algorithm but the Project-TETRA people did not know it had a reduced key?
> BM: That's correct. Not before it was delivered. Once the software had been delivered to them under the confidential understanding, that's the time at which they [would have known].
...
You've really got to wonder who at ETSI gave the thumbs up on doing this interview.
0 - https://www.zetter-zeroday.com/p/interview-with-the-etsi-sta...
> The Midnight Blue researchers have since demonstrated real-life exploitations of some of the vulnerabilities, for example at the 2023 Blackhat Conference in Las Vegas (USA). They have shown that TETRA communications secured with the TEA1 encryption algorithm can be broken in one minute on a regular commercial laptop and in 12 hours on a classic laptop from 1998 [III].
In 1998, the EFF built a custom DES Cracker[0] for around $250k that could crack a 56-bit DES message in around 1 week. As was the custom at the time, they published the source code, schematics, and VHDL source in a printed book to evade (and, I guess, mock) export restrictions.
The EFF's legal challenge was essentially that if crypto is a munition, then this printed book explaining the crypto is also at least as much of a munition, if not more so. They gave the judge the choice between deciding that a printed book is some sort of deadly tool, or deciding that crypto wasn't conceptually a munition. Strangely, the judge ruled in the EFF's favor.
It's essentially a surreptitious version of what the US did in the 1990s with "export ciphers".
How's that not a backdoor?
The weaker cipher mode, TEA1, is used when selling the radios to anyone who may not necessarily be an ally or highly trusted. This is the legacy of strong crypto being export-controlled.
It was public that these ciphers were weaker, but they were actually much weaker than advertised. This is the backdoor.
https://www.rcrwireless.com/19980309/archived-articles/dolph...
https://web.archive.org/web/20230213001335/https://github.co...
Nobody is surprised these protocols have been broken, it should not be a surprise, and having some kind of panic reaction should be considered either a charade or a case of abysmal management.
Interesting discussion about responsible disclosure. It seems a strange belief that you can tell all the radio operators about the vulnerability without also telling exploiters. Aren't they often one and the same? What's a reasonable approach here?
> The Dutch NCSC (NCSC-NL) was informed in December 2021, after which meetings were held with the law enforcement and intelligence communities, as well as with ETSI and the vendors. Shortly afterwards, on 2 February 2022, preliminary advice was distributed to the various stakeholders and CERTs. The remainder of 2022 and the first half of 2023 were used for coordination and advisory sessions with stakeholders, allowing manufacturers to come up with firmware patches, updates or workarounds.
This reads to me as if malicious parties were notified some 18 months before users were notified.
I know "bad guys" is a harsh phrasing, but when it comes to encrypted communication, they are literally the definition of the adversary. Anybody in intelligence that doesn't play for my team is a "bad guy". And since everybody belongs to multiple conflicting teams, even a person who plays on one of my teams is a "bad guy" from the perspective of my other teams.
If the first place you go with a disclosure is to the intelligence community, you are hurting users.
I suspect that there was an update (or replacement) to the radios that was generally described as an ordinary update / maintenance.
Should the vendor be allowed to continue to sell models they know are compromised while their competition loses those contracts? Shouldn't there be some consequence for such fraud?
It's kind of like saying...
Vendor: "We support up to 1 zillion bit encryption!"
User: "What's the default out of the box?"
Vendor: "10 bit"
Everybody plays the espionage game, Europe really is no exception, they just like to use the US to keep their hands (mostly) clean.
This is IMHO a very unfair TLDR; . The news is that the researchers claim that there is deliberate backdoor, which ETSI denies. If it is true, there cannot be any further trust in other proprietary parts as well.
The lack of any large allocation for this kind of radio is a big part of why US first responders are stuck with P.25, which is narrowband FM. If there were a wide-enough band in which it could be used, a lot of first responders would have bought TETRA radios a long time ago. P.25 is easy to jam by brute-force power output, and trivial if you directly attack the error correction bits. TETRA and FHSS have a much much larger ratio of attacker transmit power to victim transmit power.
https://en.wikipedia.org/wiki/Project_25#Jamming_vulnerabili...
(FWIW, P.25 is an even worse dumpster-fire than TETRA...)
https://www.powertrunk.com/pressroom/tetra-in-north-america/
That's cool, but it's going to be a niche use at those power levels. One of the things that make TETRA and P.25 so attractive is that you can put a huge, high-power repeater on a hill or tall building and cover a big chunk of a city using (fairly) small low-power handsets. Then multiple agencies (police, fire, spooks, clowns) can all use that repeater and share the cost burden.
The power-limited version looks like it'll always be a fairly niche single-agency-in-single-jurisdiction use. So the threat, while technically not zero, is not at the five-alarm-fire level that it is in Europe.
Edit: also looks like MTA bought their own spectrum license just for this one use:
MTA owns licenses in 700 MHz and 800 MHzWhich alone implies that the Tetra crypto security theatre is well known in that industry, and isn't a surprise to vendors in the slightest.