3 ms·

A related topic... GSM security is better in western nations than other nations: > Many western countries use the “strong” encryption algorithm A5/1, whil

by cies 6y ago

A related topic... GSM security is better in western nations than other nations: > Many western countries use the “strong” encryption algorithm A5/1, while other countries are “forced” to rely on the much weaker A5/2. [1] So in non-western countries breaking GSM security is much cheaper than in the rest. Why would that be? Who would want that and has the ability to exert such force? So tether the open source running latop internet access over the burner phone and use a VPN to protect your privacy. 1: https://www.diva-portal.org/smash/get/diva2:19603/fulltext01 https://www.diva-portal.org/smash/get/diva2:19603/fulltext01

lxgr 6y ago
> use the “strong” encryption algorithm A5/1, while other countries are “forced” to rely on the much weaker A5/2 Aren't they both equally bad due to being completely broken at this point? >So in western countries breaking GSM security is much cheaper than in the rest. You got it the wrong way around: A5/2 is the "export" version used in "non-western countries". The reason for that is crypto export controls which were very fashionable at the time GSM was developed. > use a VPN to protect your privacy. This is off-topic, but I'd challenge that as a general recommendation.
- cies 6y ago
  > You got it the wrong way around Sorry, fixed it.
monocasa 6y ago
It's the classic "export grade encryption" setup. As for who would want it that way, the answer is five eyes.
cpgxiii 6y ago
> Why would that be? Who would want that and has the ability to exert such force? Essentially every country ever has desired to have an "unbreakable" cipher for its own use and breakable ciphers for everyone else. Only in the modern era has the general cryptographic security of civilian communications become a concern. You can't prevent other nations from independently implementing or inventing better ciphers, but in the modern era where only a limited number of vendors implementing a given technology exist, those vendors are constrained by export restrictions in their countries of origin.
secondcoming 6y ago
I think it had the potential to be, but I'm not sure that it actually was. I have no means to back it up, but I recall that the French were heavily involved in GSM and, well, they liked a lot of zeros in encryption keys...
myself248 6y ago
Wasn't the "strong" one also intentionally weak, but in a way the NSA thought only they knew about? ISTR something along those lines being in the Snowden revelations.
- usr1106 6y ago
  > but in a way the NSA thought only they knew about? I doubt the NSA was involved. GSM was developed in Europe. But it was development by committee and strong cryptography background was underrepresented at least. So bad flaws went even into the supposedly strong encryption.
FreshFries 6y ago
Coming from this space, I can tell you that the fear of operators to _maybe_ break 0.1% of their customer's experience is a solid ground to not update. I have seen these discussions first hand (in Europe, early 2000) where we had to convince super large providers that they should update the crypto (an other issue: the refresh timing of the TIMSIs) and accept that some old (blackberry mainly at that time) devices would not be happy. Think about the numbers, some of these national providers have 20 million customers and there is nothing more expensive then 200.000 people contacting customer service or even leaving to the other provider since their phone does work there...

by cies 6y ago

lxgr 6y ago

> use the “strong” encryption algorithm A5/1, while other countries are “forced” to rely on the much weaker A5/2 Aren't they both equally bad due to being completely broken at this point? >So in western countries breaking GSM security is much cheaper than in the rest. You got it the wrong way around: A5/2 is the "export" version used in "non-western countries". The reason for that is crypto export controls which were very fashionable at the time GSM was developed. > use a VPN to protect your privacy. This is off-topic, but I'd challenge that as a general recommendation.

cies 6y ago
> You got it the wrong way around Sorry, fixed it.

monocasa 6y ago

It's the classic "export grade encryption" setup. As for who would want it that way, the answer is five eyes.

cpgxiii 6y ago

> Why would that be? Who would want that and has the ability to exert such force? Essentially every country ever has desired to have an "unbreakable" cipher for its own use and breakable ciphers for everyone else. Only in the modern era has the general cryptographic security of civilian communications become a concern. You can't prevent other nations from independently implementing or inventing better ciphers, but in the modern era where only a limited number of vendors implementing a given technology exist, those vendors are constrained by export restrictions in their countries of origin.

secondcoming 6y ago

I think it had the potential to be, but I'm not sure that it actually was. I have no means to back it up, but I recall that the French were heavily involved in GSM and, well, they liked a lot of zeros in encryption keys...

myself248 6y ago

Wasn't the "strong" one also intentionally weak, but in a way the NSA thought only they knew about? ISTR something along those lines being in the Snowden revelations.

usr1106 6y ago
> but in a way the NSA thought only they knew about? I doubt the NSA was involved. GSM was developed in Europe. But it was development by committee and strong cryptography background was underrepresented at least. So bad flaws went even into the supposedly strong encryption.

FreshFries 6y ago

Coming from this space, I can tell you that the fear of operators to _maybe_ break 0.1% of their customer's experience is a solid ground to not update. I have seen these discussions first hand (in Europe, early 2000) where we had to convince super large providers that they should update the crypto (an other issue: the refresh timing of the TIMSIs) and accept that some old (blackberry mainly at that time) devices would not be happy. Think about the numbers, some of these national providers have 20 million customers and there is nothing more expensive then 200.000 people contacting customer service or even leaving to the other provider since their phone does work there...