5 ms·

Report finds phone network encryption was deliberately weakened

63 points by stunt 5y ago

WalterBright 5y ago
One should always assume the encryption is compromised. See the success the Allies had in cracking the German and Japanese codes, and how devastating that was to the Axis, who couldn't believe their codes were broken.
- southerntofu 5y ago
  > One should always assume the encryption is compromised. In commercial applications, yes. In free-software that received audit and is built in a more-or-less reproducible manner, there is less concerns. I'd have more trust in Conversations.im built by F-Droid.org repository than any proprietary messenger, for example.
  - shapefrog 5y ago
    I love it when the veil slips and 'open source purists' show they are really about it just being free.
  - deleted 5y ago
    [deleted]
  - southerntofu 5y ago
    So one commenter here said that was nearly not enough, but the comment has been deleted since then. Here's my answer anyway: I agree with your point. You'll see in my previous comment i never said such a solution was secure, just that it has "less concerns" and therefore i have "more trust". But i would rather not place my life in the hands of ANY KIND of software, or hardware that's beyond my mechanical comprehension. In the case of OpenSSL, nobody had dared to even look at the code maintained by a single person. That's a huge problem. That code is not reproducible is another huge problem. It's also a huge problem that even when it is reproducible you don't have a convenient way to bootstrap the environment, to automatically audit code signatures (PGP) on the repository, and to compare checksums with another build environment. The GNU/guix project is addressing all these issues. Their blog is full of good stuff about their work on bootstrap seeds, on their new "guix git authenticate" command which follows a "channel introduction" to validate signatures on the repo, and with "guix challenge" command to compare build output from several repositories. Exciting days ahead of us!
- tialaramex 5y ago
  It is often claimed that the Germans didn't believe Enigma could be broken, but that's false, they simply didn't believe anybody would put the work in and it was indeed a lot of work. Trying to guess what your enemy is thinking is crucial yet very difficult work in a war like that. In "Most Secret War" R.V. Jones provides excerpts from some of the documents he wrote trying to do exactly this, based on what he believed his German equivalents would or ought to know e.g. "A representative from Rechlin might point out that even if they could not go to decimeters, the use of frequency modulation with the present system might provide some immunity from jamming". [ This is referring to the Germans' previously successful radio direction finding for bomber aircraft, which by this point the British are jamming. In the "fog of war" some German pilots believe the signal isn't jammed but "bent" sending them off course, in reality the British never developed the sophisticated calibration needed to actually do this, they just jammed the signals with powerful transmitters, but doubt set in anyway ]
  - mhh__ 5y ago
    Most Secret War is a really really great book, lots of lessons for today's crisis decision makers. Since you have are familiar with the man, there is a great PhD thesis online somewhere analysing Jones's work - he is the only source on manner matters here and he did have an ego. I'll link it when I can find it again. He was passed up for the SciInt job at MI5 post-war for having the wrong background, apparently. Shame, might have put some more pressure on Philby and friends.
  - xyzzy123 5y ago
    This reminds me a bit of the invention of "chaff", which the British and Germans invented independently. Each side held back on using it because they didn't want to tip the other side off. It's curious to think what would have happened if one side or the other had discovered that their opponent knew about it too.
    - mhh__ 5y ago
      They did know.
  - 5y ago
ng55QPSK 5y ago
a) ... was deliberately weakened by US restrictions on cryptography b) ... is a network feature and could have been disabled for ~15 years. c) afaik 3GPP has recent proposal to get GEA1 out of 5G
- yaantc 5y ago
  GEA1 has never been in 4G nor 5G. Both support the same suites: AES-CTR, SNOW 3G (introduced with 3G) or ZUC (Chinese) with 128 bits keys and Western operators use AES.
jeltz 5y ago
Isn't this public knowledge? I remember a guest lecturer talking about this 15 years ago when I was in university.
- sneak 5y ago
  Public knowledge and widely known are two different things. There are things that everyone could know (A), things that everyone knows (B), and things that everyone knows that everyone knows[3] (C). These are distinct sets. The fact that direct access to FAANG servers[2] is granted without a warrant to the US government was widely publicized, yet most people still don't realize that the NSA is regularly looking at naked pictures of Americans stored in cloud services[1]. You might even be aware of this, but have missed the (reported at the same time) fact that this is the #1 source, the most-often used, in US intelligence reports. It's where they do most of their spying. People haven't moved on to C about the non-privacy of gmail, for instance. Everyone savvy knows that gmail is compromised, yet because not everyone knows that everyone knows that, it's still pretended that your email box is private. Publicity is helpful. Most people are too busy to realize what is being done by their military in their name. Repetition helps. [1]: https://youtu.be/XEVlyP4_11M?t=1495 https://youtu.be/XEVlyP4_11M?t=1495 [2]: FISA Amendments Act Section 702, internal codename PRISM, reported in FAANG transparency reports as FISA orders [3]: https://www.epsilontheory.com/harvey-weinstein-common-knowledge-game/ https://www.epsilontheory.com/harvey-weinstein-common-knowle... and https://www.epsilontheory.com/sheep-logic/ https://www.epsilontheory.com/sheep-logic/
- espadrine 5y ago
  This is a case where different ciphers, for more advanced uses, are discovered as purposefully weakened. A5/2 (for voice communication, incl 2G) was known as a purposefully weakened variant of A5/1 for a very long time, and is probably what you remember. A5/3 (3G) and A5/4 (4G) are assumed not to be purposefully weakened, but are theoretically broken and, for related keys, practically broken. But what this research was about, was GEA/1 and GEA/2 (for data encryption in EDGE/2G). It was known to be practically broken, but not purposefully broken until now.
- beermonster 5y ago
  I recall being aware of A5 not being very strong and that fact not being much of a secret. But there’s a difference between using something known to be weaker than something else and using something that has been deliberately weakened in a way that allows compromise of that channel with that knowledge - which seems to be the suggestion in this article? At that point it’s not weaker crypto, more a back door.
xaduha 5y ago
Probably related https://www.bbc.com/news/world-europe-57302806 https://www.bbc.com/news/world-europe-57302806 Always was kinda baffled by apparent massive interest in controlling undersea cables and things like that, surely there are ungodly amounts of encrypted data which is of no real use to anyone? Apparently not.
jsnell 5y ago
Discussion of the original paper (107 comments) from two weeks ago: https://news.ycombinator.com/item?id=27529768 https://news.ycombinator.com/item?id=27529768
tialaramex 5y ago
This report doesn't "find" that - it assumes that anybody paying attention already knew it. It's like the awkward "As you know..." dialogue from a movie that is present to ensure the audience knows something that the characters ought to think is too obvious to even mention. What's interesting is that this practice continues in more recent systems: https://en.wikipedia.org/wiki/KASUMI https://en.wikipedia.org/wiki/KASUMI Notice how KASUMI is a result of modifying a known but obscure block cipher MISTY1. It was modified to "meet other requirements set for 3G mobile communications security". Well, who said those requirements were for more security? And sure enough KASUMI is much more vulnerable than MISTY1.

63 points by stunt 5y ago

One should always assume the encryption is compromised. See the success the Allies had in cracking the German and Japanese codes, and how devastating that was to the Axis, who couldn't believe their codes were broken.

southerntofu 5y ago
> One should always assume the encryption is compromised. In commercial applications, yes. In free-software that received audit and is built in a more-or-less reproducible manner, there is less concerns. I'd have more trust in Conversations.im built by F-Droid.org repository than any proprietary messenger, for example.
- shapefrog 5y ago
  I love it when the veil slips and 'open source purists' show they are really about it just being free.
- deleted 5y ago
  [deleted]
- southerntofu 5y ago
  So one commenter here said that was nearly not enough, but the comment has been deleted since then. Here's my answer anyway: I agree with your point. You'll see in my previous comment i never said such a solution was secure, just that it has "less concerns" and therefore i have "more trust". But i would rather not place my life in the hands of ANY KIND of software, or hardware that's beyond my mechanical comprehension. In the case of OpenSSL, nobody had dared to even look at the code maintained by a single person. That's a huge problem. That code is not reproducible is another huge problem. It's also a huge problem that even when it is reproducible you don't have a convenient way to bootstrap the environment, to automatically audit code signatures (PGP) on the repository, and to compare checksums with another build environment. The GNU/guix project is addressing all these issues. Their blog is full of good stuff about their work on bootstrap seeds, on their new "guix git authenticate" command which follows a "channel introduction" to validate signatures on the repo, and with "guix challenge" command to compare build output from several repositories. Exciting days ahead of us!
tialaramex 5y ago
It is often claimed that the Germans didn't believe Enigma could be broken, but that's false, they simply didn't believe anybody would put the work in and it was indeed a lot of work. Trying to guess what your enemy is thinking is crucial yet very difficult work in a war like that. In "Most Secret War" R.V. Jones provides excerpts from some of the documents he wrote trying to do exactly this, based on what he believed his German equivalents would or ought to know e.g. "A representative from Rechlin might point out that even if they could not go to decimeters, the use of frequency modulation with the present system might provide some immunity from jamming". [ This is referring to the Germans' previously successful radio direction finding for bomber aircraft, which by this point the British are jamming. In the "fog of war" some German pilots believe the signal isn't jammed but "bent" sending them off course, in reality the British never developed the sophisticated calibration needed to actually do this, they just jammed the signals with powerful transmitters, but doubt set in anyway ]
- mhh__ 5y ago
  Most Secret War is a really really great book, lots of lessons for today's crisis decision makers. Since you have are familiar with the man, there is a great PhD thesis online somewhere analysing Jones's work - he is the only source on manner matters here and he did have an ego. I'll link it when I can find it again. He was passed up for the SciInt job at MI5 post-war for having the wrong background, apparently. Shame, might have put some more pressure on Philby and friends.
- xyzzy123 5y ago
  This reminds me a bit of the invention of "chaff", which the British and Germans invented independently. Each side held back on using it because they didn't want to tip the other side off. It's curious to think what would have happened if one side or the other had discovered that their opponent knew about it too.
  - mhh__ 5y ago
    They did know.
- 5y ago

ng55QPSK 5y ago

a) ... was deliberately weakened by US restrictions on cryptography b) ... is a network feature and could have been disabled for ~15 years. c) afaik 3GPP has recent proposal to get GEA1 out of 5G

yaantc 5y ago
GEA1 has never been in 4G nor 5G. Both support the same suites: AES-CTR, SNOW 3G (introduced with 3G) or ZUC (Chinese) with 128 bits keys and Western operators use AES.

jeltz 5y ago

Isn't this public knowledge? I remember a guest lecturer talking about this 15 years ago when I was in university.

sneak 5y ago
Public knowledge and widely known are two different things. There are things that everyone could know (A), things that everyone knows (B), and things that everyone knows that everyone knows[3] (C). These are distinct sets. The fact that direct access to FAANG servers[2] is granted without a warrant to the US government was widely publicized, yet most people still don't realize that the NSA is regularly looking at naked pictures of Americans stored in cloud services[1]. You might even be aware of this, but have missed the (reported at the same time) fact that this is the #1 source, the most-often used, in US intelligence reports. It's where they do most of their spying. People haven't moved on to C about the non-privacy of gmail, for instance. Everyone savvy knows that gmail is compromised, yet because not everyone knows that everyone knows that, it's still pretended that your email box is private. Publicity is helpful. Most people are too busy to realize what is being done by their military in their name. Repetition helps. [1]: https://youtu.be/XEVlyP4_11M?t=1495 https://youtu.be/XEVlyP4_11M?t=1495 [2]: FISA Amendments Act Section 702, internal codename PRISM, reported in FAANG transparency reports as FISA orders [3]: https://www.epsilontheory.com/harvey-weinstein-common-knowledge-game/ https://www.epsilontheory.com/harvey-weinstein-common-knowle... and https://www.epsilontheory.com/sheep-logic/ https://www.epsilontheory.com/sheep-logic/
espadrine 5y ago
This is a case where different ciphers, for more advanced uses, are discovered as purposefully weakened. A5/2 (for voice communication, incl 2G) was known as a purposefully weakened variant of A5/1 for a very long time, and is probably what you remember. A5/3 (3G) and A5/4 (4G) are assumed not to be purposefully weakened, but are theoretically broken and, for related keys, practically broken. But what this research was about, was GEA/1 and GEA/2 (for data encryption in EDGE/2G). It was known to be practically broken, but not purposefully broken until now.
beermonster 5y ago
I recall being aware of A5 not being very strong and that fact not being much of a secret. But there’s a difference between using something known to be weaker than something else and using something that has been deliberately weakened in a way that allows compromise of that channel with that knowledge - which seems to be the suggestion in this article? At that point it’s not weaker crypto, more a back door.

xaduha 5y ago

Probably related https://www.bbc.com/news/world-europe-57302806 https://www.bbc.com/news/world-europe-57302806 Always was kinda baffled by apparent massive interest in controlling undersea cables and things like that, surely there are ungodly amounts of encrypted data which is of no real use to anyone? Apparently not.

jsnell 5y ago

Discussion of the original paper (107 comments) from two weeks ago: https://news.ycombinator.com/item?id=27529768 https://news.ycombinator.com/item?id=27529768

tialaramex 5y ago

This report doesn't "find" that - it assumes that anybody paying attention already knew it. It's like the awkward "As you know..." dialogue from a movie that is present to ensure the audience knows something that the characters ought to think is too obvious to even mention. What's interesting is that this practice continues in more recent systems: https://en.wikipedia.org/wiki/KASUMI https://en.wikipedia.org/wiki/KASUMI Notice how KASUMI is a result of modifying a known but obscure block cipher MISTY1. It was modified to "meet other requirements set for 3G mobile communications security". Well, who said those requirements were for more security? And sure enough KASUMI is much more vulnerable than MISTY1.