7 ms·
Does anyone know the encryption schema of LTE? Does the key change with each message or is it for a longer period of time? I'm wondering how feasible it is for
by iaw 3y ago
Does anyone know the encryption schema of LTE? Does the key change with each message or is it for a longer period of time? I'm wondering how feasible it is for an attacker to capture and then break the encryption (obviously if we're talking 2048-bit that wont be happening anytime soon)
- zitterbewegung 3y agoThis looks like a good overview of the subject. https://www.eecis.udel.edu/~salehi/files/asee13_lte.pdf https://www.eecis.udel.edu/~salehi/files/asee13_lte.pdf
- sidewndr46 3y agowhy bother? Just force the handset down to 2G and intercept that.
- slicktux 3y ago2G is deprecated so a lot of the newer phones won’t even support that..?
- sidewndr46 3y agoI can't even turn off 2G on my relatively new Samsung handset, so I find it hard to believe it is "deprecated". There are likely zero 2G towers in my area, but that doesn't mean handset suppliers don't ship it still.
- ronsor 3y agoAs long as there are countries with GSM service, it's not going to stop being shipped.
- slicktux 3y agoYea relatively speaking…
- Fnoord 3y agoOn an Android smartphone you can disable it usually, via *#*#4636#*#* There's a frontend for this on F-Droid if you prefer that [1] [1] https://f-droid.org/en/packages/pl.lebihan.network/ https://f-droid.org/en/packages/pl.lebihan.network/
- sidewndr46 3y agoThis doesn't work on Samsung phones
- noselasd 3y agoNot really no. Newer phones absolutely support 2G.
- betaby 3y agoThere is nothing to intercept on 2G in Canada and USA, 2G was decommissioned.
- bryancoxwell 3y agoThese attacks are generally carried out by a “rogue base station” that simulates being a cell tower. It doesn’t require that there be a local 2G infrastructure.
- betaby 3y agoSIMs from my two different Canadian operator doesn't allow downgrade to 2G for the home networks.
- sidewndr46 3y agoThat's pretty cool, any idea how it works?
- betaby 3y agoAuthentication profiles. Basically one can specify on the SIM profile that for the certain PLMN (mobile operator) only certain authentication methods are allowed (2G, 3G, 4G use different auth methods).
- sidewndr46 3y agothat is good. from what i understand we dont have that in the US
- dataflow 3y agoWhat prevents these from simulating a non-"home" network?
- kalleboo 3y ago
- OkayPhysicist 3y agoSurely a phone would rather connect to a moderately strong 3/4/5G tower than a very strong 2G tower, right? So that'd limit you to settings where people otherwise wouldn't have a connection at all. IDK, genuinely curious.
- is_true 3y agoi hope that would be expensive, isnt it?
- dilyevsky 3y agoIt’s a key set per session. See https://arxiv.org/pdf/1510.07563.pdf https://arxiv.org/pdf/1510.07563.pdf to answer your other question
- dfox 3y agoThe authentication model is based on Radius with EAP, the main point is that anything after and including 3G does mutual authentication and in 4G/5G this is based on IETF protocols, in theory, you can associate with 4G network with whatever authentication supplier that works with WPA-Enterprise (and in theory that even works the other way around). The idea there is that 4G/5G is simply an physical layer for Ethernet2 frames with some kind of access control and QoS layer. And quite obviously the frames are encrypted and authenticated on L2. And as the whole thing is IP, some carriers just tunnel the whole thing in additional layer of IPSec tunnels.