6 ms·

CVE-2022-24401: The Air Interface Encryption (AIE) keystream generator relies on the network time, which is publicly broadcast in an unauthenticated manner. Thi

by dhx 3y ago

CVE-2022-24401: The Air Interface Encryption (AIE) keystream generator relies on the network time, which is publicly broadcast in an unauthenticated manner. This allows for decryption oracle attacks. CVE-2022-24402: The TEA1 algorithm has a backdoor that reduces the original 80-bit key to a key size which is trivially brute-forceable on consumer hardware in minutes. CVE-2022-24404: Lack of ciphertext authentication on AIE allows for malleability attacks. CVE-2022-24403: The cryptographic scheme used to obfuscate radio identities has a weak design that allows attackers to deanonymize and track users. CVE-2022-24400: A flaw in the authentication algorithm allows attackers to set the Derived Cypher Key (DCK) to 0. "At its core, TETRA security relies a set of secret, proprietary cryptographic algorithms which are only distributed under strict Non-Disclosure Agreement (NDA) to a limited number of parties. These algorithms consist of the TETRA Authentication Algorithm (TAA1) suite for authentication and key distribution purposes, and the TETRA Encryption Algorithm (TEA) suite for Air Interface Encryption (AIE). The TEA suite consists of four stream ciphers with 80-bit keys: TEA1 to TEA4, where TEA1 and TEA4 were intended for commercial use and restricted export scenarios while TEA2 and TEA3 were intended for use by European and extra-European emergency services respectively. In addition, optional, vendor-specific end-to-end encryption (E2EE) solutions can be deployed on top of AIE." [1] https://tetraburst.com https://tetraburst.com

dylan604 3y ago
> > CVE-2022-24402: The TEA1 algorithm has a backdoor When does a backdoor get promoted from bug? Does a backdoor require for to have been intentionally added? How do researchers prove intent?
- Rygian 3y ago
  From the page: The vulnerability in the TEA1 cipher (CVE-2022-24402) is obviously the result of intentional weakning. While the cipher itself does not seem to be a terribly weak design, there is a computational step which serves no other purpose than to reduce the key's effective entropy. Similar weakened cryptography has played a part in flaws in GSM (A5/1, A5/2), GMR (GMR-1), GPRS (GEA-1), DMR ('Basic' and 'Enhanced' encryption), and P25 (ADP) and mostly results from export control practices (See: https://en.wikipedia.org/wiki/Crypto_Wars#PC_era https://en.wikipedia.org/wiki/Crypto_Wars#PC_era) at the time of design. Unfortunately, in the decades that have passed since then, this cipher has remained in use both inside and outside Europe without loud and clear warnings being issued about its actual security posture.
  - lazide 3y ago
    It seems similar to the locks you buy in typical hardware stores. While not sold that way (rather the opposite!), they have widely known weaknesses that allow compromise by any motivated actor with minimal work, while providing the illusion of security. And no one is interested in ‘fixing’ it near as I can tell, because it seems to work well enough most of the time, and is convenient for a number of parties. Weird huh?
    - hardware2win 3y ago
      Yes, weird, because we must require higher standards for comp. sec.
      - lazide 3y ago
        Interestingly, I think you'll find that many folks disagree. [https://therecord.media/senate-dea-bill-targets-end-to-end-encryption-requires-companies-to-report-drugs https://therecord.media/senate-dea-bill-targets-end-to-end-e...]
    - lokar 3y ago
      Except here the key was weakened to satisfy export requirements, without telling users. So they advertise an 80bit key, but secretly and intentionally use something much weaker. A back door
      - lazide 3y ago
        Should I not mention Masterlocks 'high security' line, which can usually be picked in seconds by anyone with a paperclip and 15 minutes to an hour of training? Or the numerous 'high security' locks with trivial bypasses?
        dylan604 3y ago
        now do TSA locks
- dhx 3y ago
  According to ETSI who have been busy reading their thesaurus to redefine negative sounding words, it wasn't a "backdoor" they specified into TEA1, rather, it's just a necessary application of export control regulations. "The TETRA security standards have been specified together with national security agencies and are designed for and subject to export control regulations which determine the strength of the encryption. These regulations apply to all available encryption technologies. As the designer of the TETRA security algorithms, ETSI does not consider that this constitutes a “backdoor”.[1] ETSI also completely bullshits this claim: "We are pleased that this research affirmed the overall strength of the TETRA standard, finding no weaknesses in the TEA2 and TEA3 algorithms following extensive analysis."[1] Which directly conflicts with the researchers who found[2] and demonstrated[3] the highest severity problems directly impact users of TEA2 and TEA3 algorithms: "The issues of most immediate concern, especially to law enforcement and military users, are the decryption oracle and malleability attacks (CVE-2022-24401 and CVE-2022-24404) which allow for interception and malicious message injection against all non-E2EE protected traffic regardless of which TEA cipher is used. This could allow high-end adversaries to intercept or manipulate law enforcement and military radio communications." This claim from ETSI is a bit like saying that disk encryption software standard that specifies use of AES in ECB mode (note: very insecure) is strong because the underlying AES standard has no identified weaknesses. ETSI are responsible for the TETRA standards that vendors implement, and could have made it mandatory for vendors to implement features such as authenticated encryption, and/or could have developed test standards for vendors to use to verify their products are correctly implemented. ETSI released TEA5, TEA6 and TEA7 encryption schemes at the end of 2022, likely in response to this security research. TEA5 is for European Union states and TEA6 and TEA7 users are supposedly kept secret.[4] [1] https://www.etsi.org/newsroom/news/2260-etsi-and-tcca-statement-to-tetra-security-algorithms-research-findings-publication-on-24-july-2023 https://www.etsi.org/newsroom/news/2260-etsi-and-tcca-statem... [2] https://tetraburst.com/ https://tetraburst.com/ [3] https://www.youtube.com/watch?v=oJjTiO6C9xs https://www.youtube.com/watch?v=oJjTiO6C9xs (demonstration of CVE-2022-24401 being used to break into radio networks using TEA2 and TEA3 algorithms in under 10 minutes) [4] https://cdn.standards.iteh.ai/samples/63125/8392cdca31d74030be682782da2d9f29/ETSI-TS-101-053-5-V1-1-1-2022-12-.pdf https://cdn.standards.iteh.ai/samples/63125/8392cdca31d74030...
  - 3y ago

by dhx 3y ago

dylan604 3y ago

> > CVE-2022-24402: The TEA1 algorithm has a backdoor When does a backdoor get promoted from bug? Does a backdoor require for to have been intentionally added? How do researchers prove intent?

Rygian 3y ago
From the page: The vulnerability in the TEA1 cipher (CVE-2022-24402) is obviously the result of intentional weakning. While the cipher itself does not seem to be a terribly weak design, there is a computational step which serves no other purpose than to reduce the key's effective entropy. Similar weakened cryptography has played a part in flaws in GSM (A5/1, A5/2), GMR (GMR-1), GPRS (GEA-1), DMR ('Basic' and 'Enhanced' encryption), and P25 (ADP) and mostly results from export control practices (See: https://en.wikipedia.org/wiki/Crypto_Wars#PC_era https://en.wikipedia.org/wiki/Crypto_Wars#PC_era) at the time of design. Unfortunately, in the decades that have passed since then, this cipher has remained in use both inside and outside Europe without loud and clear warnings being issued about its actual security posture.
- lazide 3y ago
  It seems similar to the locks you buy in typical hardware stores. While not sold that way (rather the opposite!), they have widely known weaknesses that allow compromise by any motivated actor with minimal work, while providing the illusion of security. And no one is interested in ‘fixing’ it near as I can tell, because it seems to work well enough most of the time, and is convenient for a number of parties. Weird huh?
  - hardware2win 3y ago
    Yes, weird, because we must require higher standards for comp. sec.
    - lazide 3y ago
      Interestingly, I think you'll find that many folks disagree. [https://therecord.media/senate-dea-bill-targets-end-to-end-encryption-requires-companies-to-report-drugs https://therecord.media/senate-dea-bill-targets-end-to-end-e...]
  - lokar 3y ago
    Except here the key was weakened to satisfy export requirements, without telling users. So they advertise an 80bit key, but secretly and intentionally use something much weaker. A back door
    - lazide 3y ago
      Should I not mention Masterlocks 'high security' line, which can usually be picked in seconds by anyone with a paperclip and 15 minutes to an hour of training? Or the numerous 'high security' locks with trivial bypasses?
      - dylan604 3y ago
        now do TSA locks
dhx 3y ago
According to ETSI who have been busy reading their thesaurus to redefine negative sounding words, it wasn't a "backdoor" they specified into TEA1, rather, it's just a necessary application of export control regulations. "The TETRA security standards have been specified together with national security agencies and are designed for and subject to export control regulations which determine the strength of the encryption. These regulations apply to all available encryption technologies. As the designer of the TETRA security algorithms, ETSI does not consider that this constitutes a “backdoor”.[1] ETSI also completely bullshits this claim: "We are pleased that this research affirmed the overall strength of the TETRA standard, finding no weaknesses in the TEA2 and TEA3 algorithms following extensive analysis."[1] Which directly conflicts with the researchers who found[2] and demonstrated[3] the highest severity problems directly impact users of TEA2 and TEA3 algorithms: "The issues of most immediate concern, especially to law enforcement and military users, are the decryption oracle and malleability attacks (CVE-2022-24401 and CVE-2022-24404) which allow for interception and malicious message injection against all non-E2EE protected traffic regardless of which TEA cipher is used. This could allow high-end adversaries to intercept or manipulate law enforcement and military radio communications." This claim from ETSI is a bit like saying that disk encryption software standard that specifies use of AES in ECB mode (note: very insecure) is strong because the underlying AES standard has no identified weaknesses. ETSI are responsible for the TETRA standards that vendors implement, and could have made it mandatory for vendors to implement features such as authenticated encryption, and/or could have developed test standards for vendors to use to verify their products are correctly implemented. ETSI released TEA5, TEA6 and TEA7 encryption schemes at the end of 2022, likely in response to this security research. TEA5 is for European Union states and TEA6 and TEA7 users are supposedly kept secret.[4] [1] https://www.etsi.org/newsroom/news/2260-etsi-and-tcca-statement-to-tetra-security-algorithms-research-findings-publication-on-24-july-2023 https://www.etsi.org/newsroom/news/2260-etsi-and-tcca-statem... [2] https://tetraburst.com/ https://tetraburst.com/ [3] https://www.youtube.com/watch?v=oJjTiO6C9xs https://www.youtube.com/watch?v=oJjTiO6C9xs (demonstration of CVE-2022-24401 being used to break into radio networks using TEA2 and TEA3 algorithms in under 10 minutes) [4] https://cdn.standards.iteh.ai/samples/63125/8392cdca31d74030be682782da2d9f29/ETSI-TS-101-053-5-V1-1-1-2022-12-.pdf https://cdn.standards.iteh.ai/samples/63125/8392cdca31d74030...
- 3y ago