This may be of use to you: https://blog.cryptographyengineering.com/2013/05/14/a-few-thoughts-on-cellular-encryption/ https://blog.cryptographyengineering.com/2

This may be of use to you: https://blog.cryptographyengineering.com/2013/05/14/a-few-thoughts-on-cellular-encryption/ https://blog.cryptographyengineering.com/2013/05/14/a-few-th... "GSM phones authenticate to the tower, but the tower doesn’t authenticate back. This means that anyone can create a ‘fake’ tower that your phone will connect to. The major problem here is that in GSM, the tower gets to pick the encryption algorithm! That means your attacker can simply turn encryption off (by setting encryption ‘algorithm’ A5/0) and simply route the cleartext data itself.In theory your phone is supposed to alert you to this kind of attack, but the SIM chip contains a bit that can de-active the warning. And (as researcher Chris Paget discovered) carriers often set this bit."