8 ms·

One thing I absolutely don't understand about telecom security is how, in 2025, we're still using pre-shared keys in our mobile phone standards. RSA and Diffie

One thing I absolutely don't understand about telecom security is how, in 2025, we're still using pre-shared keys in our mobile phone standards. RSA and Diffie Hellman[1] have existed for decades, so have CA systems, yet SIM cards are still provisioned with a pre-shared key that only the card and the operator knows, and all further authentication and encryption is based on that key[2]. If the operator is ever hacked and the keys are stolen, there's nothing you can do. To make things even worse, those keys have to be sent to the operator by the SIM card manufacturer (often a company based in a different country and hence subject to demands of foreign governments), so there are certainly opportunities to hack these companies and/or steal the keys in transit. To me, this absolutely feels like a NOBUS vulnerability, if the SIM manufacturers and/or core network equipment vendors are in cahoots with the NSA and let the NSA take those keys, they can potentially listen in on all mobile phone traffic in the world. [1] I'm aware that those algorithms are not considered best practices any more and that elliptic curves would be a better idea, but better RSA than what we have now. [2] https://nickvsnetworking.com/hss-usim-authentication-in-lte-nr-4g-5g/ https://nickvsnetworking.com/hss-usim-authentication-in-lte-...

Narkov 2y ago
> To me, this absolutely feels like a NOBUS vulnerability, if the SIM manufacturers and/or core network equipment vendors are in cahoots with the NSA and let the NSA take those keys, they can potentially listen in on all mobile phone traffic in the world. This feels like the obligatory XKCD comic[1] when in reality there isn't any secretive key extraction or cracking...things are just sent unencrypted from deeper into the network to the three-letter-agencies. Telco's are well known to have interconnect rooms with agencies. [1] https://xkcd.com/538/ https://xkcd.com/538/
- bayindirh 2y ago
  > Telco's are well known to have interconnect rooms with agencies. Maybe these connections are a requirement for their permits in the first place. Who knows?
  - deleted 2y ago
    [deleted]
  - amiga386 2y ago
    https://en.wikipedia.org/wiki/Qwest#Refusal_of_NSA_surveillance_requests https://en.wikipedia.org/wiki/Qwest#Refusal_of_NSA_surveilla... Not a requirement, but if for some reason you don't do the Right Thing that the NSA wants, oh dear your CEO goes to jail, he was a bad boy, look at all that insider trading. You'll do the Right Thing next time we ask, capiche? https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A
    - LargoLasskhyfv 2y ago
      https://en.wikipedia.org/wiki/Dagger_Complex https://en.wikipedia.org/wiki/Dagger_Complex in Germany. Right next to the former https://de.wikipedia.org/wiki/Posttechnisches_Zentralamt https://de.wikipedia.org/wiki/Posttechnisches_Zentralamt and https://de.wikipedia.org/wiki/Fernmeldetechnisches_Zentralamt https://de.wikipedia.org/wiki/Fernmeldetechnisches_Zentralam... (similar to Bell Central Office/HQ) hosting the Deutsche Telekoms early NOC and CIX. There are also endless ramblings of some german blogger about how he has been sabotaged at the University of Karlsruhe, regarding very early development of encrypted digital telephony and data-transfer in the 80ies/90ies, by very incompetent and corrupted professors, connected to this. Also related: https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Operation_Rubicon https://en.wikipedia.org/wiki/Operation_Rubicon https://en.wikipedia.org/wiki/Maximator_(intelligence_alliance) https://en.wikipedia.org/wiki/Maximator_(intelligence_allian... We're all friends, listening in on the party line :>
whyever 2y ago
Are you suggesting end-to-end encryption? Telecom providers have to implement "lawful intercept" interfaces to comply with the law in many jurisdictions.
- dylan604 2y ago
  That's fine. Let them have lawful intercept into my encrypted communications. Let them eat static
  - secondcoming 2y ago
    If it's all encrypted you wouldn't be able to call land lines.
    - dylan604 2y ago
      yeah? and? so? who does that? if you're concerned about being intercepted and are still using land lines, then you're really not concerned. we learned that in the 80s. if you're using SMS, you're also not really concerned. friends don't let friends use unencrypted.
      - lxgr 2y ago
        I exclusively call landlines from my phone, at least using "actual" phone calls; businesses, to be precise. For all person-to-person calls, my family and friends have long switched to FaceTime and WhatsApp, which are both encrypted. Why would I pay per minute for a less secure and lower fidelity (HD voice usually does not work internationally) channel? That said, I really would prefer if the POTS were better secured, given that SSNs and payment card numbers are transmitted over it all the time.
  - immibis 2y ago
    As part of lawful intercept, they can't encrypt the traffic and then send the NSA the encrypted traffic. They have to send the unencrypted traffic. Or they go to jail.
johnwayne666 2y ago
Gemalto was hacked 15 years ago: > "AMERICAN AND BRITISH spies hacked into the internal computer network of the largest manufacturer of SIM cards in the world, stealing encryption keys used to protect the privacy of cellphone communications across the globe, according to top-secret documents provided to The Intercept by National Security Agency whistleblower Edward Snowden." https://theintercept.com/2015/02/19/great-sim-heist/ https://theintercept.com/2015/02/19/great-sim-heist/
2OEH8eoCRo0 2y ago
"I don't understand it, must be <insert conspiracy>."
- KevinGlass 2y ago
  You realize this exact thing was in the Snowden docs a decade ago? This exact worry, sim keys being hacked by the NSA, was in the leaks.
  - DaSHacka 2y ago
    You seem to have forgotten, anything inconvenient to the government is a conspiracy theory.
- newsclues 2y ago
  follow the money. perverse incentives at play.
newsclues 2y ago
I worked for a major telco in technical support/customer service. I saw numerous security issues, and when I brought them up, with solutions to improve the service for customers, I was informed the the company would lose money. Scammers are big customers for telcos, and when they get caught, and banned, they come back again and pay a new connection fee and start the cycle again. Scammers also enable feature upselling, another way to profit from not solving the problem.
rightbyte 2y ago
I have talked to telephone engineers and they said they could read all passing SMSs verbatim when they hooked up to a cell tower to debug stuff. Dunno if that is still the case though. However, cell phones as secure communication did not use to be the case. You would probably want to communicate with encrypted data traffic device to device.
- ArnoVW 2y ago
  From what I remember from early 2000’s only the air interface was encrypted. Since anyway they have to provide lawful intercept capability there was not much benefit in providing end to end encryption. It’s not like it was a top of mind feature for consumers.
  - Scoundreller 2y ago
    > It’s not like it was a top of mind feature for consumers. BlackBerry got some market share for promoting their encryption. Of course the encryption was complete junk, possibly worse than junk because of the false sense of security, unless you were an enterprise customer. https://www.theregister.com/2016/04/15/canada_blackberry_water_cooler/ https://www.theregister.com/2016/04/15/canada_blackberry_wat...
    - immibis 2y ago
      Blackberry's (probably) legally allowed to provide text message encryption, but telcos aren't. "Lawful intercept" (which should more accurately be called "gunpoint eavesdropping") is a legal requirement for all telcos, and the larger the telco, the more optimized and automated the process is required to be. They have to be able to read customer SMSes and tap phone calls. If the SMS happens to be gibberish, that's not their problem, but they can't make it gibberish.
    - throw0101c 2y ago
      > BlackBerry got some market share for promoting their encryption. Consumer-to-consumer BB messages were not E2E encrypted, but if you had a BES connected to your (on-prem?) Exchange server then everything with-in your company was wrapped in a key unique to your organization. Further, I'm not sure if telcos could read the messages either: the bits were routed through RIM's central servers. For evidence of this, several countries made deals for access to the bit flow under threat of banning the service: * https://www.wired.com/story/blackberry-india/ https://www.wired.com/story/blackberry-india/ * https://www.theguardian.com/world/2010/aug/07/saudi-arabia-deal-avert-blackberry-ban https://www.theguardian.com/world/2010/aug/07/saudi-arabia-d...
ngneer 2y ago
You appear to be neglecting the need for symmetric stream ciphers to achieve realtime communications (needed for performance reasons). No matter what you do, you are going to have a symmetric key in there somewhere for adversaries to extract. Once the adversary owns the telco, it is over (i.e., calls can be decrypted), no matter how strong the cryptography is. Your strongest cryptography cannot withstand a key leak.
- andrewflnr 2y ago
  Do you know how TLS works? The asymmetric keys are used to negotiate temporary symmetric keys, which are used for the actual data. That's exactly what the mentioned Diffie-Hellman algorithm does. Also check out "perfect forward secrecy".
  - xen2xen1 2y ago
    Phase 1 and Phase 2.
  - ngneer 2y ago
    Of course I know how TLS works, as well as PFS. I recommend Kaufman on the subject. The general scheme you refer to is known as hybrid cryptography, and the key material that is derived is used to generate symmetric keys for the TLS session (several keys, in fact, separately for confidentiality and integrity, and for duplex communications). You missed my point completely, though. Unlike TLS sessions, which rely on packets, calls are multiplexed with TDMA or CDMA, for example. Unlike TCP, these channels have realtime requirements that necessitate stream ciphers be employed. I could ask you if you know how telecom works, but that would be childish and demeaning. As ephemeral as you wish to make it, the telco must know the secret key, for imagine if the call is being relayed to Timbuktu and must be passed in plaintext.
    - lxgr 2y ago
      > these channels have realtime requirements that necessitate stream ciphers be employed Even if that were relevant (you can easily convert a block cipher to a stream cipher): It's absolutely possible to do key derivation for a symmetric stream cipher asymmetrically. > the telco must know the secret key No, the telco must not know the secret key if they're serious about confidentiality.
lxgr 2y ago
Some of these algorithms have to run on the SIM card, and smart cards (at least in the past) don't support RSA or (non-elliptic-curve) DH without a coprocessor that makes them more expensive. Also, symmetric algorithms are quantum safe :) But yes, I also wish that in 2025 we'd at least support ECC, which most smart cards should support natively at this point. > To make things even worse, those keys have to be sent to the operator by the SIM card manufacturer (often a company based in a different country and hence subject to demands of foreign governments), so there are certainly opportunities to hack these companies and/or steal the keys in transit. If you can't trust your SIM card vendor, you're pretty much out of luck. The attack vector for an asymmetric scheme would look a bit different, but if you can't trust the software running on them, how would you know if they were exfiltrating plaintexts through their choice of randomness for all nondeterministic algorithms?
- miki123211 2y ago
  There's a difference between asking / bribing / blackmailing / legally forcing the company to make a copy of some text files (or just figuring out a way to get those files yourself) versus forcing them to modify their software in deliberately insecure ways (which can also be discovered by others and used against you). The former is a true NOBUS, the second one is not (though you're right that governments would probably treat this as one).
tptacek 2y ago
If you have the ability to distribute keys directly, asymmetric cryptography adds complexity without much payoff. Certainly the idea that introducing RSA to a symmetrical system makes it more sound isn't well supported; the opposite is true. The "NOBUS vulnerability" thing is especially silly, since the root of trust of all these systems are telecom providers. You don't have to ask if your American telecom provider is "in cahoots" with the US intelligence community; they are.
- miki123211 2y ago
  > American telecom provider Who said anything about American telecom providers specifically? > If you have the ability to distribute keys directly, asymmetric cryptography adds complexity without much payoff. It's hard for me to believe that a symmetric key, touched by at least three systems (SIM card, operator HSS, SIM manufacturer), the former two of which can't be completely airgapped for obvious reasons, with no ability to rekey, is more secure than a key that is physically unable to leave a single device. With a TLS-like system, you'd have to somehow hack every single SIM card to get anywhere. Hacking the manufacturer wouldn't help unless you could make them flash custom software that would exfiltrate the keys, and the consequences of an operator hack could be contained by revoking an immediate certificate and generating a new one, presumably from the operator's root cert, sitting somewhere safe in a completely airgapped HSM.
bcrl 2y ago
Nortel DMS100 switches are still running code written for Motorola 680x0 CPUs. There is not enough CPU power to validate an RSA key in a timely manner for any control message sent over a T1 or ISDN PRI.

Narkov 2y ago

> To me, this absolutely feels like a NOBUS vulnerability, if the SIM manufacturers and/or core network equipment vendors are in cahoots with the NSA and let the NSA take those keys, they can potentially listen in on all mobile phone traffic in the world. This feels like the obligatory XKCD comic[1] when in reality there isn't any secretive key extraction or cracking...things are just sent unencrypted from deeper into the network to the three-letter-agencies. Telco's are well known to have interconnect rooms with agencies. [1] https://xkcd.com/538/ https://xkcd.com/538/

bayindirh 2y ago
> Telco's are well known to have interconnect rooms with agencies. Maybe these connections are a requirement for their permits in the first place. Who knows?
- deleted 2y ago
  [deleted]
- amiga386 2y ago
  https://en.wikipedia.org/wiki/Qwest#Refusal_of_NSA_surveillance_requests https://en.wikipedia.org/wiki/Qwest#Refusal_of_NSA_surveilla... Not a requirement, but if for some reason you don't do the Right Thing that the NSA wants, oh dear your CEO goes to jail, he was a bad boy, look at all that insider trading. You'll do the Right Thing next time we ask, capiche? https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A
  - LargoLasskhyfv 2y ago
    https://en.wikipedia.org/wiki/Dagger_Complex https://en.wikipedia.org/wiki/Dagger_Complex in Germany. Right next to the former https://de.wikipedia.org/wiki/Posttechnisches_Zentralamt https://de.wikipedia.org/wiki/Posttechnisches_Zentralamt and https://de.wikipedia.org/wiki/Fernmeldetechnisches_Zentralamt https://de.wikipedia.org/wiki/Fernmeldetechnisches_Zentralam... (similar to Bell Central Office/HQ) hosting the Deutsche Telekoms early NOC and CIX. There are also endless ramblings of some german blogger about how he has been sabotaged at the University of Karlsruhe, regarding very early development of encrypted digital telephony and data-transfer in the 80ies/90ies, by very incompetent and corrupted professors, connected to this. Also related: https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Operation_Rubicon https://en.wikipedia.org/wiki/Operation_Rubicon https://en.wikipedia.org/wiki/Maximator_(intelligence_alliance) https://en.wikipedia.org/wiki/Maximator_(intelligence_allian... We're all friends, listening in on the party line :>

whyever 2y ago

Are you suggesting end-to-end encryption? Telecom providers have to implement "lawful intercept" interfaces to comply with the law in many jurisdictions.

dylan604 2y ago
That's fine. Let them have lawful intercept into my encrypted communications. Let them eat static
- secondcoming 2y ago
  If it's all encrypted you wouldn't be able to call land lines.
  - dylan604 2y ago
    yeah? and? so? who does that? if you're concerned about being intercepted and are still using land lines, then you're really not concerned. we learned that in the 80s. if you're using SMS, you're also not really concerned. friends don't let friends use unencrypted.
    - lxgr 2y ago
      I exclusively call landlines from my phone, at least using "actual" phone calls; businesses, to be precise. For all person-to-person calls, my family and friends have long switched to FaceTime and WhatsApp, which are both encrypted. Why would I pay per minute for a less secure and lower fidelity (HD voice usually does not work internationally) channel? That said, I really would prefer if the POTS were better secured, given that SSNs and payment card numbers are transmitted over it all the time.
- immibis 2y ago
  As part of lawful intercept, they can't encrypt the traffic and then send the NSA the encrypted traffic. They have to send the unencrypted traffic. Or they go to jail.

johnwayne666 2y ago

Gemalto was hacked 15 years ago: > "AMERICAN AND BRITISH spies hacked into the internal computer network of the largest manufacturer of SIM cards in the world, stealing encryption keys used to protect the privacy of cellphone communications across the globe, according to top-secret documents provided to The Intercept by National Security Agency whistleblower Edward Snowden." https://theintercept.com/2015/02/19/great-sim-heist/ https://theintercept.com/2015/02/19/great-sim-heist/

2OEH8eoCRo0 2y ago

"I don't understand it, must be <insert conspiracy>."

KevinGlass 2y ago
You realize this exact thing was in the Snowden docs a decade ago? This exact worry, sim keys being hacked by the NSA, was in the leaks.
- DaSHacka 2y ago
  You seem to have forgotten, anything inconvenient to the government is a conspiracy theory.
newsclues 2y ago
follow the money. perverse incentives at play.

newsclues 2y ago

I worked for a major telco in technical support/customer service. I saw numerous security issues, and when I brought them up, with solutions to improve the service for customers, I was informed the the company would lose money. Scammers are big customers for telcos, and when they get caught, and banned, they come back again and pay a new connection fee and start the cycle again. Scammers also enable feature upselling, another way to profit from not solving the problem.

rightbyte 2y ago

I have talked to telephone engineers and they said they could read all passing SMSs verbatim when they hooked up to a cell tower to debug stuff. Dunno if that is still the case though. However, cell phones as secure communication did not use to be the case. You would probably want to communicate with encrypted data traffic device to device.

ArnoVW 2y ago
From what I remember from early 2000’s only the air interface was encrypted. Since anyway they have to provide lawful intercept capability there was not much benefit in providing end to end encryption. It’s not like it was a top of mind feature for consumers.
- Scoundreller 2y ago
  > It’s not like it was a top of mind feature for consumers. BlackBerry got some market share for promoting their encryption. Of course the encryption was complete junk, possibly worse than junk because of the false sense of security, unless you were an enterprise customer. https://www.theregister.com/2016/04/15/canada_blackberry_water_cooler/ https://www.theregister.com/2016/04/15/canada_blackberry_wat...
  - immibis 2y ago
    Blackberry's (probably) legally allowed to provide text message encryption, but telcos aren't. "Lawful intercept" (which should more accurately be called "gunpoint eavesdropping") is a legal requirement for all telcos, and the larger the telco, the more optimized and automated the process is required to be. They have to be able to read customer SMSes and tap phone calls. If the SMS happens to be gibberish, that's not their problem, but they can't make it gibberish.
  - throw0101c 2y ago
    > BlackBerry got some market share for promoting their encryption. Consumer-to-consumer BB messages were not E2E encrypted, but if you had a BES connected to your (on-prem?) Exchange server then everything with-in your company was wrapped in a key unique to your organization. Further, I'm not sure if telcos could read the messages either: the bits were routed through RIM's central servers. For evidence of this, several countries made deals for access to the bit flow under threat of banning the service: * https://www.wired.com/story/blackberry-india/ https://www.wired.com/story/blackberry-india/ * https://www.theguardian.com/world/2010/aug/07/saudi-arabia-deal-avert-blackberry-ban https://www.theguardian.com/world/2010/aug/07/saudi-arabia-d...

ngneer 2y ago

You appear to be neglecting the need for symmetric stream ciphers to achieve realtime communications (needed for performance reasons). No matter what you do, you are going to have a symmetric key in there somewhere for adversaries to extract. Once the adversary owns the telco, it is over (i.e., calls can be decrypted), no matter how strong the cryptography is. Your strongest cryptography cannot withstand a key leak.

andrewflnr 2y ago
Do you know how TLS works? The asymmetric keys are used to negotiate temporary symmetric keys, which are used for the actual data. That's exactly what the mentioned Diffie-Hellman algorithm does. Also check out "perfect forward secrecy".
- xen2xen1 2y ago
  Phase 1 and Phase 2.
- ngneer 2y ago
  Of course I know how TLS works, as well as PFS. I recommend Kaufman on the subject. The general scheme you refer to is known as hybrid cryptography, and the key material that is derived is used to generate symmetric keys for the TLS session (several keys, in fact, separately for confidentiality and integrity, and for duplex communications). You missed my point completely, though. Unlike TLS sessions, which rely on packets, calls are multiplexed with TDMA or CDMA, for example. Unlike TCP, these channels have realtime requirements that necessitate stream ciphers be employed. I could ask you if you know how telecom works, but that would be childish and demeaning. As ephemeral as you wish to make it, the telco must know the secret key, for imagine if the call is being relayed to Timbuktu and must be passed in plaintext.
  - lxgr 2y ago
    > these channels have realtime requirements that necessitate stream ciphers be employed Even if that were relevant (you can easily convert a block cipher to a stream cipher): It's absolutely possible to do key derivation for a symmetric stream cipher asymmetrically. > the telco must know the secret key No, the telco must not know the secret key if they're serious about confidentiality.

lxgr 2y ago

Some of these algorithms have to run on the SIM card, and smart cards (at least in the past) don't support RSA or (non-elliptic-curve) DH without a coprocessor that makes them more expensive. Also, symmetric algorithms are quantum safe :) But yes, I also wish that in 2025 we'd at least support ECC, which most smart cards should support natively at this point. > To make things even worse, those keys have to be sent to the operator by the SIM card manufacturer (often a company based in a different country and hence subject to demands of foreign governments), so there are certainly opportunities to hack these companies and/or steal the keys in transit. If you can't trust your SIM card vendor, you're pretty much out of luck. The attack vector for an asymmetric scheme would look a bit different, but if you can't trust the software running on them, how would you know if they were exfiltrating plaintexts through their choice of randomness for all nondeterministic algorithms?

miki123211 2y ago
There's a difference between asking / bribing / blackmailing / legally forcing the company to make a copy of some text files (or just figuring out a way to get those files yourself) versus forcing them to modify their software in deliberately insecure ways (which can also be discovered by others and used against you). The former is a true NOBUS, the second one is not (though you're right that governments would probably treat this as one).

tptacek 2y ago

If you have the ability to distribute keys directly, asymmetric cryptography adds complexity without much payoff. Certainly the idea that introducing RSA to a symmetrical system makes it more sound isn't well supported; the opposite is true. The "NOBUS vulnerability" thing is especially silly, since the root of trust of all these systems are telecom providers. You don't have to ask if your American telecom provider is "in cahoots" with the US intelligence community; they are.

miki123211 2y ago
> American telecom provider Who said anything about American telecom providers specifically? > If you have the ability to distribute keys directly, asymmetric cryptography adds complexity without much payoff. It's hard for me to believe that a symmetric key, touched by at least three systems (SIM card, operator HSS, SIM manufacturer), the former two of which can't be completely airgapped for obvious reasons, with no ability to rekey, is more secure than a key that is physically unable to leave a single device. With a TLS-like system, you'd have to somehow hack every single SIM card to get anywhere. Hacking the manufacturer wouldn't help unless you could make them flash custom software that would exfiltrate the keys, and the consequences of an operator hack could be contained by revoking an immediate certificate and generating a new one, presumably from the operator's root cert, sitting somewhere safe in a completely airgapped HSM.

bcrl 2y ago

Nortel DMS100 switches are still running code written for Motorola 680x0 CPUs. There is not enough CPU power to validate an RSA key in a timely manner for any control message sent over a T1 or ISDN PRI.