Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerabilities in TETRA radio networks

cryptomuseum.com

Post reply on HN
Print view View original

71–80 of 91 posts

Re: Vulnerabilities in TETRA radio networks

#71

Post by nicce »

perlgeek wrote: post #56
londons_explore wrote: post #41

Earlier quoted context omitted.

And yet this one lasted 30 years. That's far longer than most open encryption algorithms continue to be deemed secure. Obviously you can debate wether having it 'appear' secure for longer before someone publishes details of the flaw is more important or not...

It lasted 30 years in the sense it hasn't been publicly broken before. We don't know how many intelligence agencies have found some of these and are happily listening in on "secure" communication, concealing that fact successfully.

This argument holds for any non-disclosed vulnerabilities, however.

Re: Vulnerabilities in TETRA radio networks

#72

Post by marcus0x62 »

clankyclanker wrote: post #69
marcus0x62 wrote: post #54

Earlier quoted context omitted.

In the mid-late 90s, 40-bit encryption was common due to US export control restrictions, and even then, that was thought to be insecure against a nation state attacker. In 1998, the EFF built a custom DES Cracker[0] for around $250k that could crack a 56-bit DES message in around 1 week. As was the custom at the time, they published the source code, schematics, and VHDL source in a printed book to evade (and, I guess…

(If that's the case I'm thinking of) it was actually documented as a challenge to export restrictions, mocking them was merely a pleasant byproduct. The EFF's legal challenge was essentially that if crypto is a munition, then this printed book explaining the crypto is also at least as much of a munition, if not more so. They gave the judge the choice between deciding that a printed book is some sort of deadly tool, o…

That was Phil Zimmerman’s book containing the PGP source whixh was published a few years before the Deep Crack book. https://philzimmermann.com/EN/essays/BookPreface.html

Re: Vulnerabilities in TETRA radio networks

#73

Post by a1369209993 »

tptacek wrote: post #49
a1369209993 wrote: post #47

Earlier quoted context omitted.

And yet became a official standard anyway, and was occasionally actually used, despite the fact that is was obviously backdoored to anyone who knew anything about (elliptic-curve) cryptography. (It's literally a textbook-exercise leaky RNG, of the sort that you would find under "Exercise: create a elliptic-curve-based RNG that leaks seed bits within N bytes of random data." in a actual cryptography textbook.)

You don't really need to understand elliptic curves to understand Dual EC. It's a public key RNG. The vulnerability is that there's a matching private key.

True, but my parenthetical was covering the opposite issue: it's possible to not realise DUAL_EC_DRBG is broken (rather than impossible to realise it) if your only knowledge of cryptography is, say, hash functions and stream ciphers (so you don't recognise public key cryptography from looking at it). It's unlikely, because DUAL_EC_DRBG is really obviously broken, but I wouldn't fault someone who knew nothing about elliptic-curve cryptography for missing it, even if they were familiar with other types of cryptography. (I would fault them for claiming that it's secure, rather than recognizing that they don't know enough to evaluate its security, but you can't conclude something's backdoored just from that.)

Re: Vulnerabilities in TETRA radio networks

#74

Post by barsonme »

xyzzy4747 wrote: post #28
LocalH wrote: post #4

Sounds like they took the "roll your own and don't tell anyone how it works" approach. Security by obscurity is never security. History has shown that the open encryption standards are the most secure.

Security has many layers. Obscurity can be one of them.

Obscurity can certainly be part of defense in depth, but it unequivocally does not make anything more (meaningfully) secure.

For example, hiding the fact that your data is encrypted with AES doesn’t make an attacker any more likely to be able to break AES. Similarly, hiding the fact that you use a weak encryption algorithm doesn’t keep an attacker from breaking it.

Re: Vulnerabilities in TETRA radio networks

#75

Post by snvzz »

londons_explore wrote: post #41
LocalH wrote: post #4

Sounds like they took the "roll your own and don't tell anyone how it works" approach. Security by obscurity is never security. History has shown that the open encryption standards are the most secure.

And yet this one lasted 30 years. That's far longer than most open encryption algorithms continue to be deemed secure. Obviously you can debate wether having it 'appear' secure for longer before someone publishes details of the flaw is more important or not...

The publicly known attacks are recent, yes.

I know some group had it pwned at least 2010-ish. But won't elaborate.

And I'm sure they weren't the first, nor the only ones.

Re: Vulnerabilities in TETRA radio networks

#76

Post by perlgeek »

michaelt wrote: post #58
perlgeek wrote: post #56

Earlier quoted context omitted.

It lasted 30 years in the sense it hasn't been publicly broken before. We don't know how many intelligence agencies have found some of these and are happily listening in on "secure" communication, concealing that fact successfully.

Aren't these encrypted radios mostly for cops? I mean, this is embarrassing - but who cares if the secret police are spying on the regular police?

Does the FBI use these? The FBI is tasked with counter intelligence, and for a spy it could be highly relevant to learn if they are being targeted.

Re: Vulnerabilities in TETRA radio networks

#77

Post by chislobog »

perlgeek wrote: post #76
michaelt wrote: post #58

Earlier quoted context omitted.

Aren't these encrypted radios mostly for cops? I mean, this is embarrassing - but who cares if the secret police are spying on the regular police?

Does the FBI use these? The FBI is tasked with counter intelligence, and for a spy it could be highly relevant to learn if they are being targeted.

Federal stuff is going to be p25 phase 2, usually AES encrypted. Harris or Motorola, and at one point Thales (previously Racal.)

Some other brands end up being used like cobham or bendix but those are usually for aviation.

Tetra isn’t used by us LE. There are military encryption schemes, some of which are classified or controlled occasionally used by feds. Mostly tho you're looking at encrypted voice over data using mobile phones tho. Cellcrypt Inc, for example. Not many investigators lug around a radio to call agents in the field unless they need interoperability with other agencies or tactical communications using local infrastructure.

During the Obama inauguration the Thales liberty triband was used with AES. I think most agencies dumped the Thales Libntry for Harris tri band radios or Motorola now, which is sad because as a result the liberty is basically a dead end platform

Re: Vulnerabilities in TETRA radio networks

#78

Post by creer »

neilv wrote: post #29

> Two of the vulnerabilities are deemed critical. One of them appears to be an intentional backdoor [...] Reading the contents of a firmware upgrade is not trivial though, as it is heavily encrypted and relies on a Trusted Execution Environment (TEE), embedded in the core processor of the radio.* I don't know whether the backdoor allegation is correct, but unfortunately we should treat opaque ostensible security with…

Isn't the time for the generous qualifiers long past? Such, often, can, our protection, unfortunately, skepticism... There is a good track record by now. Something like:

"under the guise of protecting trade secrets and swear words in the code, the code encryption actually protects crappy code stuffed with vulnerabilities (i.e. future entry points available to the right friends and foes) and backdoors (some forgotten and some very much not)". And in this case "future" was a while ago.

Re: Vulnerabilities in TETRA radio networks

#79

Post by creer »

michaelt wrote: post #58
perlgeek wrote: post #56

Earlier quoted context omitted.

It lasted 30 years in the sense it hasn't been publicly broken before. We don't know how many intelligence agencies have found some of these and are happily listening in on "secure" communication, concealing that fact successfully.

Aren't these encrypted radios mostly for cops? I mean, this is embarrassing - but who cares if the secret police are spying on the regular police?

Seems this was a general export item resulting from the 1990's crypto restrictions. The article mentions 100 countries using them. That would be agencies for whom it didn't matter, yes, (ambulance, corp security, etc) - but also everyone else who could not afford anything better but for whom security actually mattered. Not every country can afford to roll their own for this kind of stuff.

Re: Vulnerabilities in TETRA radio networks

#80

Post by londons_explore »

xmprt wrote: post #59
nicce wrote: post #43

Earlier quoted context omitted.

> And yet this one lasted 30 years. Main goal of security through obscurity is the hindrance. Make it slower and harder to to detect possible vulnerabilities. So indeed, there is something to debate. But I guess it helps only against those with limited resources, not against nation states.

Is it still true that nation states are at the forefront of innovation and the largest security threats? At least in the United States, I'd be surprised to learn that their best and brightest minds are working in three letter government agencies when they can work in industry for more money and less bureaucracy.

Does one need the best and brightest minds to break crypto? Or does it just take a lot of full-time regular minds?

Because the academic/opensource communities famously don't have many hours to dedicate to the cause.

Post reply on HN