I heard about this some time ago... the timeline shows the sources should be available from august this year, but nothing yet on github ( https://github.com/MidnightBlueLabs/TETRA_burst )
Vulnerabilities in TETRA radio networks
81–90 of 91 posts
Re: Vulnerabilities in TETRA radio networks
#82Earlier quoted context omitted.
Do you remember when cryptography export was controlled? It was implemented by limiting key size to certain number of (effective) bits (of security). This suite is just a victim of that law, as it is a 1990s design.
It's not "just" a victim of that law unless they disclosed that the export cryptography protocol was trivially breakable. Export cryptography in the 1990s US was documented.
To quote https://www.cryptomuseum.com/crypto/algo/tea/1.htm:
> The algorithm was developed in 1996/97 at Philips Crypto BV in Eindhoven (Netherlands) as a consultancy job for ETSI-SAGE. As the algorithm is secret, it has never been submitted for peer-review or in-depth security analysis. Instead it was evaluated by other ETSI-SAGE members before being submitted as a formal ETSI standard. All members of the TEA family, use an 80-bit key, but in the case of TEA1 it is effectively reduced to 32 bits, which makes it vulnerable to a brute-force attack. According to one of the developers, this was mandatory to get the algorithm approved for export. It was part of the ETSI specification and was clearly visible in the code [3].
Re: Vulnerabilities in TETRA radio networks
#83Earlier quoted context omitted.
Do you remember when cryptography export was controlled? It was implemented by limiting key size to certain number of (effective) bits (of security). This suite is just a victim of that law, as it is a 1990s design.
Reading the wiki page, it seems to be a European standard. The law you are referring to sounds like a US law.
American encryption laws did not exist in a void. According to this website, one person who was working on the standard indicated that the key space had to be reduced to allow for export.
Take, for example, this old article discussing French law in the late 1900s: https://web.archive.org/web/20000118230559/http://www.opengr...
French cryptography exports required authorisation if the key strength was higher than 40 bits. With its 80 bit keys, the TETRA key space would've been too big to qualify for free exports.
As TETRA is part of an ETSI standard, it seems pretty likely to me that one of the European countries had a 32 bit restriction, and TETRA might as well pick the lowest common denominator when it comes to selecting a backdoor.
Re: Vulnerabilities in TETRA radio networks
#84TL;DR: The only newsworthy vulnerability is the breaking TEA1 - which is anyways the least secure of them all and only intended for commercial use (that is, no emergency services). https://www.tetraburst.com/
Some installations have additional cryptography.
Which alone implies that the Tetra crypto security theatre is well known in that industry, and isn't a surprise to vendors in the slightest.
Re: Vulnerabilities in TETRA radio networks
#85[deleted]
Re: Vulnerabilities in TETRA radio networks
#86In 2023 you're telling me that some emergency vehicles are happily rocking encryption protocols with 80-bit, wait actually, 32-bit keys? These are all cases of systemic procrastination. We're talking about emergency vehicles here though, so: neglect.
Nobody is surprised these protocols have been broken, it should not be a surprise, and having some kind of panic reaction should be considered either a charade or a case of abysmal management.
Re: Vulnerabilities in TETRA radio networks
#87The fact many armies use this (including my own country's) is mind boggling. Didn't they request the technical details of the encryption and the source code and have it vetted properly before awarding the tender for these devices? /sarcasm
Re: Vulnerabilities in TETRA radio networks
#88Earlier quoted context omitted.
Is it still true that nation states are at the forefront of innovation and the largest security threats? At least in the United States, I'd be surprised to learn that their best and brightest minds are working in three letter government agencies when they can work in industry for more money and less bureaucracy.
Does one need the best and brightest minds to break crypto? Or does it just take a lot of full-time regular minds? Because the academic/opensource communities famously don't have many hours to dedicate to the cause.
> Because the academic/opensource communities famously don't have many hours to dedicate to the cause.
People in academics dedicate their lifes for this. Who has more time?
Re: Vulnerabilities in TETRA radio networks
#89TL;DR: The only newsworthy vulnerability is the breaking TEA1 - which is anyways the least secure of them all and only intended for commercial use (that is, no emergency services). https://www.tetraburst.com/
It appears to be used for infrastructure, including things like power and transportation signals here in the US.
Are you sure? TETRA uses frequency-hopping spread spectrum, which requires a much wider contiguous bandwidth allocation for this modulation and use. That allocation doesn't exist in the US.
The lack of any large allocation for this kind of radio is a big part of why US first responders are stuck with P.25, which is narrowband FM. If there were a wide-enough band in which it could be used, a lot of first responders would have bought TETRA radios a long time ago. P.25 is easy to jam by brute-force power output, and trivial if you directly attack the error correction bits. TETRA and FHSS have a much much larger ratio of attacker transmit power to victim transmit power.
https://en.wikipedia.org/wiki/Project_25#Jamming_vulnerabili...
(FWIW, P.25 is an even worse dumpster-fire than TETRA...)
Re: Vulnerabilities in TETRA radio networks
#90Earlier quoted context omitted.
It appears to be used for infrastructure, including things like power and transportation signals here in the US.
Are you sure? TETRA uses frequency-hopping spread spectrum, which requires a much wider contiguous bandwidth allocation for this modulation and use. That allocation doesn't exist in the US. The lack of any large allocation for this kind of radio is a big part of why US first responders are stuck with P.25, which is narrowband FM. If there were a wide-enough band in which it could be used, a lot of first responders wo…
Googling “MTA Tetra” turns up a pile of articles about the deployment of TETRA trunked radio for communications in the NYC bus fleet and Staten Island Railroad. And in those articles there’s some controversy about the spectrum and interference issues. I don’t know where else they use TETRA, just that they were cited in some of the original articles about the vulnerabilities.