Now Reading


2023-12-09 11:02:29



TEA1 →



9 August 2023 —
We are actually in a position to share the reverse-engineered C-source code of
the TAA1, TEA1, TEA2 and TEA3 algorithms. This clearly exhibits
the weak spot in TEA1. Additionally revealed is a paper on TETRA:BURST,
written by the Midnight Blue researchers Carlo Meijer, Wouter Bokslag
and Jos Wetzels.

Vulnerabilities in TETRA radio networks

On 24 July 2023, researchers of the Dutch safety agency
Midnight Blue revealed
that they’d discovered 5 vulnerabilities within the authentication and
encryption algorithms of the TETRA radio community, which is utilized in
the crucial infrastructure of greater than 100 nations.
Two of the vulnerabilities are deemed crucial. One in all them
seems to be an intentional backdoor [1].

The vulnerabilities had been found through the course of 2020, and had been
reported to the NCSC within the Netherlands in December of that yr. It was
determined to carry off public disclosure till July 2023, to provide emergency
companies and gear suppliers the flexibility to patch the gear.


A number of algorithm suites and cryptographic primitives are used on the
core of the TETRA protocol, specifically TAA for authentication,
and TEA for encryption.
As these algorithms are secret, they’ve by no means been
publicly disclosed and, therefore, have by no means been subjected to in-depth
public scrutiny. So as to discover any vulnerabilities within the
code, the researchers due to this fact first needed to reverse-engineer the
TAA and TEA algorithms, which seemed to be not trivial in any respect.

The reverse-engineering mission — codenamed RE:TETRA — was began
on 1 January 2020, with funding from the non-profit
NLnet foundation, as a part of the latter’s
European Fee supported NGI0 PET fund.
As soon as the reverse-engineering was accomplished, the researchers had been
in a position to isolate and analyse the cryptographic capabilities.

For reverse-engineering, a Motorola MTM-5400
industrial off-the-shelf (COTS) cell radio was used,
together with related firmware upgrades obtained by way of
newbie radio boards. Studying the contents of a firmware improve
isn’t trivial although, as it’s closely encrypted and depends
on a Trusted Execution Surroundings (TEE), embedded in
the core processor of the radio.

The MTM-5000 collection is constructed round a Texas Devices
OMAP-L138 System on Chip (SoC), which comprises an
ARM core and TI C6748 DSP.
It provides safe boot by way of TEE,
because of which confidential code may be loaded
and executed with out revealing its implementation.
That is how the TETRA algorithms are protected.

So as to execute arbitrary code on the ARM core,
the researchers first needed to exploit one other collection of
identified vulnerabilities, utilizing a serial AT command interface
because the assault floor and performing a cache-timing aspect
channel assault.


Click to see more

With the ARM core and the DSP now firmly beneath management of the attackers,
the MBM-5000 collection can be utilized as a growth platform for researchers,
permitting in-depth safety analysis into TETRA, which can hopefully
enhance total TETRA safety.
The Midnight Blue researchers have introduced
that they are going to publicly launch the instruments for unpacking Motorola
firmware improve packages, in addition to utilities for instrumenting, debugging,
monitoring and packet injection.


As soon as the software program had been reverse-engineered, the researchers had been
in a position to do in-depth safety analysis with the purpose to seek out vulnerabilities
and finally mount an assault. Over the course of 1 yr,
the next vulnerabilities had been found:

  1. Dependence on network time
    The Air Interface Encryption (AIE) keystream depends on community time,
    which is publicly broadcast in an unauthenticated method. This permits
    for decryption oracle assaults and will result in lack of
    confidentiality and authenticity. This vulnerability is deemed crucial.

    CVE-2022-24401 ·
    This drawback may be fastened by putting in a firmware improve.


  2. Backdoor in TEA1
    The TEA1 algorithm has a backdoor that reduces the unique
    80-bit key to a measurement which is trivially brute-forceable on shopper
    {hardware} in minutes. It is a crucial flaw that results in lack of
    confidentiality and authenticity. The researchers imagine that this
    is a intentionally created weak spot to supply intelligence companies
    entry to the site visitors.

    CVE-2022-24402 ·
    This drawback may be fastened by utilizing E2EE on high of TEA1.


  3. Lack of ciphertext authentication
    The dearth of ciphertext authentication of AIE permits for
    malleability assaults. This will likely finally result in lack of authenticity.

    CVE-2022-24404 ·
    This drawback may be fastened by putting in a firmware improve.


  4. Weak anonymisation
    The cryptographic scheme used to obfuscate radio identities, has a weak
    design that enables attackers to deanonymize and monitor customers.

    CVE-2022-24403 ·
    This drawback may be fastened by utilizing E2EE on high of TEA1.


  5. DCK may be set to 0
    A flaw within the authentication algorithm permits attackers to set the
    Derived Cipher Key (DCK) to 0.
    This will likely result in lack of authenticity and partial lack of confidentially.

    CVE-2022-24400 ·
    This drawback may be fastened by migrating to TAA2 (long-term).


ETSI’s reply
24 Aug 2023

The TETRA encryption algorithms had been applied in 1996 and 1997 by
or on behalf of the
Security Experts Group of the
European Telecommunications Standards Insitute
It’s ETSI’s coverage to not disclose their cryptographic algorithms
and to not submit them to public in-depth safety analysis,
apart from validation by the opposite ETSI-SAGE members, claiming that
obscurity can be a type of safety [7]. Researchers
typically see this as a violation of Kerckhoffs’s Precept nonetheless [5],
which in the long term can doubtlessly result in weak exploitable techniques.

On the day of the TETRA:BURST disclosures,
ETSI issued a press assertion by which the findings of the
researchers had been largely downplayed, claiming that enhancements
had been already underway and that no precise exploitations of operational
networks had been identified on the time [6].

The Midnight Blue researchers have since demonstrated real-life
exploitations of a few of the vulnerabilities, for instance on the
2023 Blackhat Convention in Las Vegas (USA). They’ve proven that
TETRA communications secured with the TEA1 encryption algorithm
may be damaged in a single minute on a daily industrial laptop computer and in 12 hours
on a basic laptop computer from 1998 [III].

1. Dependence on community time

★★★★★ CVE-2022-24401

Within the video beneath, the primary crucial vulnerability (CVE-2022-24401) is
demonstrated. It exhibits a decryption oracle assault that’s primarily based on the
indisputable fact that the Air Interface Encryption (AIE) keystream depends on community time,
which is publicly broad­forged in an unauthenticated method. The video exhibits a
lab setup by which an instrumented base station is used as an attacker platform.


★★★★★ CVE-2022-24402

Midnight Blue researchers found a backdoor within the TEA1
encryption algorithm, which had clearly been added intentionally, most likely
to provide inteligence companies entry to the system.
Within the video beneath, the TEA1 backdoor is demonstrated on an actual community.
After breaking the preliminary key — one minute on a daily laptop computer —
the remainder of the site visitors may be learn with none issues.


3. Breaking TEA1 on a 1998 laptop computer

★★★★★ CVE-2022-24401

After the TETRA:BURST vulnerabilities had been dis­closed on 24 July 2023,
the European requirements physique ETSI downplayed the
discoveries, saying that the quick TEA1 key isn’t an actual backdoor,
and {that a} key size of 32 bits was applicable when the usual was
issued within the late Nineties.

To bust these claims, the researchers have run their TEA1 cracking
device on an previous 1998 Toshiba laptop computer, operating Microsoft Home windows 95
on a Pentium II at 266 MHz. The important thing was discovered after 12.5 hours,
which demonstrates that even within the late Nineties an assault would
have been lifelike.


TETRA Encryption Algorithms

TEA is a set of encryption algorithms that can be utilized for
Air Interface Encryption (AIE) within the TETRA communications system.
It consists of 4 variants (TEA1, TEA2, TEA3 and TEA4), with
differing ranges of safety, relying on the applying. The algorithms
are easy but sturdy, and might simply be applied in each hard- and
software program. All TEA variants use an 80-bit key.

The construction of the TAA and TEA algorithms, together with the
HURDLE block cipher utilized in TAA, is described intimately in a paper
by Carlo Meijer, Wouter Bokslag and Jos Wetzels — all
concerned within the TETRA:BURST vulnerability analysis at
Midnight Blue [I].

 Read the paper

 Reverse-engineered source code

 Overview of TEA algorithms

See Also

The TEA1 algorithm was supposed for industrial purposes and
restricted export.
Its construction is similar to TEA2,
however the 80-bit secret’s manipulated in such a approach that it turns into
a 32-bit key, which may be damaged with a brute-force assault
on a daily industrial laptop computer in round one minute.
The supply code snippet beneath exhibits how the important thing size is diminished.

     int32_t tea1_init_key_register(const uint8_t *lpKey) {
         int32_t dwResult = 0;
         for (int i = 0; i < 10; i++) 
             g_abTea1Sbox[((dwResult >> 24) ^ lpKey[i] ^ dwResult) & 0xff];
         return dwResult;

The important thing consists of 80 bits, which is the same as 10 bytes.
Within the above code, the ten bytes are processed one by one, after which shifted
into the end result (


) register. Nevertheless, because the


register is just 32 bits broad, the primary 48 bits are shifted out
and the important thing consists of the final 32 bits solely, which is trivially
quick for a brute-force assault.

Though the quick key size may be seen as a backdoor
— it’s a deliberate weakening —
that is disputed by the unique developer, because it was performed in plain
sight and never hidden in some complicated code, operate or desk [3].
The quick key size was merely an ETSI requirement.
Any firm that needed to implement the algorithm in its gear,
had entry to the design specification and will need to have been conscious
of the limitation [3].
That is corroborated by Gert Roelofsen in an interview with
De Volkskrant on 29 July 2023, by which he states that the federal government
had been conscious of it for the previous 30 years [2]. On the time, Roelofsen
was on the ETSI consultants workforce on behalf of KPN.

 More about TEA1

TEA2 was developed for European emergency companies, and is arguably
the strongest of the 4 algorithms. It makes use of the total 80-bit key
size. If we assume {that a} 32-bit key may be damaged in a single
minute – as with TEA1 above – we are able to calculate how lengthy it will take
to brute-force an 80-bit key. As every bit doubles the required time,
the full time wanted is:

60 × 248 [sec] ≈ 535 milion years

If there isn’t any identified technique to break the cipher apart from by way of
a brute-force assault, this algorithm may be assumed safe.

 More about TEA2

TEA3 is meant for emergency companies exterior Europe.
It’s just like TEA2 and doesn’t have the weak spot of
TEA1 (i.e. the diminished key size). Though it’s possible that
TEA3 is stronger than TEA1 and TEA4, additionally it is possible
that it’s weaker than TEA2. Thus far, the researchers haven’t discovered
any weaknesses on this cipher, however acknowledge the necessity for additional

 More about TEA3

The TEA4 algorithm is meant for industrial use and restricted
entry, similar to TEA1, which means that it additionally has a
built-in weak spot. Nevertheless, as no implementation of this
cipher was accessible on the Motorola goal MTM-5400 platform,
the researchers had been unable to assessment the algorithm.
It appears possible although, that it has comparable weaknesses to TEA1.

 More about TEA4

Though there isn’t any direct proof of precise exploitation of a TETRA
community, it appears possible that malicious events are all for studying
or interfering with TETRA site visitors. The easy indisputable fact that no exploitations
are identified [6], doesn’t imply that they don’t exist.
mission exhibits that reverse-engineering of the cryptographic primitives
is possible with restricted assets.

A weak spot just like the diminished key
size of TEA1 is so apparent that it’s going to definitely have been
observed and exploited. Other than the potential of reverse-engineering,
an adversary wouldn’t be hampered by authorized restrictions,
and may use leaked or stolen documentation as an alternative.

Beneath is a timeline of occasions because the begin of the reverse-engineering
mission RE:TETRA on 1 January 2021 and the primary public disclosure on 24 July
2023. The Dutch NCSC (NCSC-NL) was knowledgeable in December 2021, after which
conferences had been held with the regulation enforcement and intelligence communities,
in addition to with ETSI and the distributors. Shortly afterwards, on 2 February 2022,
preliminary recommendation was distributed to the assorted stakeholders and CERTs.
The rest of 2022 and the primary half of 2023 had been used for coordination
and advisory periods with stake­holders, permitting producers to come back
up with firmware patches, updates or workarounds.

The time between the primary contact with NCSC-NL and the general public disclosure
of the vulnerabilities, is a rigorously chosen tradeoff between giving
asset house owners as a lot time as potential and the appropriate of the general public to know.
The 1.5+ years inbetween had been used to seek out as many stakeholders as
potential and inform/recommendation them, in order that software program updates and mitigations
might be devoloped.

The Midnight Blue researchers will current their discovering on the following
occasions and conferences:

Additional supply codes on GitHub

    Midnight Blue, 24 July 2023.

  2. Huib Modderkolk, Overheid weet al dertig jaar van ‘achterdeur’ in beveiliging radiocommunicatie
    De Volkskrant, 29 July 2023.

  3. Cees Jansen, TEA co-developer at Philips Crypto BV
    Private correspondence.
    Crypto Museum, 2 August 2023.

  4. Royal Holloway, University of London, Impact case study (REF3b)
    Design of a block cipher used in TETRA secure radio.
    REF2014. Undated however most likely 2014.

  5. Wikipedia, Kerckhoffs’s principle
    Retrieved 5 August 2023.

  6. ETSI and TCCA Statement to
    TETRA Security Algorithms Research Findings Publication on 24 July 2023

    ETSI/TCCA. Sophia Antipolis, 24 July 2023.

  7. Kim Zetter, Interview with the ETSI Standards Organisation That Created TETRA “Backdoor”
    Interview between Kim Zetter and Brian Murgatroyd, Chairman ETSI TC TETRA.
    Zero Day web site, 25 July 2023.

  8. ETSI and TCCA Statement to
    TETRA Security Algorithms Research Findings Publication on 24 July 2023

    ETSI/TCCA. Sophia Antipolis, 24 July 2023.

Any hyperlinks proven in crimson are at present unavailable.
When you like the data on this web site, why not make a donation?
Crypto Museum. Created: Tuesday 08 August 2023. Final modified: Saturday, 26 August 2023 – 07:00 CET.

Click for homepage

Source Link

What's Your Reaction?
In Love
Not Sure
View Comments (0)

Leave a Reply

Your email address will not be published.

2022 Blinking Robots.
WordPress by Doejo

Scroll To Top