A treatise revealing that 'a backdoor was intentionally installed' was published in the early mobile phone network


by

Patrick Breen

A paper was published that revealed that mobile phone networks in the 1990s and 2000s were vulnerable to fundamental cryptographic algorithms. Cryptographic experts conclude that 'early mobile networks were deliberately designed to be vulnerable,' as it is highly unlikely that this vulnerability was accidentally compromised.

Cryptanalysis of the GPRS Encryption Algorithms GEA-1 and GEA-2
(PDF file) https://eprint.iacr.org/2021/819.pdf

Bombshell Report Finds Phone Network Encryption Was Deliberately Weakened
https://www.vice.com/en/article/4avnan/bombshell-report-finds-phone-network-encryption-was-deliberately-weakened

Report insinuates that early mobile networks were deliberately backdoored
https://www.xda-developers.com/early-mobile-networks-deliberately-backdoored/

The cipher used by researchers at the University of Rennes in France and the University of Ruhr-Bochum in Germany on June 16, 2021 when the early mobile industry adopted the GPRS standard second generation mobile communication system (2G). Announced that a vulnerability that could be regarded as a backdoor was found in the 'GEA-1' encryption algorithm. The team of researchers has hidden the details of the source of GEA-1 as an 'informant who wants to remain anonymous.'


by rhoadeecha

According to the research team, although GEA-1 was said to have a cryptographic strength of 64 bits, it was actually only about 40 bits. Therefore, it is said that a network attacker could analyze the encryption key and decrypt the communication contents extremely easily.

Matthew Green, who teaches cryptography at the Johns Hopkins Institute for Information Security, said of the difference between 64-bit and 40-bit cryptographic levels, 'some might think it's not a big deal because it's only 24-bit different. No, but from a security perspective, it could make a difference of 16,777,216 times. '



In a treatise, the research team said, 'I couldn't even find the possibility of creating such a vulnerable algorithm even after trying 1 million times using commonly used random number generation technology.' We conclude that sex was deliberately mixed in to limit security to the 40-bit level. The next-generation encryption algorithm 'GEA-2' obtained from the same information provider also had an insufficient security level, but there are traces of intentionally incorporating vulnerabilities. It wasn't.

The European Telecommunications Standards Institute (ETSI), which designed GEA-1, told the IT news site Motherboard that the algorithm was vulnerable and said, 'We limit the strength of GEA-1. I followed the export restrictions. '

XDA Developers, a community site for developers, said that the regulations mentioned by ETSI were 'probably French Decrees 98-206 and 98-207 . Promulgated in 1998, the same year that GEA-1 was developed. According to the decree, 'authorization and declaration are exempted for cryptographic technologies and services of 40 bits or less.'

The author of the treatise, Håvard Raddum, commented on this: 'Political needs have exposed millions of mobile phone users to poor security.'

According to Raddum, the risk is considerably lower because GEA-3 and GEA-4 are used in many countries at the time of writing the article. However, some areas still use the GEA-1 mobile network.

'Fortunately, the GEA-1 is only used in some older cell phones today, but that's not a pleasure, because the government's motivation to regulate encryption is Because it was and is still the same. Some of us may think that the government has become wise enough not to do this anymore, or that we have become wise enough to see through their schemes. That may be true, but I don't think so. '

Related Posts:

in Mobile,   Security, Posted by log1l_ks