GSM Security and Encryption
By:Poonam Sharma
Topics
GSM: Introduction GSM Security Objectives
Concerns, Goals, Requirements
GSM Security Mechanisms Authentication and Encryption Scheme SIM Anatomy
GSM: Introduction
GSM is the most widely used cellular standard Over 600 million users, mostly in Europe and Asia Limited coverage and support in USA Based on TDMA radio access and PCM trunking Use SS7 signalling with mobile-specific extensions Provides authentication and encryption capabilities Todays networks are 2G evolving to 2.5G 3 Third generation (3G) and future (4G)
GSM Security Concerns
Operators
Bills right people Avoid fraud Protect Services
Customers
Privacy Anonymity
Make a system at least secure as PSTN
4
GSM Security Goals
Confidentiality and Anonymity on the radio path Strong client authentication to protect the operator against the billing fraud Prevention of operators from compromising of each others security
Inadvertently Competition pressure
GSM Security Design Requirements
The security mechanism
MUST NOT
Add significant overhead on call set up Increase bandwidth of the channel Increase error rate Add expensive complexity to the system
MUST
Cost effective scheme
Define security procedures
Generation and distribution of keys Exchange information between operators Confidentiality of algorithms
GSM Security Features
Key management is independent of equipment
Subscribers can change handsets without compromising security
Subscriber identity protection
not easy to identify the user of the system intercepting a user data
Detection of compromised equipment
Detection mechanism whether a mobile device was compromised or not
Subscriber authentication
The operator knows for billing purposes who is using the system
Signaling and user data protection
Signaling and data channels are protected over the radio path
7
GSM Mobile Station
Mobile Station
Mobile Equipment (ME)
Physical mobile device Identifiers
IMEI International Mobile Equipment Identity
Subscriber Identity Module (SIM)
Smart Card containing keys, identifiers and algorithms Identifiers
Ki Subscriber Authentication Key IMSI International Mobile Subscriber Identity TMSI Temporary Mobile Subscriber Identity MSISDN Mobile Station International Service Digital Network PIN Personal Identity Number protecting a SIM LAI location area identity
GSM Architecture
Mobile Stations Base Station Subsystem Network Management Subscriber and terminal equipment databases
OMC BTS
Exchange System
VLR BTS BSC MSC HLR BTS EIR
9
AUC
Subscriber Identity Protection
TMSI Temporary Mobile Subscriber Identity
Goals
TMSI is used instead of IMSI as an a temporary subscriber identifier TMSI prevents an eavesdropper from identifying of subscriber
Usage
TMSI is assigned when IMSI is transmitted to AuC on the first phone switch on Every time a location update (new MSC) occur the networks assigns a new TMSI TMSI is used by the MS to report to the network or during a call initialization Network uses TMSI to communicate with MS On MS switch off TMSI is stored on SIM card to be reused next time
The Visitor Location Register (VLR) performs assignment, administration and update of the TMSI
1 0
Key Management Scheme
Ki Subscriber Authentication Key
Shared 128 bit key used for authentication of subscriber by the operator Key Storage
Subscribers SIM (owned by operator, i.e. trusted) Operators Home Locator Register (HLR) of the subscribers home network
SIM can be used with different equipment
11
Detection of Compromised Equipment
International Mobile Equipment Identifier (IMEI)
Identifier allowing to identify mobiles IMEI is independent of SIM Used to identify stolen or compromised equipment
Equipment Identity Register (EIR)
Black list stolen or non-type mobiles White list - valid mobiles Gray list local tracking mobiles
Central Equipment Identity Register (CEIR)
Approved mobile type (type approval authorities) Consolidated black list (posted by operators)
1 2
Authentication
Authentication Goals
Subscriber (SIM holder) authentication Protection of the network against unauthorized use Create a session key
Authentication Scheme
Subscriber identification: IMSI or TMSI Challenge-Response authentication of the subscriber by the operator
1 3
Authentication and Encryption Scheme
Mobile Station SIM Ki SRES A8 Fn mi A5 Kc Encrypted Data A3 Signed response (SRES) Authentication: are SRES values equal? Radio Link Challenge RAND Ki GSM Operator
A3
SRES
A8 Kc A5 Fn mi
1 4
Authentication
AuC Authentication Center HLR Home Location Register
Provides parameters for authentication and encryption functions (RAND, SRES, Kc) Provides MSC (Mobile Switching Center) with triples (RAND, SRES, Kc) Handles MS location
VLR Visitor Location Register
Stores generated triples by the HLR when a subscriber is not in his home network One operator doesnt have access to subscriber keys of the another operator.
1 5
A3 MS Authentication Algorithm
Goal
Generation of SRES response to MSCs random challenge RAND
RAND (128 bit)
Ki (128 bit)
A3
SRES (32 bit)
1 6
A8 Voice Privacy Key Generation Algorithm
Goal
Generation of session key Ks
A8 specification was never made public
RAND (128 bit)
Ki (128 bit)
A8
KC (64 bit)
1 7
Logical Implementation of A3 and A8
Both A3 and A8 algorithms are implemented on the SIM
Operator can decide, which algorithm to use. Algorithms implementation is independent of hardware manufacturers and network operators.
1 8
Logical Implementation of A3 and A8
COMP128 is used for both A3 and A8 in most GSM networks.
COMP128 is a keyed hash function
RAND (128 bit)
Ki (128 bit)
COMP128
128 bit output SRES 32 bit and Kc 54 bit
1 9
A5 Encryption Algorithm
A5 is a stream cipher
Implemented very efficiently on hardware Design was never made public Leaked to Ross Anderson and Bruce Schneier
Variants
A5/1 the strong version A5/2 the weak version A5/3
GSM Association Security Group and 3GPP design Based on Kasumi algorithm used in 3G mobile systems
2 0
Logical A5 Implementation
Mobile Station Fn (22 bit) Kc (64 bit) Fn (22 bit) BTS Kc (64 bit)
A5 114 bit
A5 114 bit Data (114 bit) XOR
Data (114 bit)
XOR
Ciphertext (114 bit)
Real A5 output is 228 bit for both directions
2 1
A5 Encryption
Mobile Stations Base Station Subsystem Network Management Subscriber and terminal equipment databases
OMC BTS
Exchange System
VLR BTS BSC MSC HLR BTS
A5 Encryption
AUC
EIR
2 2
SIM Anatomy
Subscriber Identification Module (SIM)
Smart Card a single chip computer containing OS, File System, Applications Protected by PIN Owned by operator (i.e. trusted) SIM applications can be written with SIM Toolkit
23
Smart Card Anatomy
2 4
Microprocessor Cards
Typical specification
8 bit CPU 16 K ROM 256 bytes RAM 4K EEPROM Cost: $5-50
Smart Card Technology
Based on ISO 7816 defining
Card size, contact layout, electrical characteristics I/O Protocols: byte/block based File Structure
2 5
Summary
GSM: Introduction GSM Security Objectives
Concerns, Goals, Requirements
GSM Security Mechanisms Authentication and Encryption Scheme SIM Anatomy
2 6
Poonam Sharma
2 7
