Hi,
> Not good enough for what? If you're doing research, those 35 seconds are
> far more than enough to convince everyone that GSM security is broken and
> needs fixing.
To play the devil's advocate here :
Everyone should have been convinced a long time ago ... But "they" come up with
arguments saying the attack is not "practical" and they partially still hold :
The first that comes to mind is obviously Frequency Hopping :
Even if not in use everywhere, I've heard the argument that "all" that
would be needed would just be to use hopping everywhere. Of course we
all know that despite what the GSMA says/pretends, hopping is _not_ a
security feature. But that doesn't mean it doesn't pose a practical
problem.
And I'm not talking about the HW itself. The USRP with a good FPGA
firmware should be able to follow the hopping sequence, or you could
use dedicated GSM hw that supports it by design.
The main issue here is that in Early Assignement or Late Assignement,
the hopping sequence is just unknown. The parameters are transmitted
in ciphered form.
To workaround that you can either :
- Listen and record the whole relevant RF (limited to 64 arfcn, but
if they're "spread", that makes it very annoying) and record it.
- Break the hopping sequence trying to detect RF power change. (some
parameters are fixed, you almost only need to find MAIO and H.N)
- Break the cipher fast enough not to loose too much TCH.
And on a personal note, I also think that anything that can improve
the attack time is worth exploring. But I'm more talking about
algorithmic improvements, new weaknesses in the cipher rather than
"how to build the better hardware to run the attack".
Anyway, just my 2 cents :)
Cheers,
Sylvain
_______________________________________________
A51 mailing list
[email protected]
http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
