UMTS
UMTS
Posted Jan 8, 2010 13:42 UTC (Fri) by anton (subscriber, #25547)In reply to: UMTS by Nimos
Parent article: GSM encryption crack made public
With a well-designed protocol the content is encrypted end-to-end and the provider does not need (and ideally should not be able to) decrypt it. So the provider only needs to decrypt some meta-data, which is not that much. Also, AFAIK AES is designed (and was selected) to be cheap to encrypt and decrypt. The chances that the UMTS designers found something significantly cheaper that's as secure are very small.
Posted Jan 8, 2010 15:08 UTC (Fri)
by anselm (subscriber, #2796)
[Link] (3 responses)
This is well and good from an end-user's point of view, but of course the
last thing that mobile communications systems are supposed to do is
provide arbitrary thugs with communication methods that law enforcement
cannot intercept and decrypt (and free with the basic service at that).
The nice thing
about the present system, from the point of view of law enforcement, is
that communications are only encrypted on the air, but available for
interception in the clear from where they enter the backbone network.
So if the thugs want to communicate securely, they will need to provide
their own end-to-end encryption, without help from the network operators.
As far as the operators are concerned,
this isn't a problem as long as their protocols are secure enough
to prevent things that eat into their revenue, such as large-scale fraud
by users impersonating others for billing purposes.
Posted Jan 8, 2010 16:05 UTC (Fri)
by anton (subscriber, #25547)
[Link] (2 responses)
If a provider conspires with the NSA (or similar organizations) to
subvert the privacy of their paying customers, then decrypting and
reencrypting the connection will be the least of the costs
that is incurred in that action: They have to pay for some human or
voice-recognition computer to understand what was said, and either of
these options will be more expensive than decrypting and re-encrypting
the connection.
Your use of "thugs" for citizens who value their privacy appears
to come from the idea that innocent citizens have nothing to hide. Do
you wear clothes in warm weather? Do you have curtains in your home?
If yes, why? Do you have something to hide?
Why do you think that users impersonating others will eat into the
provider's revenue (especially if all the providers have that problem)?
Posted Jan 8, 2010 16:28 UTC (Fri)
by anselm (subscriber, #2796)
[Link]
Read again. That was from the point of view of the non-endusers.
If it was up to me I'd let everybody communicate securely. However,
unfortunately
neither the government nor the mobile operators have seen fit to consult
me for my opinion. Quite on the contrary -- over here in Europe they're
busy building a large infrastructure based on the assumption that
everybody is a potential criminal, hence everyone's use of
telecomms (phone calls, SMS, e-mail, ...) must be monitored and stored for
an extended period of time for
the benefit of the police and assorted three-letter agencies. It was all
the German Constitutional Court could do to keep them from exploiting the
data to try to identify, e.g., traffic transgressors and Internet
downloaders here in Germany, pending a more thorough judicial review.
Posted Jan 11, 2010 12:17 UTC (Mon)
by marcH (subscriber, #57642)
[Link]
This is only one type of interceptions the NSA might be interested in. But it is also also very interesting for the NSA to have weak air encryption by default, because 1) it leaves no traces at the provider, or 2) it allows eavesdropping on ANY provider, even a not friendly one. See the Crypto AG scandal for an example of what the NSA is capable of.
UMTS
The priorities of the NSA are not necessarily the priorities of the
mobile providers and their paying customers. However, the ideal of
not being able to decrypt the messages in the middle with an ordinary
mobile phone is probably hard to attain, because there is no
end-to-end authentication, so I don't see how man-in-the-middle
attacks could be detected. Hmm, the SIM cards could identify
themselves, and so one could detect a change in SIM cards after the
first time one has had a call to that number; so the man-in-the-middle
would have to be there from the start to avoid getting noticed (but
that assumes that the NSA does not have the data necessary for faking
this identification). So yes, if citizens value their privacy, they
have to do end-to-end encryption themselves, do their own key
management, and they have to be sure they can trust their encryption
device.
UMTS
UMTS
Your use of "thugs" for citizens who value their privacy appears to come
from the idea that innocent citizens have nothing to hide.
UMTS