Digital encryption breaking...possible?

[ersin]

I've used my network to test/crack my XP passwords way back when(DES based I believe?)...took about 3 days with about 4 computers...distributed would be the best bet IMO as well....and the only reason I haven't bought a digital scanner is because as soon as I do, Metro PD will start encrypting it I think the whole law about decrypting should be changed a bit...why is it we are able to listen to local analog PD transmissions with our scanner, but the analog cell phone band is locked out?...how is it that just because they throw the encryption flag up it suddenly becomes illegal when we were able to listen to the analog version without any hitches? With this same mentality, ALL analog transmissions should be legal to listen to :P And technically...isn't the fact that newer systems are digitally modulated _some_ form of encryption? I mean if you look at it this way, analog scanners cannot "decode"/"decrypt" a digital transmission, right?...I guess I just see encryption as another form of digital modulation ...I dunno...what do you guys think? :/

Cracking a password is a bit different. You're not searching through the keyspace, you are searching through the password space. Left to themselves -- which is the norm -- people do not choose good really random passwords. There are patterns to the passwords. A password cracker exploits these vulnerabilities and can find a person created password much faster than finding a real random key.

I don't believe everyone is jumping on the encryption bandwagon so soon:

1. Most PDs (or rather municipal governments) just recently (relatively speaking) bought trunked systems. Upgrades like this aren't cheap. I believe mass encryption will have to wait until the next round of upgrading.

2. Interoperability with other departments, agencies, etc. is very important. Encryption complicates this.

3. Like I said above, I don't believe DES based systems are secure. In fact, I believe these systems are not truly DES, but a variant of it. I have not seen any mention of these variant algorithms in the literature, so they have not had the benefit of peer review. (Then again, maybe they had help from some three letter government agency?) And it has been shown (in the '80s) that almost anything you do to change DES will break it. My guess, is that any DES variant used is much weaker than "plain" DES. I would think that folks looking into these encrypted radios will say "Gee, I just don't see spending the money to keep the amateurs from listening to the cops if it doesn't also keep the real bad guys out." This is assuming they have any real expertise in the area.

4. For the few radio companies that make radios for LE, this is high stakes competition. If they can get into one municipality, say a county, chances are likely they could get into neighboring counties. While encryption would be a feature, it does complicate usage somewhat. I am thinking that anything that complicates the system (which is already complicated enough) would be a disadvantage to marketing. But, I don't really know.

5. Ven0mizer hasn't bought his digital scanner yet. :wink:

I've come to the conclusion that the only way to make sense of laws today is to "follow the money". These laws aren't made because they are right or even logical. They are made to help out big corporations (like the phone/cell/cable/internet/voip/etc. companies) who contribute big money to political campaigns or who roll over whenever the federal government asks them to do something for them. Prospect of a cushy job for a
"govie" after retirement probably plays a big part in this too. Laws aren't made to help you or me. They are made to help politicians and their friends. Lesson: don't try to make sense of the laws or you'll go crazy. :roll: Sorry to be so pessimistic.

Encryption is not another form of modulation. It is, basically, substitution of one element in the data, with a different element. Modulation is how the EM signal is varied to convey information. It's just that since digital modulation is available, encryption can work on the "bits" much easier than working on an analog signal so you always see encryption with digital type modulation.

[MikeOxlong]

I'm going to assume that the AES algorithm with 128 bit keys is being used. There is no evidence yet to suggest that any practical attack will work better then exhaustive key search, so ...

256 bit AES has been offered by Motorola for years now.

If somebody is determined enough to make sure nobody can listen, they'll just rekey the radios using Other The Air Rekeying (OTAR) every day as most of the 3 letter agencies are doing now.

By the time you've broken the key, the key will have changed.

[MikeOxlong]

1. Most PDs (or rather municipal governments) just recently (relatively speaking) bought trunked systems. Upgrades like this aren't cheap. I believe mass encryption will have to wait until the next round of upgrading.

Motorola is now offering ADP encryption. I believe it's 40 bit encryption but no extra hardware is needed in the end units and the keys can be loaded through software. It's quite cheap and a lot of small town forces are switching over to it.

2. Interoperability with other departments, agencies, etc. is very important. Encryption complicates this.

That's what interop channels are for. You need to set them up as analog, conventional, no tones and no encryption. All bands have channels set aside for such use. Use these for interop and save your fancy stuff for your regular dispatch channels.

3. Like I said above, I don't believe DES based systems are secure. In fact, I believe these systems are not truly DES, but a variant of it.

Generic DES is based on DES-CFB. Most departments are using DES-OFB and it's one of the APCO25 standard encryption protocols. Feds are using 256 bit AES and there's even stronger encryption offered to those who need it.

4. While encryption would be a feature, it does complicate usage somewhat. I am thinking that anything that complicates the system (which is already complicated enough) would be a disadvantage to marketing. But, I don't really know.

It's getting pretty easy to use these days. On the channels which are encrypted, the radio is forced to encrypted and the officer can't turn it off.

The marketing guys seem to have it figured out as well. I guess the big sale is the fact that nobody can listen in. We've had numerous small town police forces and one fire department go APCO25 with DES-OFB encryption lately.

[MikeOxlong]

I was also reading about ESK, a way of encrypting the control channels on trunked systems such that nobody would be able to follow the trunking without the key.

Yup, already broken. Looks for a program called etrunker which listens to the control channel and displays activity on the system. They tossed an ESK option into it a couple of years ago. Try this link:

http://wiki.radioreference.com/index.php/ESK

I think the problem is the legality of decrypting the control channel in order to follow it with a scanner. Uniden might be leary of incorporating it into a scanner however etrunker does offer the ability of monitoring a system with a 2nd scanner.

Florida is using ESK on their new system. Unfortunately, they're also using Provoice with DES-OFB encryption.

[amoney]

I was also reading about ESK, a way of encrypting the control channels on trunked systems such that nobody would be able to follow the trunking without the key.

Yup, already broken. Looks for a program called etrunker which listens to the control channel and displays activity on the system. They tossed an ESK option into it a couple of years ago. Try this link:

http://wiki.radioreference.com/index.php/ESK

I think the problem is the legality of decrypting the control channel in order to follow it with a scanner. Uniden might be leary of incorporating it into a scanner however etrunker does offer the ability of monitoring a system with a 2nd scanner.

Florida is using ESK on their new system. Unfortunately, they're also using Provoice with DES-OFB encryption.

Ah...

good info.

:wink:

Yeah Uniden would never/legaly can't put a procduct out that could , but that does not stop an overseas manufacture.

[ersin]

I was also reading about ESK, a way of encrypting the control channels on trunked systems such that nobody would be able to follow the trunking without the key.

Yup, already broken. Looks for a program called etrunker which listens to the control channel and displays activity on the system. They tossed an ESK option into it a couple of years ago. Try this link:

http://wiki.radioreference.com/index.php/ESK

I think the problem is the legality of decrypting the control channel in order to follow it with a scanner. Uniden might be leary of incorporating it into a scanner however etrunker does offer the ability of monitoring a system with a 2nd scanner.

Florida is using ESK on their new system. Unfortunately, they're also using Provoice with DES-OFB encryption.

Yes, after reading the description of it I immediately saw how to break it. It's comical. If you read how it works you should be able to figure it out too. I'm not sure if actually breaking this is considered breaking encryption as written in the law because this is not designed to encrypt the voice data, only the trunking data, i.e. which frequency to use. I suppose it is best to describe this as an access control mechanism.

[ersin]

When AES is used anybody will have a very hard time breaking it. There is almost no hope of actually breaking the AES. Instead you would go after the implementation, key management, social engineering, etc. before actually attacking AES. In a system, AES would not be the weakest link.

If DES is used, and it doesn't matter what mode -- ECB, CFB, OFB or CBC -- then you would have a pretty good chance of breaking the algorithm. But there are the others parts to attack too: implementation, key management, etc.

But, unless you work for government, this is all illegal. And if you further use this in commission of a crime the penalties are higher (as it's always been even before they made trying to crack encrypted communications illegal).


Cheers.

[MikeOxlong]

Instead you would go after the implementation, key management, social engineering, etc. before actually attacking AES. In a system, AES would not be the weakest link.

Most agencies that have implemented AES have their keyloaders under strict lock and key. Social engineering is a little harder since only a couple of people know the actual key. Once one keyloader is loaded, you can link them to download the keys into the other loaders. It can be done remotely or through a key management server.

Then toss in Over The Air Rekeying which can happen every couple of hours, days, weeks, etc and you've got a pretty tough system to beat.

Heck, with multiple keys loaded into a radio, crews could change things up every couple of minutes before OTAR even happens.

Pretty tough to beat for the average hobbiest.

[ersin]

Instead you would go after the implementation, key management, social engineering, etc. before actually attacking AES. In a system, AES would not be the weakest link.

Most agencies that have implemented AES have their keyloaders under strict lock and key. Social engineering is a little harder since only a couple of people know the actual key. Once one keyloader is loaded, you can link them to download the keys into the other loaders. It can be done remotely or through a key management server.

Then toss in Over The Air Rekeying which can happen every couple of hours, days, weeks, etc and you've got a pretty tough system to beat.

Heck, with multiple keys loaded into a radio, crews could change things up every couple of minutes before OTAR even happens.

Pretty tough to beat for the average hobbiest.

Sounds like you're talking military grade radios. And before you ask, yes some do use AES instead of those other algorithms. So AES must be good. :wink:

But, do state agencies -- counties, fire departments, police departments, etc. -- actually have access to this technology. OTAR is still considered fairly sophisticated stuff. I could be wrong, but what I have found on the Internet leads me to believe what the states and municipalities use aren't quite up to this yet.

[MikeOxlong]

Sounds like you're talking military grade radios. And before you ask, yes some do use AES instead of those other algorithms. So AES must be good. :wink:

But, do state agencies -- counties, fire departments, police departments, etc. -- actually have access to this technology. OTAR is still considered fairly sophisticated stuff. I could be wrong, but what I have found on the Internet leads me to believe what the states and municipalities use aren't quite up to this yet.

Nope, AES is available for purchase by anybody (as long as you reside in the right country).

There are currently two Motorola XTS2500 radios on Ebay right now with AES encryption.

It's mainly the 3 letter agencies that are using OTAR. They've got the budgets to be able to afford the infrastructure necessary to support it. It's actually a timesaver (and lifesaver) for them as field agents don't need to visit the radio shop everytime a radio needs to be rekeyed. If a radio is ever lost, you can quickly rekey all the other radios without any downtime.