Silicon.fr reporting GSM crypto broken

[[EMAIL PROTECTED] (Brian Beesley)]

On Thursday 04 September 2003 11:13, Ross Anderson wrote:
>
> An alternative fix is perhaps just never to use A5/2. If a base
> station wants to talk A5/2, talk in clear instead. I suspect that this
> too could only be implemented on a smallish subset of the fielded
> equipment base.

Ummm - is this a "fix" - surely it would be easier still to eavesdrop or 
break into a conversation if it were in clear instead of A5/2?

The A5/2 fix would be to ensure that a session was never set up using that 
protocol. If a phone won't accept A5/1 then don't set up a session.

This fix could be done at the base stations, which are presumably a lot 
easier to upgrade than phones, if only because there are less of them & they 
don't move around so much. If this fix breaks any phones, it's because they 
were defective to start off with i.e. A5/1 was not implemented properly hence 
they were forced to A5/2.
>
> It's an interesting long-tail vulnerability resulting from weak crypto
> mandated by governments.

Yes. We need to break this sort of thing once & for all. Governments should 
keep their noses out of private conversations, full stop.

Brian Beesley