CNS - 09 - Wireless Cellular Authentication I

Notice that it is extremely inefficient for the serving operator to connect to the home operator everytime the user wants to connect to the network. To solve this problem the idea is that the serving operator only gives the IMSI to the home operator, and the home operator gives N triples of the form \(\langle \text{RAND}, \text{SRES}, Kc \rangle\), each of which allows for establishing an authentication with the given user.

The approach of using triplets (authentication vectors) has two main benefits, which are:

1. Performance.

2. The RAND challenge/nonce is generated by the home operator. This prevents a vulnerability in which an attacker enters the serving operator and generates specific nonces.

---

The algorithm A3 that computes the SRES is computed by the chip inside the SIM, and not by the operating systems of the smartphone. Inside the chip there is also the identity \(k_i\). This means that the telephone does not need to know A3. The only entity that needs to know the algorithm used for authentication is the operator. As a consequence of this, different operators may use different authentication algorithms. From the point of view of security I can hide the algorithm used and keep it for myself. This is exactly the approach taken by authentication by the GSM (2G) guys.

To recap, authentication in 2G was doing using a CHAP-like protocol with

• A 128 bitrandom challenge RAND

• A 128 bit secret \(k_i\)

• An hash using the (proprietary) \(A_3\) algorithm.

Since the key derivation and the challenge authentication were computed using the same arguments (the key \(k_i\) and the random challenge rand), an algorithm called \(A_{38}\) was used to compute both \(A_3\) and \(A_8\) at the same time to get the SRES response (32 bit), and the crypto key of 64 bits (well, technical they were 54 bits plus then 0s).

Observation: In 1990s a \(64\) bits was still computationally unfeasible to break, even for governments. But as we have seen, the key used actually only \(54\) bits. And we now that going from \(64\) to \(54\) we are a thousand times less secure.

---

We'll now get to the crux of the argument: most people still believe that using a secret algorithm is more secure than using a known algorithm. This is called security by obscurity. Security experts however believe the opposite, that is, they prefer known algorithms instead of unkown algorithms.

An example of why security by obscurity does not work as well as we might think is shown to us by the history of 2G, and in particular in how the \(A_3, A_8\) algorithms were used. Since the \(A_{38}\) algorithm could be operator-specific, operators were left with two possibilities:

1. Either they designed their own algorithm,

2. or they took a secret algoritm (which was later given the name COMP128) designed by the standardizer and kept secret.

The COMP128 algorithm was never officialy disclosed, but sometime later it was leaked out. In 1998 David Wagner analyzed the algorithm and broke it in minutes. This show us a crucial thing to remember: an algorithm that is not designed by a cryptographer will probably be broken. In 2002 people found out another attack which worked in less than 1 minute (GSM cloning).

This example showed just how much security by obscurity that does not work for various reasons:

1. It's not easy to find a very strong cryptographer in "restricted" team. (Like Enrico Fermi for the atomic bomb).

2. If you have a public algorithm, then this algorithm will be read by all of the big guys in crypto, who will try to break it in all the possible ways. In general if an algorithm survives public scrutiny, then the algorithm is probably well designed.

For these reasons security by obscurity has been abandoned by serious people. This is the same divide that there is between closed-source or open-source. In general in the context of cryptography openness is much better.

Observation: the key \(k_i\) works like a master secret from which other secrets derive. This approach of using a master secret is favorable, since we only have \(1\) long term secret (\(k_i\)), while the key actually used \(k_c\) is derived dynamically for every session.

---

One of the problem of 2G authentication was the fact that there was no mutual authentication. This means that you could set a fake base station and convince the users to connect to your base station.

To create 4G and 5G stations you need to pay around \(1000\) euroes to have some software defined radios (ETTUS B210). At the time of 2G devices like ETTUS B210 were not available, and thus it was not possible to simulate a base station.

To protect against this type of attack, mutual authentication was needed. The main innovation in 3G and 4G/5G was to change the authentication protocol and come out with a mutual authentication and key agreement protocol.