Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When I make a call on my cellphone (on a GSM network), is it encrypted?

share|improve this question
add comment

2 Answers

up vote 6 down vote accepted

For the most part[1] they are encrypted, but not sufficiently enough to be considered as safe, tap resistant encryption. GSM uses 64-bit A5/1 encryption that is weak, to say the least. $15 phone, 3 minutes all that’s needed to eavesdrop on GSM call article from ArsTechnica covers it pretty well IMO, if you care to read more about it.

However, it also depends on what you mean by GSM. What I mentioned above is true for what we usually mean as GSM (2G, or second generation protocols). 3G are generally considered slighly safer (for lack of a better word):

3G networks offer greater security than their 2G predecessors. By allowing the UE (User Equipment) to authenticate the network it is attaching to, the user can be sure the network is the intended one and not an impersonator. 3G networks use the KASUMI block cipher instead of the older A5/1 stream cipher. However, a number of serious weaknesses in the KASUMI cipher have been identified.

https://en.wikipedia.org/wiki/3G#Security

However:

Many operators reserve much of their 3G bandwidth for internet traffic, while shunting voice and SMS off to the older GSM network.

http://arstechnica.com/gadgets/2010/12/15-phone-3-minutes-all-thats-needed-to-eavesdrop-on-gsm-call/

[1] Unencrypted communication (flag A5/0) is also supported on GSM systems, and this encryption (or lack thereof) might be regulated by laws of different countries differently, or part of the carrier's policy not to use it. Some devices also display notifications to users when their calls will be encrypted and when not, but most probably felt it's hardly worth bothering notifying users, especially considering the strengths of various cypher suits in use with GSM protocols. See my reply to @HSN's comment below for more information.

share|improve this answer
    
year ago i was viewing a lecture on GSM security and spoofing , the lecturer said that each GSM chip has a flag that when its set on , it warns you when you are attempting to make a call on unencrypted network . he claimed that he hasn't seen a company that turns this bit on –  HSN May 5 '13 at 2:32
2  
@HSN - The encryption flag (0 or A5/0 for unencrypted) notifies the end user on some mobiles/smartphones (older Nokia phones with a similar icon like web browsers for HTTP/HTTPS, and iOS 5 and up with a message dialog, to name a few ). Problem is, it's pretty much meaningless with encryption strengths of A5/1 and KASUMI. Some countries also prohibit GSM operators from enabling encryption and some disable it for "other reasons". –  TildalWave May 5 '13 at 2:55
1  
For some additional information and entertainment: The GSM: SRSLY? lecture at 26C3 puts GSM security into perspective. –  Chris Jun 7 '13 at 1:01
add comment

Yes, all GSM calls use an A5/1 stream cipher. It has been found that this is fairily easy to decrypt using a Rainbow Table. Additionally, the FBI admits to intercepting all phone conversations in the US.

So yes, it is encrypted, and cell phone companies don't give a damn about your privacy. If you care about privacy, you should use RedPhone and TextSecure which is an open source projects by Whisper Systems (now apart of Twitter).

share|improve this answer
4  
@TildalWave I find the reference to sexual intercourse to be not nearly as offensive as the existence of service providers who do not care about their customers' privacy. –  Ram Rachum May 5 '13 at 1:38
    
@Ram Rachum thank you, I could not agree more. –  Rook May 5 '13 at 1:40
    
@TildalWave if this was a concern then surely these arbitrary sequences of bits would be altered in some fashion. –  Rook May 5 '13 at 1:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.