The following papers explain that it is possible to suppress the encryption (or downgrade) in GSM using faked messages:
The main problem seems, that the messages, which are used to determine which encryption protocols are supported, are not integrity protected so an attacker can modify them.
I am just wondering how you would realize that? Do I have to drop the message which comes from the base station (is that even possible?) or can I impersonate the user and send a message to the base station that indicates that I am only supporting A5/1 ? How would you guys realize that? Using osmocomBB or are there other ways?