I've read this article about NSA allegedly stealing SIM cards from Gemalto which states:

After a SIM card is manufactured, the encryption key, known as a “Ki,” is burned directly onto the chip. A copy of the key is also given to the cellular provider, allowing its network to recognize an individual’s phone.

Is it really so that each SIM card has a key which is later on used to encrypt the traffic using symmetric cryptography? That seems rather unfortunate, why isn't Diffie-Hellman key exchange used?

  • 1
    Should "What" be replaced with "Why"? – user49075 Apr 28 '15 at 21:32
  • 1
    Because GSM is specifically designed to give total control to the carriers (part of the reason is probably to please the security agencies of various countries, not just the NSA), and using their own crapto seemed better for them than using what is standard in the IT industry. By the way, if you want security over GSM, just run IPSec and/or SIP+TLS over it. – user42178 Apr 29 '15 at 5:53
  • You're forgetting the possibility that intel agencies getting the keys is an intended side-effect. – cpast May 1 '15 at 17:59

GSM was designed at a time when consumer products, in particular the first GSM phones and the smart cards, were a lot less powerful than they are today (at that time, a desktop computer was using, at best, a 16 MHz 68020 CPU or something similar). Asymmetric crypto could not be achieved within a reasonable time frame on these cards.

The shared key model is a problem, but not really the one you may think about. The goals of the protocol are:

  1. To protect the confidentiality of the conversation against over-the-air listeners.
  2. To establish some "proof" that the call really occurred, for billing purposes.

The confidentiality was never meant for anything else than the radio transmission between the phone and the nearest base station. It is not, never has been, and never meant to be, an end-to-end (ie. phone-to-phone) encryption system. Providers want to access the raw data, if only to be able to (re)compress the voice feed more aggressively than what the phone themselves do(*). In that model, the provider is, by definition, trusted. A "shared secret" model, with a key known to both the phone and the provider, is fine in that respect.

Of course, there is ample room for making mistakes, for instance by using a poor key derivation function or an even worse encryption algorithm. The shared secret model, though, is not at cause here.

It is for the second point that using a shared secret is suboptimal. If the secret is known to both the user's device and the provider, then anything that is computed relatively to this secret could have been computed by either the user or the provider. As such, it should not be usable as proof in a dispute between the user and the provider. The billing mechanism is thus at risk (though experience shows that, in practice, providers don't find it hard to obtain money from consumers). An "academically" better model would involve asymmetric signatures (so not DH, but rather DSA) where a phone would sign its request for opening or maintaining a communication channel.

(*) Of course, accessing the raw data also helps interception by legal authorities, but to my knowledge that is not the primary reason. In fact, end-to-end encryption is hard because both ends must agree on the protocol to use. Point-to-point encryption is way easier.


One reason is speed, because symetric encryption is easier in this situation, and also DH need communication for exchanging key, that can busy the GSM line for each client and in overall GSM network, and also DH is vulnerable to MITM attack, because there is no verified third party and authorization, so NSA also can run MITM. So there is no difference between A5, DH from point of NSA and both of them are vulnerable to penetration. But A5 is used for better speed. And just other persons could not obtain information properly.

  • 1
    Just to add additional context, the GSM crypto architecture was developed in the late 80's. In 2015 we have a much greater insight into practical attacks and much more capable hardware. I suspect DH was simply not possible for a mobile phone in the late 80's, even if we wanted the guarantees it provides (and worked around the dangers of DH.) – bradreaves May 1 '15 at 18:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.