Slashdot Mirror
How the NSA Is Spying On Everyone: More Revelations
The Intercept has published today a story detailing documents that "reveal how the NSA plans to secretly introduce new flaws into communication systems so that they can be tapped into—a controversial tactic that security experts say could be exposing the general population to criminal hackers." The documents also describe a years-long effort, aimed at hostile and friendly regimes, from the point of view of the U.S. government, to break the security of various countries' communications networks.
"Codenamed AURORAGOLD, the covert operation has monitored the content of messages sent and received by more than 1,200 email accounts associated with major cellphone network operators, intercepting confidential company planning papers that help the NSA hack into phone networks."
There is a group called SAGE that writes the crypto protocols for cell phones, DECT phones and other ETSI/ITU/3GPP derived standards.
They have never knowingly published an unbroken spec. It is widely understood that this group exists to put government sponsored back doors into cordless phones and cell phones.
I attended a 3GPP meeting since LTE was happening. In it, the guy from SAGE was presenting the new link cipher. 3GPP had asked for something based on AES (so SAGE couldn't pull their A5 shit any more). He presenting AES-CTR for the encryption and AES-CBC-MAC for the integrity field. He added in an off hand way that *the integrity field is truncated to 16 bits*.
Since I wasn't there to help them, I didn't question this in the meeting but after the meeting I cornered him an asked why he made it 16 bits (because its obviously stupid), and he did a Gallic shrug of his shoulders and said "Zat ees what zey asked for". So at that point I knew the fix was in.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.