Time-Memory Trade-Offs Sound the Death Knell for GPRS and GSM

Avoine, Gildas; Carpent, Xavier; Claverie, Tristan; Devine, Christophe; Leblanc-Albarel, Diane

Abstract

This paper introduces a practical TMTO-based attack against GSM (A5/3) and GPRS (GEA-3), which are both technologies used in 2G mobile networks. Although designed in the 80 s, these networks are still quite active today, especially for embedded systems. While active attacks against 2G networks with a fake base station were already known for a while, the attacks introduced in this paper rely on a passive attacker. We explain in this paper how to find material in GPRS and GSM communications to perform a TMTO attack. We performed validation experiments with off-the-shelf devices operated in real-life networks. We provide the success probability of the attack and its performances for several real-life scenarios. We optimized the implementation of KASUMI with AVX2 instructions, and designed a specific TMTO implementation to get around the SSD access latency. As a motivating example, an attacker passively eavesdropping a GSM communication between a target and a base station can decrypt any 2-h call with probability 0.43, in 14 min.

Citation

Avoine, G., Carpent, X., Claverie, T., Devine, C., & Leblanc-Albarel, D. (2024, August). Time-Memory Trade-Offs Sound the Death Knell for GPRS and GSM. Presented at Advances in Cryptology – CRYPTO 2024, Santa Barbara, USA

• Presentation Conference Type: Conference Paper (published)
• Conference Name: Advances in Cryptology – CRYPTO 2024
• Start Date: Aug 18, 2024
• End Date: Aug 22, 2024
• Online Publication Date: Aug 17, 2024
• Publication Date: Aug 17, 2024
• Deposit Date: Jan 29, 2025
• Publicly Available Date: Aug 18, 2025
• Peer Reviewed: Peer Reviewed
• Volume: 14923 LNCS
• Pages: 206-240
• Series Title: Lecture Notes in Computer Science
• Series Number: 14923
• Series ISSN: 1611-3349
• Book Title: Advances in Cryptology – CRYPTO 2024
• ISBN: 9783031683848
• DOI: https://doi.org/10.1007/978-3-031-68385-5_7
• Public URL: https://nottingham-repository.worktribe.com/output/44689157
• Publisher URL: https://link.springer.com/chapter/10.1007/978-3-031-68385-5_7