Why did the NSA not report this flaw to NATO before this became a standard? The NSA had differential cryptanalysis before anyone else. It is odd that they did not catch/report the problem.
In practice this isn’t a very useful attack. You need hours of encrypted and unencrypted data and you can then only decrypt the encrypted transmissions of the targeted node.
The NSA if it knew about it most likely did disclosed the vulnerability, it was just deemed not significant enough to redesign, manufacture and re-issue millions of new radios.
These radios aren’t rated for secret communications anyhow. By the time you manage to decrypt what you want the information would likely be stale since all of the information passed over radios will be tactical in nature at best.
There are still other defenses like spread spectrum transmission and frequency hopping that make intercepts harder. The main threat model against radios isn’t actually message interception but rather basic SigInt that would be able to detect, identify and track transmissions.
On the battlefield that’s the most useful intelligence you’ll get especially during war time.
Any interception beyond that would take days if not weeks to be properly analyzed and disseminated this isn’t something that it done on a regiment or division levels.
Likely a honey trap. NATO’s adversaries can waste budget listening on this leaving the real comms unchecked, plus the advantage of throwing some false comms in the event of war.
I agree. I find it incredibly difficult to believe this wasn’t a known issue until now. The NSA/CIA have unbelievable computing and analysis power available.
Anyway, IDRTFA, but I hope this was at least reported before the release of the talk. This sort of thing could get a lot of people killed.
> This sort of thing could get a lot of people killed.
NATO is not at war. People aren't dying.
And I wouldn't be surprised if it's at least partly used to "leak" info to other state actors. Part of the cold war not turning hot was the mutual understanding of what went on in each block's military due to espionage. Without that, things could easily misinterpreted (and almost did a couple times like with able archer, which emphasizes the importance of this).
Some things could not be shared officially but leaving it out in a not-fully-unbreakable form might well have been a way of hinting the enemy about intentions.
Ahem, NATO countries are assisting Ukraine in drone and missile attacks on Russia as we speak and foolishly floating the idea of adding Ukraine to NATO. Russian leadership has repeatedly said stuff along the lines of "Make no mistake, we are at war with NATO because Ukraine alone doesn't have the capabilities to do what it's been doing to attack us." So yes, NATO is essentially at war.
>While eastern European countries say some sort of a road map should be offered to Kyiv at a NATO summit in Vilnius on Tuesday and Wednesday, the United States and Germany are wary of any move that might take the alliance closer to war with Russia.
"Some" of NATO is clearly on board with it. The article says that the support must be unanimous, but I think we know who really runs NATO. At any rate, "some" of NATO is not "nobody in NATO" as you said. I could swear I hear these people talk about the issue every month or so.
Please be more specific than ‘they’. I’ll also remind you that journalists do not make policy, and policymakers don’t give a shit about journalists unless they’re trying to plant a story beneficial to them.
> "Some" of NATO is clearly on board with it. The article says that the support must be unanimous, but I think we know who really runs NATO. At any rate, "some" of NATO is not "nobody in NATO" as you said. I could swear I hear these people talk about the issue every month or so.
From the article you linked, emphasis mine:
‘While eastern European countries say some sort of a road map should be offered to Kyiv at a NATO summit in Vilnius on Tuesday and Wednesday, the United States and Germany are wary of any move that might take the alliance closer to war with Russia.’
It doesn’t matter if Poland and Lithuania want Ukraine in NATO, lmao. The US is NATO, and they’re not going to admit a country into NATO that is currently at war with Russia, it would immediately trigger Article V… which would either destroy NATO, or the world.
Even if Ukraine won the war and Russia retreated, there is far too much corruption in Ukraine for it to seriously be considered for NATO and EU at this point in time.
What you describe in C falls under A) are not that capable and did not know about it - investing all into offence means you're not capable in defense. Making sure the encryption of the major military alliance you're part of doesn't fall apart seems like a serious miss, no matter how we slice it. Be the reason bureaucratic, malicous or financial.
There're more options, but those require multiple nation states to work together in a conspiracy (everyone in the know) and all others to be incompetent. Given just publicly known facts and Occam's razor…
NATO Keys are distributed to every NATO member through distribution agencies. A good chunk of them (and the algorithms and cipher equipment) are produced by the US and shared (with some limitations) with NATO. I don't know the scope of algorithm sharing but I believe there are some limitations for NATO access to US-shared algorithms.
It's probably a case of 'nobody cares too much'. The standardization process is very long and the industry probably had already put them into their equipments.
ALE is not used that much and from what I can gather manual frequency establishment is often preferred. I'm not sure what the actual operational impact of this DoS would be, and if some spoofing is possible, but the actual communication is encrypted by different protocols depending on the type of comms (RATT, IP-like, Voice) so actually deciphering comms wouldn't be possible.
So you need 2 hours of both encrypted and unencrypted data at same time to make this attack work, is this feasible? And if you just flip the switch on devices to use more bits in the encryption the attack becomes unfeasible. Piss poor that NATO never replied to them.
For those without a free hour to watch, here's the slide deck?
I am not a cryptography or digital radio expert, so grain of salt and all that.
Slide 14 shows real world feasibility, I think it's safe to say that while theoretically possible it's unlikely that this creates a significant real world issue. One bit of info I don't know - how long is a set of exchanged keys used for in most situations?
