38C3 - Breaking NATO Radio Encryption

[@der.Schtefan]

There is nothing more German than explaining your own joke, even after half the room did actually laugh.

[@jomanaminneed]

the only thing even more german happens when a jew doesnt laugh at the germans joke

[@stoertebecker5]

In fact there is: making a video about if something is legal to own / do. Only Germans care enough about that

[@petergerdes1094]

@@stoertebecker5Unless it's a kind of gun. Then it's an American video.

[@alfatech8604]

@@jomanaminneed 😂

[@joepgevaert5298]

Since it's nato, I'd have expected the ~~elephants~~ casaphants to be called Alpha Bravo and Charlie...

[@RandomGeometryDashStuff]

35:23 What does red bold text mean? I thought it means if you change δ (mentioned at 31:42) values of red texts changes, values of black texts don't change. But at 35:23 rk₇ changed from red to black, why?

[@FreeOfFantasy]

the bold red rk_x are the round keys for the specific rounds.

[@RandomGeometryDashStuff]

@@FreeOfFantasy> the bold red rk_x are the round keys for the specific rounds. what are non-bold black rk_x then?

[@Babenhausener]

Warum der reupload?

[@SALTINBANK]

Warum das radio kapput ist ?

[@Medusa_la_Luna]

@SALTINBANK :)

[@mediacccde]

Das ist kein Reupload. Wir laden die Videos bei denen es Audio-Probleme gab erst hier hoch, sobald wir diese behoben haben, weil das hier eben ohne Re-Upload nicht geht. Anderen Kanälen war das leider egal, sie haben sich bei media.ccc.de bedient, wo wir die Videos als Preview mit Tonstörungen veröffentlicht haben.

[@AnoNymInvestor]

NATO did zero cryptanalysis.

[@petergerdes1094]

As for why not use AES, it wouldn't surprise me at all if there was discomfort with using an algorithm whose adoption was so associated with the us government (ie concern about backdoors) -- or this was just developed in part before aes was standardized. The NSA employs some top flight mathematicians and security people so I'd be surprised if they weren't already aware of this. But they are no doubt hoping to move to a quantum resistant algorithm when they make the next change.

[@infinitelyexplosive4131]

AES is already quantum resistant?

[@matthiaskatze1932]

Oha. Wirklich krass dass die Nato so was halbgares verwendet. Die Engländer mussten für Enigma mehr Aufwand betreiben.

[@morgensternc]

Und sind über den selben Scheiss gestolpert. Eine standardisiert (aber eigentlich verbotene) Datum-Zeit Gruppe.

[@AmauryJacquot]

halfloop is obviously half-baked 🤣 the russians must be laughing all the way to moscow

[@bendunselman]

Are neural nets like for instance generative adverserial nets (or deeplearning AI technology in general) useable/applicable instead of brute force attacks?

[@RoboArc]

You mean real time attacks, no lol. They can eves drop and then decrypt it later. Which is a good thing that AI can't crack it fast.

[@micmanders]

Hmmm….I feel that the direction finding and movement of the radios gives you more valuable info….even to know if voice/data might be encrypted as well. Callsign and ALE Key-Up phase may not be the most spectacular thing to know in my limited view of evesdropping the whole scene…..but only my thoughts….

[@potatoonastick2239]

No directionality in HF radio due to the reflection in the upper atmosphere

[@riaganbogenspanner]

If you got the key, you can listen to all messages. Not only the ALE but ALL communication.

[@micmanders]

@@riaganbogenspanner Oh! That is something different then! Thanks for clarification. ALE makes me curious since ages…maybe I will try it out soon, but clear comms of course :-)

[@lmaoroflcopter]

​@potatoonastick2239 HFDF has been common practice since WW2.

[@lmaoroflcopter]

​​@@riaganbogenspannerexcept that isn't the case. HALFLOOP is used only for ALE. The data itself is encrypted. To quote the presenter "so what I am saying HALFLOOP is used in handshake messages and finish messages only, what I explain does not apply to the voice or data, only the handshake or finish messages."

[@jfbeam]

Wait a minute. If your attack depends on knowing the plaintext, and you have a way of getting that, I'd have to say that's a bigger problem. (break in security) Recovering the key would allow you to listen to the entire network, not just the one endpoint you can see unencrypted. Why not just use AES? I don't even know anyone with a security clearance that would know that. :-) For a standard from 2017, I can't see why they wouldn't -- AES can be done in hardware quickly, cheaply, and using low power. Maybe they were still living in the "export restricted" world. (even then, the standards were public... once you double pinky swear you're not in an restricted country.) Maybe they needed something that could work on older radio hardware that couldn't do AES. (but it's still just as complex as AES.) Government and military tech moves rather slowly, so who knows, but I'd bet there's a contractor somewhere who made a fortune coming up with this.

[@hanfo420]

I would recommend watching the video (again).

[@der.Schtefan]

Getting known plaintext, or guessing a large part of it, is quite common. Either because you just triggered an event that causes a message to be sent, or you are guessing weather reports, or Typcial greetings. I recommend reading up about how Enigma got broken in WW2. But this also used to be an attack vector in HTTPS when it came to session cookies, etc

[@jfbeam]

@@der.Schtefan I'm aware of german foolishness. (and there was much of it.) But I'll say it again: _if you're in a position to know the plaintext, that's your first problem._ (and will remain a problem no matter what cipher is used.)

[@randomgeocacher]

If you analyze most real word protocol, attacker typically know parts of the plaintext. Message oracles, padding oracles, formatting oracles, etc. are common plaintext leaks. And those plaintext errors are protocol errors. Next imagine all the operator errors. But yeah, in an ideal world the plaintext is always unpredictable, with no know plaintexts or oracles; but in real world we usually want to send something more humanly meaningful than meaningless random noice.

[@DantalionNl]

@@jfbeam You clearly fundamentally do not understand under what context we reason about cryptographic security. Yes avoiding leaking plaintext is important, but for the robustness of the cipher we have to include that the attacker can get arbitrary plaintexts.

[@alfatech8604]

99% didnt understand anything😂

[@El_Locoroco]

WTF?

[@HuntHeader]

thats life

[@TricTrac3]

🫡

[@negvorsa]

💩🤧

[@maoiljitschguevara]

This is easily the worst C3 talk I ever tried to listen to.

[@msschubi]

Why?

[@mojoblues66]

Lost patience after 15 minutes of uhm and ehms. Badly prepared and badly presented.

[@msschubi]

@@mojoblues66 He should have just spoken German...

[@mojoblues66]

@@msschubi yup

[@maoiljitschguevara]

Let's not mock people for the way they pronounce a foreign language. Regarding the content however: Spends 5-7 minutes on "Cryptography for Dummies" while talking at a conference FULL OF HACKERS. Then suddenly spends 10 minutes talking about some very technical details WITHOUT MOTIVATION. 30 minutes into the talk is the first time he actually mentions anything about a vulnerability. And that's where I stepped of this slow motion train wreck.

[@attribute-4677]

@15:30 You cannot “easily” brute force 56 bits. Even with a modern GPU, it takes at least a year, and that’s vanilla DES with ECB and no entropy analysis, much less CBC, OFB or other modes with multiple rounds.

[@jacobscheit4128]

Not true, a Custom Silicon Can do that by now very fast. 1-2 Hours. And the Type of Special Hardware is Not Hard to get but Not cheap.

[@hanfo420]

It’s called an FPGA 🤫

[@jfbeam]

@ Custom chips aren't necessary. There are several projects doing this with off-the-shelf Xilinx FPGA's. Yes, your single desktop GPU isn't going to be very useful. A few thousand of them (which is a _small_ AI cluster these days) certainly can.

[@xj0ex39]

Git Gud scrubs -your printer

[@der.Schtefan]

Dude, just get 365 cloud GPUs, with a stolen credit card, done.