GSM Encryption Falls

Financial Times reports that the GSM A5/1 encryption has been cracked at a competition during the 26C3.

The *actual* A5/1 algorithm was initially proprietary and only published to industry members. Over time the cipher was reverse-engineered into a functionally identical algorithm and several flaws were found with both it and the original.

The practical implementation of this weakness relies on two pieces - the first is the actual A5/1 rainbow tables which seem to now be fairly easily computable into a 3TB dataset.The second involves the actual RF hardware necessary to communicate and process calls with the handsets as a clandestine base station.

“The reality is that a practical attack is beyond the capabilities of the vast majority of people” -- James Moran, security director of the GSMA. [link]

If this is the stumbling block to easy exploitation, then projects like OpenBTS, USRP and SDR in general should be getting a lot of traffic right now...