Er foelgende[1] beskrivelse af handset authentication i DECT korrekt, og
hvorfor det skulle vaere specielt dyrt at regne "reverse" algorithmen
ud. Det er vel en standard?
"Authentication of a handset may be done as a standard procedure at
every call setup. During the authentication session, the base station
checks the secret authentication key without sending it over the air.
The principle for hiding the identity information in the air is as
follows: the base station sends a random number to the handset that is
called the "challenge". The handset calculates a "response" by combining
the authentication key with the random information and transmits the
"response" to the base station. The base station also calculates the
expected "response" and compares it with the received "response". The
comparison results into a continuation of the call setup or a release.
If somebody is eavesdropping on the air interface, in order to steal the
authentication key he needs to know the algorithm to recalculate the key
from the "challenge" and the "response". This "reverse" algorithm
demands for a huge amount of computing power. So the cost of retrieving
the key by eavesdropping of the authentication procedure is made
extremely high."
Givet at DECT benytter en 4 cifret pin som subscription key, saa virker
det ikke ret besvaerligt, at gaa rundt med et modificeret DECT handset,
der kan bruteforce de relativt faa kombinationer og derefter subscribe
sig til hvilken som helst DECT base. Man kan ikke lytte til de andre
opkald paa basen, men man kan, saa vidt jeg forstaar, faa gratis,
anonyme opkald.
Kommentarer til ovenstaaende?
[1]
http://handytel.com/technology/dect06.htm
--
I prefer the dark of the night, after midnight and before four-thirty,
when it's more bare, more hollow.
http://a.mongers.org