Hi Karsten, >> At least on my local networks this would have virtually no effect to >> do only that. >> The SI5 & SI5ter don't have any padding here so their content would be >> known in anyway and they provide way enough plain text. > > That's a correct observation: Randomizing filling bytes would force an > attacker to use SI messages instead, thus increasing the attack > complexity by at least an order of magnitude due to the variability in > the SI content and placement.
I guess, it's yet another config the operator must pay attention to. Here, operators all use late assignement, so we first go to a SDCCH where we have between at least 2 ciphered SACCH (so 8 bursts) at predictable position (and it's often more than 2) And AFAICT, their content is not variable at all (explained here : http://lists.lists.reflextor.com/pipermail/a51/2010-July/000804.html ) > Beyond the ordering of the values, SI 5/6 messages, are filled with '00' > bytes. My proposal would be to randomize those in the same way as the > '2B' pattern. Even making a single byte unpredictable would increase the > attack effort by two orders of magnitude. What do you mean by filled with '00' ? AFAIK those are padded with '2b' as well (and SI6 is for sure here). It just happens that the BCCH list encoding in SI5/5ter takes up all the 23 bytes and there is no padding. Sure there are a lot of '00' in those encoding, but they mean something, they're not just padding and if you change them, you change the BCCH list. Sylvain _______________________________________________ A51 mailing list [email protected] http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
