TETRA’s Secret Cryptography and the 2023 Findings

▶ Watch (00:32)

TETRA (terrestrial trunked radio) was standardized in 1995 and runs police, military, and SCADA communications across Europe, Latin America, the Middle East, and South Asia. Its cryptography was NDA-protected from the start. In 2023, Midnight Blue reverse-engineered the full cipher suite and found TEA1, an intentionally weakened cipher delivering 32 bits of effective security against an advertised 80. They also found a keystream recovery attack that breaks confidentiality regardless of which cipher the network runs. End-to-end encryption was proposed as the fix. That is what this talk examines.

End-to-End Encryption: Proprietary, Secret, and Widening in Use

▶ Watch (04:03)

TETRA E2E is used by intelligence agencies, covert police units, and special forces across dozens of countries. The TCCA governs the specification, but access requires signing paperwork that prohibits publishing anything about it. That leaves end users with no independent view of what they bought. Searching the public internet turned up a 2003 document by the ETSI technical committee chair, seven Chinese academic papers, and a Russian paper, all based on the restricted spec. The universities that published them are now on sanctions lists.

“these NDAs are really not aiding security at all.” — Wer

Getting Inside the Radio: Hardware Acquisition and Code Execution

▶ Watch (06:20)

Midnight Blue wanted Motorola hardware but found one unit on eBay that turned out to be broken or fake. They pivoted to Sapura, which makes a software-based embedded E2E implementation running on the OMAP L138, the same chip in a Motorola radio they had studied thoroughly two years earlier. They bought several civilian Sapura radios on the open market, applied previously discovered code-execution vulnerabilities, and extracted the E2E cryptographic implementation. The code execution and key extraction demo on Sapura radio (07:54) shows the full physical-access-to-implant sequence, completing in seconds.

E2E Weaknesses: Reduced Key Entropy and Voice Injection

▶ Watch (13:41)

Two findings stand out. First, algorithm 0x87 accepts a 128-bit traffic key, then runs additional processing that reduces effective entropy to 56 bits, putting it within brute-force range. Vendors rarely disclose this in public tenders. Second, TETRA voice codecs produce identical silence frames at the start of every call across multiple radio models from multiple manufacturers. An attacker who intercepts a sync frame can recover the keystream for those frames, then inject arbitrary audio that receivers cannot distinguish from a legitimate E2E call. See the voice injection into an encrypted E2E call (16:30) demo.

Air Interface: ETSI’s Mitigation Bypassed and Multi-Cipher Networks Compromised

▶ Watch (22:21)

ETSI’s 2023 standard revision tells radios to “consider” switching cells on unexpected IV changes. The word is non-mandatory, and Midnight Blue built a two-frequency setup that satisfies the new rule while still delivering the original attack. The ETSI-bypass keystream recovery demo (26:06) shows a captured message decrypted end-to-end. Multi-cipher networks add a second problem: TEA1 and TEA3 users must share the same CCK network key to avoid identity collisions. Compromise one TEA1 radio and you own the CCK for every TEA3 user, indefinitely if the key is never rotated.

“all you need to know is successful time change equals keystream equals message decrypted.” — Wer

SCADA Injection and What This Means for Critical Infrastructure

▶ Watch (33:46)

The SCADA circuit breaker injection demo (33:46) uses a lab built to mirror real electric utility deployments: an RTU connected to a circuit breaker, a SCADA server, and both sides linked by TETRA radio modems carrying IEC 104. The attacker intercepts a legitimate control message, forges a replacement, and trips the breaker without authenticating to the network. Any protocol running over TETRA, IP or serial, is exposed the same way.

“but don’t trust blackbox solutions people keep doing this even though they know and they should know better” — Carlo Meijer

Q&A

Did ETSI already respond to your research? Midnight Blue disclosed to ETSI through a coordinated process; ETSI acknowledged the issues in private communications but had issued no public statement or mitigations at the time of the presentation. ▶ 39:33

Notable Quotes

these NDAs are really not aiding security at all. Wer · ▶ 11:37

all you need to know is successful time change equals keystream equals message decrypted. Wer · ▶ 23:30

but don’t trust blackbox solutions people keep doing this even though they know and they should know better Carlo Meijer · ▶ 38:19

Key Takeaways

  • Algorithm 0x87 silently downgrades TETRA E2E keys from 128-bit to 56-bit, putting communications within brute-force range.
  • Predictable silence frames at call start let attackers inject arbitrary voice into end-to-end encrypted TETRA channels.
  • Multi-cipher networks share one CCK, so a single weak TEA1 radio compromises all TEA3 traffic on the same network indefinitely.