https://media.ccc.de/v/38c3-breaking-nato-radio-encryption media.ccc.de logo, a lucky cat holding a play icon News RSS, last 100 Podcast feed of the last two years SD quality Podcast audio feed of the last year Podcast archive feed, everything older than two years SD quality Podcast feeds for 38c3 mp4 SD quality opus mp3 webm SD quality vtt [ ] News RSS, last 100 Podcast feed of the last two years SD quality Podcast audio feed of the last year Podcast archive feed, everything older than two years SD quality Podcast feeds for 38c3 mp4 SD quality opus mp3 webm SD quality vtt 1. browse 2. congress 3. 2024 4. event conference logo Breaking NATO Radio Encryption Lukas Stennes Saal ZIGZAG Security Playlists: '38c3' videos starting here / audio * 59 min * 2024-12-27 * 2024-12-28 * 11306 * Fahrplan We are aware of audio issues, especially during talks of day 1 (2024-12-27). Some talks have been released in a preview-version, but are still being worked on behind the scenes. We present fatal security flaws in the HALFLOOP-24 encryption algorithm, which is used by the US military and NATO. HALFLOOP-24 was meant to safeguard the automatic link establishment protocol in high frequency radio, but our research demonstrates that merely two hours of intercepted radio traffic are sufficient to recover the secret key. In the talk, we start with the fundamentals of symmetric key cryptography before going into the details of high frequency radio, HALFLOOP-24, and the foundation of our attack. High frequency (HF) radio, also known as shortwave radio, is commonly used by the military, other government agencies and industries that need highly robust long-distance communication without any external infrastructures. HF radio uses frequencies between 3 and 30 MHz. These frequencies enable skywave propagation, where the radio signals are reflected by electrically charged particles in the upper atmosphere. While this effect enables communication across very large distances, historically, it required trained and experienced operators to establish a radio link. This dependence on operators was reduced by the introduction of the automatic link establishment (ALE) protocol. In a nutshell, an ALE-enabled radio establishes a link to another radio by selecting a suitable frequency according to a propagation model and then transmitting a call frame. If the frequency is good, the other radio receives the frame and the two radios perform a handshake to set up a link. The encryption of these ALE frames is known as linking protection. It is primarily meant to protect unauthorized users from establishing links with radios in a network or interfering with established links. Additionally, encryption of ALE frames also protects the network from certain types of traffic analysis, which is the analysis of operating data such as network structure, frequencies, callsigns and schedules. The first ALE standard did not specify a cipher, but specified how to integrate a stream cipher with ALE. Later standards introduced the 56-bit key Lattice/SoDark cipher, which is now recommended to be replaced with HALFLOOP whenever possible. HALFLOOP, which is standardized in US standard [MIL-STD-188-14D] (https://quicksearch.dla.mil/qsDocDetails.aspx?ident_number=67563) since 2017, is essentially a downscaled version of the Advanced Encryption Standard (AES), which effectively is the most used encryption algorithm today. While this downscaling led to many strong components in HALFLOOP, a fatal flaw in the handling of the so-called tweak enables devastating attacks. In a nutshell, by applying a technique known as differential cryptanalysis, an attacker can skip large parts of the encryption process. In turn, this makes it possible to extract the used secret key and hence enables an attacker to break the confidentiality of the ALE handshake messages and also makes an efficient denial-of-service attack possible. These attacks are described in the two research papers, [Breaking HALFLOOP-24](https://doi.org/10.46586/tosc.v2022.i3.217-238) and [Destroying HALFLOOP-24](https://doi.org/10.46586/ tosc.v2023.i4.58-82). They were initiated by the presentation of the [Cryptanalysis of the SoDark Cipher](https://doi.org/10.46586/ tosc.v2021.i3.36-53), the predecessor of HALFLOOP. Licensed to the public under http://creativecommons.org/licenses/by/ 4.0 Download Video * MP4 * WebM Download 1080p eng-deu-fra 618 MB Download 576p eng-deu-fra 210 MB Download 1080p eng-deu-fra 419 MB Download 576p eng-deu-fra 243 MB These files contain multiple languages. This Talk was translated into multiple languages. The files available for download contain all languages as separate audio-tracks. Most desktop video players allow you to choose between them. Please look for "audio tracks" in your desktop video player. Audio Download mp3 eng 54 MB Download mp3 deu 54 MB Download opus eng 40 MB Download opus deu 39 MB Embed [