start	end	text
0	14680	Thank you very much. Can everybody see me? Can everybody hear me?
15820	20980	Awesome. This microphone is kind of sketchy, but we'll deal.
21180	30000	Our presentation is end-to-end voice encryption over GSM, a different approach.
30640	36120	We have Wesley Tanner, who is a systems engineer for Software Divine Radio Company
36120	40120	and has a BS in EE from RPI. There's me.
42400	43920	RPI in the house, I see.
44260	48660	Me, I'm not really a security engineer, but it says it on the slide anyway.
49480	55200	I'm an engineer for a computer company in Cupertino, BS in computer science from UCSB.
55600	59980	And we have Keith, who isn't here sadly, also from RPI.
60900	63340	We love you, Keith, wherever you are.
65780	67340	Presentation overview.
68300	72650	We're going to go over the motivation, the need for cellular crypto.
72940	75480	Current market offerings.
76340	81180	And our approach, a different approach to the GSM voice channel modem.
81180	87240	We're going to go over the details, the radio interface, traditional telephone modems over GSM.
87280	90680	Some of the design choices and issues we're facing.
90680	97680	We're going to go into the cryptographic design and hopefully we'll have some demonstrations that won't fail miserably.
98040	99140	It'll work.
99380	100740	I have faith.
101980	103180	Motivation.
103340	106960	Where is the end-to-end voice protection over cellular?
108080	113880	A lot of people want it, but a majority of the products in the market don't provide
115420	120220	in the sense that they fail in a lot of different areas.
120220	122520	The number one being price.
122960	125020	We'll get into that later.
125180	132620	We want to make cryptographic cell phones available for the discerning privacy-conscious consumer.
132680	135240	One sec. It's okay for photographs.
137300	138840	Thanks, Wes.
138900	141980	It's a requirement. We have to say it.
143740	145380	That was awesome.
145380	150200	Here is an image of the GSM network. We stole it from Wikipedia.
151080	156120	The only thing we wanted to point out is that here is the handset and here is the base station.
156120	159800	Those are the only two things you need to realize.
161960	165540	GSM cryptography. You're probably reasonably familiar.
165540	167860	We have the A3 algorithm for authentication.
167860	173360	The A5 for the actual encryption of the voice channel, or attempts at that.
173360	177200	And the A8, which is key generation.
180380	183340	A5 has been broken horribly.
183400	187540	You have no voice protection on GSM.
188280	191480	Even if you did, it's only over the air.
191480	196620	Once the data actually reaches the network, you're in clear text.
197040	198660	That should be fun.
198660	202900	As the slide says, the moral of the story.
203240	210560	GSM cryptography provides limited, if any, security to your voice channel.
210560	216400	Something else is needed. A cryptographic layer on top of that, or a cryptographic data channel.
218480	220860	More on the need of cellular cryptography.
220940	225280	Cellular phones have completely supplanted PSTN.
225280	228360	I don't think that many people in here have landlines.
228360	231480	I sure don't, and I don't really know anyone that does.
232440	236800	The cellular companies do not provide meaningful protection for that traffic.
237800	244400	And the ease of interception of voice data is kind of ridiculously easy, as we'll see later.
247180	249160	Two major classes of intercept.
249160	251260	The government-perpetrated intercept.
251280	254900	The TLAs, authorized and unauthorized.
254900	259420	I'm not sure I want to say that.
259420	261940	Non-government-perpetrated, the more interesting ones.
261940	265740	By private investigators, business partners, economic espionage and such.
265740	271960	The product on the right is a device you can buy for a couple of thousand dollars.
273340	276200	Yeah, these devices are relatively expensive.
276200	284360	But in the coming years, it's expected that with a cheap A to D converter and some special software, you can do this for a lot less money.
284360	288120	So it's going to become more of a reality for private intercepts.
289940	291440	Thank you, Mr. Tanner.
293400	295340	Government intercepts are probably the most common.
295440	297800	Undetectable. Sadly, untraceable.
298380	300660	Done on the higher levels of government.
302020	304020	Data for the reported intercepts.
304020	306400	In 2000, there were 1700 intercepts.
306400	307740	That covers everything.
308380	310740	1500 of those were portable devices.
310740	315000	Cellular, telephones, satellite phones, etc.
315260	317100	That's quite a large number.
318040	323540	Here is a chart of the increase in cellular wildtaps.
323540	326240	Actually, yes, cellular wildtaps, portable devices.
326240	331460	As you notice, intercepts have doubled since 2000.
331700	334500	The trend appears to show that it's increasing.
334500	336940	You could probably all notice that from the last slide.
337580	342500	What's interesting, though, is there's no massive jump after September 11th.
342500	345000	We won't go all tinfoil hat on you.
345000	349300	Which kind of implies they are obviously doing more wildtaps.
349300	351860	So those aren't getting released in those numbers.
353460	357940	There's also a GSM spec for lawful interception.
357940	359180	That's kind of interesting.
359260	360940	They make it rather easy.
360940	363840	It's actually built into the GSM specifications to get
363840	367500	output product, network data, which is your, you know,
367500	370820	location, type of call, parties, numbers, of course,
370820	374640	the product, which is the speech user data, SMS,
374640	377240	everything you take for granted to be reasonably private.
378060	379040	It's not.
379980	382380	Here is a diagram of a lawful interception.
383080	387240	Note the shady-looking law enforcement agent, the intercept request,
387240	389980	and the data coming back to the LEA.
390300	391640	Very interesting.
391640	396360	The moral of the story, too, is even if the GSM crypto is sufficient,
396360	399200	as I said earlier, the protection from the handset to the tower
400960	402980	is capable of being...
403520	407620	Even if the voice, the over-the-air voice crypto is secure,
407620	411960	you still have the over-the-wire cryptography.
412180	415600	Sorry, over-the-wire cleartext, which is easily interceptable,
415600	417720	as noted from the last diagram.
419880	421080	What's that?
422660	426500	There's a variety of products out there already that address this problem.
426820	429140	And we got a chance to see the CryptoPhone guys
429140	432360	present their products at Hope last year.
432840	434640	Apologies. Is it better?
435920	438000	The CryptoPhone guys presented their product.
438000	441460	It's slick. I've never used it, but it does address this problem.
441500	444940	There's the Sectera device by General Dynamics,
444940	446520	and that's really used more...
446520	449820	That's basically available to a military and government contract.
450500	453140	There's the Ancord crypto smartphone.
453320	455860	There's not a whole lot of information about this product out there.
455860	459720	It's kind of a... Well, I was unable to find anything about it.
459880	461900	And there's several other vapor products that have...
461900	465120	Their web presence has gone up and down, and they're no longer available,
465120	467260	so I can't say anything about those.
470720	471160	There's...
475080	475960	There's a government...
478740	480720	There's a new government standard
480720	484200	that's looking to replace the STU3,
484200	489280	which is what they use typically to provide type 1 voice crypto.
489480	492420	It's the Future Narrowband Digital Terminal standard.
493000	497820	This has a minimum requirement of 2,400 hertz for voice.
497820	500920	This is very standard things like MELP for voice encryption,
500920	505740	voice compression, and AES for voice encryption.
505940	508300	And there's more data about this on Wikipedia.
511840	514080	The problem with the current products...
515180	517840	They all probably work very well. I've never used them.
518060	519640	Oh, I've never seen them demonstrated.
519640	522720	But they use the circuit-switched data channel.
524160	527340	I was never offered this as part of my consumer package.
527680	531500	And I think... I've heard that you need to pay roaming charges
531500	533480	in some areas on this.
533480	536140	So it's not as ubiquitous as the voice channel itself.
537260	539980	There's longer call setup times associated with it,
539980	541100	because it's a modem.
541880	545340	It has to negotiate the connection. And there's a higher latency.
545680	548480	But it's better than the packet-switched services that we use
549240	552520	like GPRS for a typical internet over a cell phone.
552520	555320	Also, if you can get circuit-switched data,
555320	559020	it's usually rather expensive, which is kind of irritating.
561200	563460	And it's meant to carry data, not voice.
563460	566780	And data is not forgiving with bit error.
567280	570440	And voice is. You can have large numbers of bit errors
570440	574500	in your voice stream and have reasonable voice quality.
574500	576560	So you don't need it to retransmit.
576560	577760	And for data, you do.
582160	584980	And the biggest problem is that these products are
584980	587460	not available to you or me. They're very expensive.
587460	590600	Or they're for military or government use only.
590900	593740	And a solution should be available to you and me.
595640	598260	3G will probably take care of a lot of these problems.
598720	601380	Because it is a high bandwidth data.
601500	604160	And the data suggests that it will be low latency as well.
604160	607100	It hasn't been rolled out everywhere. It actually is in San Diego.
607160	610220	And I believe San Francisco. I don't have it, but...
610220	613720	It may solve the problems, but again, it's not available to everybody today.
615320	618640	And we're proposing a solution, which is what we've been researching
618640	620600	for the last couple months.
620600	623600	It's developing a modem
624320	627900	that will work over the 2G voice channel
627900	629600	and the 3G voice channel.
630240	632440	And it involves a bunch of technical disciplines,
632440	634240	which makes it an interesting problem.
634860	637880	And that's all I want to say about that.
638120	642540	Basically, the voice channel on GSM
642540	647680	is a subset of a generic voice channel.
648280	651040	Basically, the tricky part about the GSM channel
651040	652920	is that it's highly compressed.
653020	656440	And if we get a product to work on the GSM channel,
656440	659900	we can use it on anything. You can use it over 2-way radio,
660780	662220	voice over IP, or
662960	665040	normal packet switch telephone networks.
666000	668860	And the goal is to have an integrated thing
668860	671100	that works over all these protocols.
671600	674280	All these systems. That's the goal.
675100	678520	And this is the proposed system block diagram.
679060	681500	I don't know if it's easy to read.
681640	684160	But basically, you have your input voice stream
684160	685760	that goes into some kind of modem
686480	690260	and goes through the GSM channel, all through all the networks,
690260	692800	and comes out the other side undistorted.
697520	699680	The project goals are basically
699680	702480	to maximize the voice quality
703940	706780	and provide strong crypto
707500	710640	for privacy. And to minimize the distortion.
710640	713060	So you want to have good sounding quality audio
713640	715580	and have it very secure.
719820	721360	I'm going to blow through some of these quick
721360	724980	because it's highly involved
724980	727880	and takes too much time. But basically,
727880	731100	the GSM voice channel is a low latency,
731100	733340	highly available channel.
733460	735800	It has a friendly billing system. You can use your minutes
737800	740900	instead of more expensive data packages.
741740	743620	However, the voice channel uses
743620	746780	strong compression, which causes distortion
746780	749080	for certain types of signals that you pass through it.
749760	752720	And therefore, you need to pass through things that look like speech
752720	754140	so they're not distorted.
755600	758060	This is a pretty busy slide,
758060	760360	but it's basically calculating the data rate
760360	763300	over the GSM air interface.
763940	767780	And this is a breakdown of the GSM voice frame
767780	769620	by speech parameter.
769980	772520	It works out to 13 kilobits per second
773100	775120	and there's 260 bits per frame
775120	777400	and those are sent every 20 milliseconds.
779060	782660	And all these parameters here are what we're trying to exploit
783320	786420	to enable us to create a waveform
786420	788320	that will work over in this frame
788320	791320	without significant distortion when it goes through the channel.
791320	795240	And this just shows that there's an 8-to-1 compression.
795240	798120	Your input on a typical GSM handset
798120	800300	is 8 kilohertz sample rate audio
800880	803080	at 13 significant bits.
803080	804600	And that works out to an 8-to-1 compression
804600	807160	when you go down to 13 kilobits per second.
808320	813020	The official name of the 2G GSM voice channel
813020	815400	is the top bit.
815400	817200	It's a long way of saying that it uses
819780	820880	a complicated compression
820880	822800	to achieve its goal.
823280	825600	And the input is PCM
826140	828120	on a uniform quantized data.
829120	830880	This is another busy slide.
831240	834460	And this is from the 3GPP website.
834460	836260	A lot of this data is available there.
837320	840460	It's the voice encoder.
841040	842900	Your speech samples go in on the left
842900	846940	and the parameters that describe that speech
846940	848580	come out on the right.
849780	852200	And there's a bunch of complicated processing in the middle.
852200	853680	It's highly nonlinear.
854840	857680	And this is the speech decoder, the synthesizer.
857680	859480	It takes those input parameters
859480	863060	and spits out synthesized speech
863060	864800	that's a very clear representation
864800	867960	of what you originally put through the channel.
870240	871860	I'm going to blow through this one.
871860	874680	Basically, the processing involves
874680	876960	short-term algorithms
878220	880580	that determine what the short-term content is.
880580	883840	There's a long-term prediction that gives you your lag and gain.
883940	885720	And the coder also
886540	888800	determines the pitch of your voice.
889340	892240	And all this is fed through this coder.
892240	895240	You get a residual error signal out, and that's also encoded.
895240	898700	So all these parameters do a good job of representing speech.
900620	904740	When the voice packets go over your GSM radio,
905900	907620	some bits are protected
907620	910240	from transmission errors, and some are not.
910940	912660	The class A bits are.
912940	916180	I think it's about 36 bits
916180	919200	that are actually protected. Those are the most important bits.
919200	923400	If you flip one of those, it's impossible to have intelligible speech.
923400	926440	If the other bits are flipped, it's possible that you can actually
926440	928780	understand the audio coming out of the phone.
929780	932300	There's an RFC about this that goes into more detail.
934300	935680	And this is a slide
935680	938160	we threw in just showing a typical speech pattern.
939020	941140	It has a pretty distinct shape.
941140	942960	I'm sure a lot of you have seen that before.
943100	947600	This is 8 kHz sampling rate, and it's about 6 seconds of audio.
948480	950580	And this is a zoomed-in version.
950580	953800	It shows that there's a certain pitch
953800	955240	over the frame.
958680	961680	And I always wondered why you couldn't use
961680	964060	your traditional telephone modems over
964060	966200	the GSM channel.
967040	970000	So I'm going to talk about why this might not work.
970780	973420	Your typical telephone modulation schemes
973420	976540	are listed here in order of bit error.
976540	978080	I mean, bit rate.
978080	980480	There's the 300 all the way to the
981320	984860	56 kbit per second that we're pretty used to these days.
985200	987980	And they're listed by modulation type as well.
987980	991060	So they use different schemes to encode the audio.
993020	995160	And I'll give a quick description of
995160	997620	56 kbit per second modem.
997980	1001140	It uses basically shaped voltages
1001140	1004320	or pulses over your analog pair.
1004820	1008060	And these represent bits that you're sending.
1008060	1009960	And those are converted to digital signal
1009960	1011820	when it gets to the telco office.
1013120	1016340	These voltages are held on the line for 125 microseconds
1016340	1018140	which is a pretty short amount of time.
1018180	1021500	And there's 8 bits per pulse. So there's 256 discrete voltages
1021500	1022780	that go over your line.
1023240	1025740	And in North America, we use only 7.
1025740	1028900	So we have 56 instead of 64 kbit per second.
1028900	1033880	But in reality, the analog lines are not able to discriminate.
1033880	1036160	It's hard to discriminate between the 256 levels.
1036160	1037500	So they typically use less.
1037500	1039960	And that's why it negotiates a slower connection.
1041560	1044280	And this is a high level diagram of
1044280	1047340	talking from one analog voice modem
1047340	1049600	V.90 modem to another.
1050460	1051780	And basically you can see the pulse.
1051780	1056200	You go through analog. Comes out digital. Goes back analog.
1059350	1061550	And one of the 1200 bit per second modems
1061550	1065190	they use a phase modulation scheme.
1065190	1066870	I just threw this one in.
1066870	1070630	It's a simulink model of a PSK modulator.
1071810	1073410	And it turns out that
1073410	1075490	voice codecs are not...
1075490	1079030	it's not important to preserve phase information
1079510	1081510	for voice traffic.
1081510	1085810	It's hard to perceive changes in phase and timing
1085810	1087890	on voice.
1089510	1092330	And so that information is not preserved over the channel.
1092430	1094990	And this is what PSK kind of looks like.
1094990	1097590	On the right is the time domain signal.
1097830	1100810	And you can see that it's a sinusoidal shape.
1101090	1103990	And there's discontinuities where we're adjusting the phase.
1104110	1106930	One phase represents a zero. One phase represents a one.
1107210	1109590	And the spectral content.
1109670	1111510	You can see the bandwidth it takes up.
1112390	1115290	So I'm blowing through these fast because I don't think we've got the time.
1117170	1119550	I want to run a demo right quick.
1121010	1123310	Of using frequency modulation
1123310	1124970	over GSM.
1125050	1126790	And what frequency modulation really is
1128250	1131090	you're encoding one tone as a zero
1131090	1133070	and another tone as a one.
1133070	1136590	And those tones are flipped back and forth at a certain rate
1136590	1139250	so that you send your data that way.
1139470	1144050	And we're going to show how the GSM channel distorts that signal.
1144050	1146810	Making it impossible to decode correctly.
1160440	1162040	That would have been bad.
1165180	1167120	Alright, this is a quick aside.
1167120	1170720	We did our modeling and work in Simulink and MATLAB.
1170720	1172880	It's a numeric processing tool that is
1172880	1175840	pretty quick to prototype on.
1176200	1179600	It allows you to rapidly throw something together
1179600	1181600	and throw information at the channel
1181600	1183700	and see how it behaves.
1184560	1186520	The actual voice channel we're using
1186520	1189600	our model came from the 3GPP website.
1189600	1191580	They have all the reference code available.
1192080	1193420	And so it's in C.
1193580	1197000	It compiles basically on any architecture.
1197680	1200400	And so we threw that code and put some glue into Simulink
1200400	1201780	so we could model this.
1208190	1210650	Alright, so this is running at 100 bits per second.
1221500	1222680	Hold on right quick.
1224620	1228320	This is the output special content
1228880	1231500	going through the voice channel.
1231500	1232960	But let me switch it over to
1232960	1234720	the straight pass through.
1235140	1236180	You can see the tones
1240800	1241840	going back and forth
1241840	1242960	between the 0 and the 1.
1243520	1246460	Closer to the 0 is a 0.
1246460	1248960	And further out in frequency is a 1.
1248960	1250900	You can see them flipping back and forth.
1251040	1253800	And you can basically determine at any given time
1254280	1256080	which one is which. It's easy to discern
1256700	1258500	when it's a 0 and when it's a 1.
1259940	1263520	If you put this through the voice channel itself
1266560	1268380	you can see that the pulses
1268380	1270720	they look a little more distorted.
1270740	1273020	It's harder to tell at any given time
1273920	1277380	what the actual tone is going through there.
1277500	1280500	There are these blips and blobs
1280500	1282520	and it's harder to pick them out.
1282520	1285720	That's just a visual representation of what kind of distortion
1285720	1287580	you'd expect to see on this channel.
1305010	1308050	I'll go into some technical details about what we're proposing to do
1308550	1311030	which is to make a modem, a modulation scheme
1311030	1313890	that will allow you to pass data undistorted
1313890	1316830	and cryptographically secured voice data through this channel
1316830	1318810	without having it flip bits.
1321390	1323510	There was a group in England, we discovered
1323510	1325490	that is doing the very same thing.
1325750	1330250	They've managed to get a 1200 bit per second link
1330250	1333870	over GSM using a similar scheme.
1334310	1335250	Basically what they do
1335250	1337850	they take their input encrypted voice
1337850	1340850	which is encoded at 1200 bits per second
1340850	1342670	which kind of sounds like a speak and spell
1342670	1347030	it goes through basically a codebook lookup system
1347030	1349050	where it has a list of waveforms
1349050	1350930	that will actually pass through the channel correctly
1351690	1355130	and it will synthesize speech based on some of those parameters.
1355450	1357250	It's a relatively simple approach
1357250	1360230	they're exploiting the fact that speech has very specific
1361090	1363230	qualities and parameters that you can
1365290	1368250	readily... the channel is able to
1368250	1370450	distinguish between those different things.
1371130	1372630	Our system is very similar
1372630	1376390	we're going to try to take what
1376910	1378850	they've done a certain thing, they've taken these parameters
1378850	1382170	they've synthesized things, we want to figure out a better way
1382170	1384630	to characterize the voice channel itself
1384630	1387490	and see if we can come up with a higher bit rate
1388170	1391090	we've decided that 2400 bit per second audio
1391090	1393990	is much better than 1200 bit per second audio
1393990	1397570	so much so that it's worth investigating how to make that happen.
1398470	1400610	And again, there's our proposed system block diagram
1402190	1403850	and this is a
1403850	1406730	high level diagram about the flow of data through the system
1406730	1409730	so you have a microphone at one end that's going into
1409730	1412150	an analog to digital converter
1412150	1414590	so you get your audio samples
1414590	1418090	you put that through a speech compression routine
1418090	1422010	and the output of that is the 2.4 kilobits per second
1422010	1423830	and you run that through some kind of crypto
1423830	1425930	and we're proposing AES block cipher
1426620	1429550	and run that through an error-corrective coding
1429550	1432910	I said more details on that later
1432910	1435890	and an error-corrective coding which basically means that
1435890	1438910	you can encode the data in such a way that if there are errors
1438910	1441390	on the channel, based on either
1441390	1444350	through the distortion of the GSM voice channel or
1444350	1446610	dropped frames over the air
1446610	1449570	as if you go through a tunnel or inside a building
1449570	1453370	it'll be able to correct those errors or at least detect them
1453370	1456870	and finally going through the modem that we're proposing to develop
1457590	1460050	that'll generate valid speech waveforms
1460050	1461030	that'll work over the channel
1463470	1465870	and those are fed through directly into the
1466770	1468690	speech codec on the GSM phone
1468690	1471330	and they go through to the decoder on the other side
1471330	1473030	which is basically the thing in reverse
1478230	1479530	this is showing
1480530	1490350	Let's do the demo first. I'm going to demonstrate some of the... basically using a simple
1490350	1495250	approach to the problem, trying to determine how the GSM voice channel will corrupt the
1495250	1500670	data that you pass through it. So what we're proposing is using the voice channel against
1500670	1507310	itself, using the speech decoder as the modulator and the speech encoder as the demodulator.
1507310	1515330	So we're going to fill the speech frame up with random bits and see how that will perform
1515330	1540860	over the channel and see what distortions happen. All right. This is another Simulink
1540860	1546260	model that we've thrown together that shows in the middle of this block right here is
1546260	1554440	the speech channel itself. And we're proposing to use the voice codec of GSM against itself,
1554440	1557900	the decoder is put on one side, and we're going to fill the frames up with random data
1557900	1569690	and see what happens on the other side. This is what it looks like on the output. Again,
1569690	1574550	this is random. We're filling the frames up randomly, and it's generating what looks like
1574550	1579650	valid speech information. It looks a lot like what we saw earlier as far as what the time
1579650	1590640	domain signal looks like. This scope shows the bit error rate through the channel. I'll
1590640	1595760	run this one more time so you can see it settling. It's taking the average bit error along the
1595760	1603220	X axis is the bit position inside of the frame, and into the page is the frame number, and
1603220	1612320	the amplitude is the number of bits that were flipped on average. Let's run this again.
1613260	1628940	Oh, it's very angry at me. I don't even know what that means. Anyway, the point being the
1628940	1633420	bit error rate settles to about 25%. One bit out of four is flipped when you put it through
1633420	1638800	using a rudimentary system like this. We propose that our research will continue as far as
1638800	1643420	developing a scheme that is able to pass a high bandwidth amount of data through that's
1643420	1650260	acceptable speech quality that will minimize that. 25% is far too high to pass meaningful
1650260	1658460	data through. MATLAB for Mac is not very good either, by the way. A side note on that,
1658460	1663120	there's a free MATLAB. I don't know if you guys know about Octave. It's basically MATLAB
1663120	1670680	minus the $100,000 fee. It's available online. You can search Google for Octave.
1675720	1680400	Thank you, Mr. Tanner. I want to take a slight segway for a second and go back to what he
1680400	1687580	was saying about 3G solving this issue. I think it will solve some of the issues, but
1687880	1698140	if you can purchase a data channel that is high bandwidth and low latency to do voice
1698660	1704720	over IP off a regular cell phone, that kind of cuts into the market that cell phone providers
1704720	1710080	have today. And I'm kind of worried that they might take steps to prevent that, but we'll
1710080	1716100	see when they actually start properly rolling things out. Here we have our network stack,
1716100	1723140	on the top, the voice channel, which is a low bit rate voice encoder, 2.4 kilobits per
1723140	1730120	second. The secure channel, which we'll go into in just a moment. The modulated data
1730120	1739120	channel, which is the voice modem and the ECC. And those are all on top of the GSM voice
1739120	1747620	channel and, of course, the GSM network. Otherwise the bits wouldn't go anywhere. Channel
1747620	1755320	expectations. We had to make some decisions and do some research on what we could expect
1755320	1761340	the lower levels to behave like. Detected and fixed bit corruption will be common.
1761340	1767640	Undetected bit corruption will be rare, but we'll deal with that. Undetected frame loss
1768520	1774580	depends on network quality and is reasonably common. You most likely hear dropped frames
1774580	1781220	during your cell phone conversations all the time. We hope to have no undetected frame
1781220	1789660	loss. As I said, frame loss and undetected bit corruption will produce gobbled speech,
1789660	1794860	which is pretty much similar to what you hear nowadays. So it's what cell phone users are
1794860	1805750	used to and is an acceptable error state. So our threat model. Who are we trying to
1805750	1813070	protect against? Of course, industrial espionage, foreign governments, anyone with $10,000
1813070	1821650	worth of equipment, and, of course, TLAs. Those damn TLAs. Three letter agencies, not
1821650	1826970	acronyms. What are we trying to protect against? Break of our privacy, loss of
1828050	1835470	confidentiality, break of authentication, loss of integrity. The threats in our threat model
1835470	1841950	are dropped frames, frame replay, frame bit corruption, partial frames, and, of course,
1841950	1851630	cryptographic attacks. So dropped frames, as I said earlier, we should be able to
1851630	1858690	deal with as we can detect and increment our counters for that. Frame replay will either
1858690	1865870	break the GSM, will either upset the GSM stack and break the call or will corrupt the
1865870	1871410	cryptographic channel, which will end up with an error state like the one we were talking
1871410	1878290	about moments ago. Bit corruption will just add slight blurbs or gobbled speech, which
1878290	1883890	shouldn't exactly deviate much from the error state as well. Partial frames will be
1883890	1888990	interesting. Probably end up corrupting the call as well or hopefully getting the GSM
1888990	1895550	call dropped. We're currently looking into that. Cryptographic attacks, those are the
1895550	1901910	fun ones, of course. We're hopefully picking strong enough crypto and strong enough
1902490	1909490	protocols so that these can be avoided. Of course, these are all closed source protocols.
1909490	1918250	I'm just kidding. Channel availability. Increasing the availability of GSM calls is really
1918250	1924290	kind of outside the scope of this project. It is ridiculously trivial to block GSM voice
1924290	1930790	channels, as you probably noticed from being inside casinos and getting no service. You
1930790	1936090	can purchase cell phone jammers, a lot of places have, for not too much money. You can
1936090	1942790	corrupt frames over the wire. You'd have to be a TLA to do that, probably. And you can also
1942790	1947830	just request from the service operator disables the voice channel or disables the account
1947830	1955550	altogether. So as you can see, it's not really practical for us to attempt to increase
1955550	1963370	availability of the voice channel. We're hoping, and it seems that channel will not
1963370	1969770	significantly decrease. The availability of the calls will not significantly decrease using
1969770	1977970	our scheme. Which is good. Secure channel. Secure channel provides voice privacy. It does not
1977970	1984210	provide message authentication. The reason being is we're working with a reasonably low
1984210	1990610	bandwidth and we don't have space for Macs or anything like that, sadly. So we're relying on
1990610	2001030	the authentication in the key exchange. And any manipulation of the data going over the air
2001030	2008810	will cause gobbled speech and will not break the cryptographic channel. Here is a wonderful
2008810	2014630	diagram of the initiation of the secure channel. Dig Helman, variable key size, being
2014630	2022710	hashed into our session key, into a send and receive key, and our two counters. Which you'll
2022710	2030750	see more of later. Here is a general diagram of our encryption model. This is for send, of
2030750	2038790	course. Session key is generating a send key through SHA, which is then used with AES and
2038910	2044830	a counter mode with our send counter. And I said before, when a frame is dropped, we will
2044830	2051230	have to increment the counter to stop from destroying the entire secure channel. Once the
2051230	2057730	key stream is generated, that is XORed with the voice data, which creates our cyber text,
2057730	2063150	which is passed off to the voice modem, the modulated data channel. There is many more
2063150	2069310	details in the white paper, which is available on the web page. Key exchange, we're
2069310	2074610	utilizing Ferguson Schneier key negotiation protocol, because it is a wonderfully strong
2074610	2081430	design. I like what Schneier and Ferguson have done. And the key size is flexible, which is
2081430	2086790	extremely key in this situation. We have two ends of this. We can have extremely limited
2086790	2092510	hardware, having a Bluetooth headset that's doing the voice encryption for you.
2092510	2099050	Extremely lightweight, and we need to save as much... use minimal CPU processing as
2099050	2102610	possible. And we have another end where you're running this on your laptop over your
2102610	2109190	generic landline. Not that any of you have a generic landline. So we want to have the
2109190	2115770	flexibility that that entails. The second choice was stationization protocol. I
2115770	2120560	definitely like the fact that you can encrypt the signatures in stationization, but it
2120560	2127660	lacks the key size flexibility, which really kind of killed it for me. Thanks for deleting
2127660	2142180	that slide, Wes. No problem. Oh, boy. Here's the key exchange. As described earlier, Alice
2142180	2146000	generating... I'm not even going to go into that. You can read details of that in the white
2146000	2150540	paper. I do want to make a comment on authentication. Most of the products and
2150540	2162860	the one even detailed by Zimmerman rely on you reading a section of text back over the
2162860	2168060	phone line to the other person to make sure the Diffie-Hellman key did not break. Sorry,
2168060	2173100	there was a man-in-the-middle attack on the Diffie-Hellman key exchange. I don't like
2173100	2180520	that. Not on a channel where you only have 2.4 kilobits of voice data going over. I
2180540	2189560	think the possibility of someone being able to spoof what your friend's voice sounds like on a
2189560	2197840	channel that's that low bitrate is quite possible, and that kind of scares me. So we're
2197840	2207060	attempting to use DSA for authentication rather than relying on the person reading the
2207060	2212980	keys back... sorry, reading the hash of the keys back over, which really kind of scares me.
2212980	2222440	Also, I think Cryptophone, G10 and the other products do that. They have better voice...
2223060	2229280	they have a higher bitrate voice encoding, which should make that not as easy an attack, but
2229280	2234480	it's still definitely possible, and that really kind of disturbs me. Conclusions and
2234480	2242700	questions? Also, if you have any questions via e-mail, we are available at info at
2242700	2248420	cellularcrypto.com, where the slides and all the other MATLAB code and Simulink code are for
2248420	2254120	your viewing pleasure. Also, the white paper will be up there momentarily, when I can
2254120	2264460	actually get onto the network. To reiterate, the point of this is to create a generic system
2264480	2270220	scheme. It will work over any type of voice link. It happens to be that GSM is pretty difficult
2270220	2275420	due to the large amount of compression. So if it works over GSM, it will work over anything
2275420	2287420	else. That's the idea, and that's what we are trying to do. Also, we only had about 50 minutes
2287420	2291700	to do this, and we had a lot of technical information that we had to gloss over, but
2292800	2299340	hopefully the point got across. It was hard for us to frame this in a way that people could
2299340	2303980	understand, just based upon the fact that a lot of it has to do with voice channel stuff.
2304280	2313860	It covers two areas, very complex GSM voice channel analysis and a voice modem, and then it
2313860	2318020	covers the cryptography. We attempted not to go into too much detail, but you can read the
2318020	2324300	majority of that on the white papers. We got a question, but we probably need a mic.
2336160	2357640	I'm not familiar with DECA. You, sir. We just tried, just for the demonstration purposes, a
2359300	2363320	test modem, basically just using the maximum amount of bits in that channel. If we were
2363320	2368700	sending data at the 13 kilobits per second, if you send data at 13 kilobits per second, you get
2368700	2377280	25% bit error. We need to generate a modem that is much more resilient to the distortion
2377280	2390790	involved. That probably implies using a lot less of the bandwidth available. Go ahead. No,
2390790	2395930	it's a work in progress. Yeah, we have not actually developed a 2.4 kilobit per second modem
2395930	2402250	as of yet. It's an ongoing process. We basically built the models to work on that kind of
2402250	2410190	design. We're at that point at the moment. Yes, we hope to have something that's usable.
2411470	2416210	Hopefully my graduate program will allow me to discover this stuff further and give me some
2416730	2425910	amount of funding. Good plan. Any more questions from the audience? You, sir.
2425930	2452970	In the back. I believe the question is, in our random test, how many bits were preserved?
2467160	2472260	We have a 25. If you use the entirety of the bits of the GSM frame and you twiddle those
2472260	2478120	randomly, you get one bit flipped out of every four. Those errors are basically distributed
2478120	2483040	evenly across the frame. There are some bits that are more persistent. They will stay. They will
2483040	2488680	not be as flipped as readily. For the most part, they are evenly distributed. I don't know if
2488680	2497280	that answers your question. Excellent. Any more questions? Closed. If anyone wants to talk
2497280	2505220	to us, we'll be in the bar for the rest of the week. Thank you. You've been a wonderful audience.
2505220	2511540	We love you. Especially you right there, lumpy lump. And Simon Cooper.
2513100	2515240	Fad. Total fad.
2516000	2517160	How's it going, mate?