Specifically talking about walkie talkie radio networks. Suppose there is a grou

Question

Specifically talking about walkie talkie radio networks. Suppose there is a group of up to 16 persons, each equipped with such a unit. Typically, one person will be talking with one another (one-to-one), or one person will be broadcasting to all the others members (one-to-all). The goal is to secure and authenticate all the communication between them.

I thought about the following:

1) Each user will have a predefined public/private key (e.g. RSA). 2) There will be a predefined symmetric key (e.g. AES-128 bit).

Voice streams will be divided into 128-bit segments. Each segment will first be encrypted using AES 128, then hashed using SHA-256, and the hash will be encrypted using user's private key, and this signature will be sent along with the encrypted message. The reciever will first hash the message, and then decrypt the signature using any of the 16-1 public keys he have. Ideally, one of them will 'work', authenticating the message. Then he proceed to decrypt the message.

Is there any "clear" vulnerability in this protocol?

P.S. I am aware of other used protocols, e.g. P25, but will prefer to implement my own.

Explanation / Answer

Signing each block of ciphertext will create a massive overhead and after all result in a slow transmission of the voice recorded.

Your protocol does not involve correct authentication. The use of a fixed AES key and no IV (appearently) leaves very much room for an attacker to forge messages or to evasdrop the plaintext. Make sure to authenticate before sending (and verify the signature of one entire message, e.g. 1/2 second of audio), use a protocol such as Diffie-Hellman to agree on a shared key and use a sufficient Block-Chaining as well as an IV.

If you plan to use this protocol with acutal walkie talkies you have to consider that fixed private/public keys can only be used for one set of units and that this set of units is not expandable (since crypto walkie talkies that require the customer to read/write the keys would not be used somewhere else than in e.g. the army).

Related Questions

Navigate

• Browse (All)
• Browse S
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.