GSM Security

GSM security goals and analog 1G limitations

Early analog 1G networks transmitted calls as unencrypted radio signals. A basic scanner could receive a private call, and a fraudster could clone a phone's identity and charge calls to another subscriber. This lack of protection was a basic weakness of those systems: it offered neither call privacy nor reliable subscriber identification.

GSM designers recognized that an international digital standard needed to build user trust. Security became part of the architecture, and GSM mechanisms were designed around three primary goals:

1. Authentication: To prove that the user is a legitimate subscriber and has the right to access the network. This prevents unauthorized use and phone cloning.
2. Confidentiality: To ensure that conversations and data transmitted over the airwaves are kept private and cannot be eavesdropped on by unauthorized parties.
3. Anonymity:To protect the user's identity, preventing them from being easily tracked by monitoring radio transmissions.

The Core Mechanisms of GSM Security

The GSM security framework rests on the interaction of three mechanisms: a secret key stored on the SIM card, a family of cryptographic algorithms, and a challenge-response procedure.

• The Secret Subscriber Key $(K_i)$: This is a 128-bit secret number unique to each subscriber. One copy of $K_i$ is securely stored in the subscriber's SIM card, and a second copy is stored in a highly protected database on the network side, called the Authentication Center (AuC). This key is the basis for authentication and ciphering, and the design keeps it off the radio network.
• Cryptographic algorithm families (A3, A8, A5): GSM uses cryptographic functions with distinct roles. The concrete A3, A8, and A5 implementations depend on the agreed version and operator configuration.
  • $A3$: the subscriber authentication function.
  • $A8$: the function for generating the session ciphering key.
  • $A5$: a family of algorithms for ciphering radio data and signalling.
• Challenge-Response Mechanism: Instead of sending a password over the air, which could be intercepted, GSM uses a "challenge-response" procedure. The network sends the phone a random, unpredictable "challenge," and the phone must provide the correct "response." Only a device possessing the secret key, $K_i$, can calculate the correct response to the challenge.

Analysis 1: Authentication - "Are You a Legitimate Subscriber?"

The authentication process is the first security check a phone must pass before it's allowed to make or receive calls. Its purpose is to verify that the SIM card is genuine and belongs to an authorised subscriber.

The procedure unfolds as follows:

1. The Challenge: The network's Authentication Center (AuC) prepares an authentication vector containing a 128-bit random number called the RAND, the expected SRES, and the $K_c$ key. The VLR or MSC selects RAND from that vector and sends it over the air to the Mobile Station (MS).
2. Computation on Both Sides: The phone computes a response to the received RAND, while the network uses the value calculated earlier by the AuC:
   • On the Phone Side (SIM): The SIM card receives the RAND from the network. It takes this RAND and its own secret, securely stored subscriber key, $K_i$, and feeds them both into the authentication algorithm, $A3$. The algorithm processes these two inputs and produces a 32-bit output called the Signed Response, or SRES.
   • On the Network Side (AuC and VLR/MSC): The AuC computes the expected SRES from $RAND$ and the subscriber's $K_i$, then sends the RAND/SRES pair and $K_c$ to the VLR or MSC. The VLR or MSC stores the expected SRES for comparison with the MS response.
3. The Response: The Mobile Station sends its calculated SRES back to the network.
4. The Verification: The VLR or Mobile Switching Center (MSC) now has two SRES values: the one it received from the phone and the one previously supplied by the AuC. It compares them.
   • If the two SRES values match perfectly, the authentication is successful. The network accepts the response as matching the subscriber because only the genuine SIM card with the correct $K_i$ could have produced the correct response to the random challenge.
   • If the SRES values do not match, the authentication fails, and the network denies the user access, preventing fraud.

Analysis 2: Confidentiality - Generating and Using the Encryption Key

Once the user's identity is verified, the next step is to secure the actual conversation. GSM protects the confidentiality of voice and data by encrypting the radio link between the mobile phone and the base station. This prevents anyone from listening in with a scanner. The key to this process is creating a temporary ciphering key for the session.

Analysis 3: Anonymity - Temporary Identifiers and Their Limits

The third security mechanism limits exposure of user identity. Continuously broadcasting a user's permanent identity (IMSI) over the air would make it easy to track that user's movements and activity. GSM limits this risk by using temporary identifiers.

When a phone registers in a new location area, the VLR assigns it a Temporary Mobile Subscriber Identity (TMSI). This TMSI is a temporary alias that has meaning only within the current location area. From that point on, routine communications such as initiating a call or responding to a page identify the phone with the TMSI, keeping the permanent IMSI outside these messages. The TMSI is periodically changed by the network, making it very difficult for an outside observer to link radio transmissions to a specific individual over an extended period. The real IMSI remains a fallback identifier, used for example during first registration with a VLR or after loss of the TMSI context, so the mechanism does not provide complete anonymity.

Strengths and Weaknesses of GSM Security

For its era, GSM security provided protection far superior to earlier analogue cellular systems. As technology advanced and security analysis became more sophisticated, several weaknesses were identified.