1、ETSI ES 202 109 1.1.1 (2003-01) ETSI Standard Terrestrial Trunked Radio (TETRA); Security ; Synchronization mechanism for end-to-end encryption 2 ETSI ES 202 109 VI .I .I (2003-01) Reference DES/TETRA-06081 Keywords air intetface, data, DMO, security, speech, TETRA ETSI 650 Route des Lucioles F-O692
2、1 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 O0 Fax: +33 4 93 65 47 16 Siret No 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-prfecture de Grasse (06) No 7803/88 Important notice Individual copies of the present document can be downloaded from: http:lwmv.ets
3、i .arq The present document may be made available in more than one electronic version or in print. In any case of existing or perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF). In case of dispute, the reference shall be the printing o
4、n ETSI printers of the PDF version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at ha p:/pa rta
5、 I. etsi I a rgltbistat uslstatus .as p If you find errors in the present document, send your comment to: Cori vriaht Notifica tion No part may be reproduced except as authorized by written permission. The copyright and the foregoing restriction extend to reproduction in all media. O European Teleco
6、mmunications Standards Institute 2003. All rights reserved. DECTTM, PLUGTESTSTMand UMTSTMare Trade Marks of ETSI registered for the benefit of its Members. TIPHONTM and the TIPHON logo are Trade Marks currently being registered by ETSI for the benefit of its Members. 3GPPTM is a Trade Mark of ETSI r
7、egistered for the benefit of its Members and of the 3GPP Organizational Partners. ETSI 3 ETSI ES 202 109 VI .I .I (2003-01) Contents Intellectual Property Rights . .4 Foreword . 4 Introduction . .4 1 2 3 3.1 3.2 4 4.1 4.2 4.2.1 4.3 4.4 4.4.1 4.4.2 4.4.3 4.4.4 4.4.5 4.5 4.6 Scope 5 References . .5 De
8、finitions and abbreviations. . .5 Definitions . 5 Abbreviations . . 6 Introduction 7 Voice encryption and decryption mechanism . 7 Protection against replay. 8 Data encryption mechanism . 8 Exchange of information between encryption uts 9 Synchronization of encryption units 9 Encrypted information b
9、etween enc 10 Transmission . . 10 Reception . 12 Stolen frame format . 12 e . 13 . 15 End-to-end encryption . .7 Location of security components in the End-to-end Key Management . Annex A (informative): Bibliography . 16 History 17 ETSI 4 ETSI ES 202 109 VI .I .I (2003-01) Intellectual Property Righ
10、ts IPRs essential or potentially essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR O00 314: “Intellectual Property Rights (7PRs); Essential,
11、 orpotentially Essential, IPRs notlJied to ETSI in respect ofETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (5). All published ETSI deliverables shall include information which directs the reader to the above source of information.
12、Foreword This ETSI Standard (ES) has been produced by ETSI Project Terrestrial Trunked Radio (TETRA). I n t rod uct ion The present document replaces the end-to-end encryption clause in each of EN 300 392-7 and ETS 300 396-6. ETSI 5 ETSI ES 202 109 VI .I .I (2003-01) 1 Scope The present document def
13、ines the Terrestrial Trunked Radio system (TETRA) synchronization operation for end-to-end encryption algorithms that employ streaming ciphers for voice. The method defined applies equally to Direct Mode Operation (as defined in EN 300 396 (see bibliography) and to Trunked Mode Operation (as defined
14、 in EN 300 392 (see bibliography). 2 Re fe re nces The following documents contain provisions which, through reference in this text, constitute provisions of the present document. References are either specific (identified by date of publication andor edition number or version number) or non-specifi
15、c. For a specific reference, subsequent revisions do not apply For a non-specific reference, the latest version applies. Referenced documents which are not found to be publicly available in the expected location might be found at p. il ETSI EN 300 392-2: “Terrestrial Trunked Radio (TETRA); Voice plu
16、s Data (V+D); Part 2: Air Interface (AI)“. IS0 7498-2: “Information processing systems - Open Systems Interconnection - Basic Reference Model - Part 2: Security Architecture“. ETSI ETS 300 395-1: “Terrestrial Trunked Radio (TETRA); Speech codec for full-rate traffic channel; Part 1: General descript
17、ion of speech functions“. 21 31 3 3.1 Definitions and abbreviations De fi nit ions For the purposes of the present document, the following terms and definitions apply: cipher key: value that is used to determine the transformation of plain text to cipher text in a cryptographic algorithm cipher text
18、: data produced through the use of encipherment NOTE: The semantic content of the resulting data is not available (IS0 7498-2 2). decipherment: reversal of a corresponding reversible encipherment (IS0 7498-2 2) encipherment: cryptographic transformation of data to produce cipher text (IS0 7498-2 2)
19、encryption state: encryption on or off end-to-end encryption: encryption within or at the source end system, with the corresponding decryption occurring only within or at the destination end system flywheel: mechanism to keep the KSG in the receiving terminal synchronized with the Key Stream Generat
20、or (KSG) in the transmitting terminal in case synchronization data is not received correctly Initialization Value (IV): sequence of symbols that initializes the KSG inside the encryption unit key stream: pseudo random stream of symbols that is generated by a KSG for encipherment and decipherment ETS
21、I 6 ETSI ES 202 109 VI .I .I (2003-01) Key Stream Generator (KSG): cryptographic algorithm which produces a stream of binary digits which can be used for encipherment and decipherment NOTE: The initial state of the KSG is determined by the initialization value. Key Stream Segment (KSS): key stream o
22、f arbitrary length plain text: unencrypted source data NOTE: The semantic content is available. proprietary algorithm: algorithm which is the intellectual property of a legal entity synchronization value: sequence of symbols that is transmitted to the receiving terminal to synchronize the KSG in the
23、 receiving terminal with the KSG in the transmitting terminal synchronous stream cipher: encryption method in which a cipher text symbol completely represents the corresponding plain text symbol NOTE: The encryption is based on a key stream that is independent of the cipher text. In order to synchro
24、nize the KSGs in the transmitting and the receiving terminal synchronization data is transmitted separately. time stamp: sequence of symbols that represents the time of day 3.2 Abbreviations For the purposes of the present document, the following abbreviations apply: AI CK C-plane CT DMO EKSG EKSS F
25、 HSC HSI HSN HSS HSSE IV KSG KS S L1 L2 L3 MAC MS PT SAP SHSI STCH sv T/DMA-SAP T/DMC - SAP T/DMD-SAP TMD-SAP DMD-SAP Tx U-plane V+D Air Interface Cipher Key Control-plane Cipher Text Direct Mode D Service Access Point Direct Mode Operation End-to-end Key Stream Generator End-to-end Key Stream Segme
26、nt Function Half- Slot Condition Half- Slot Importance Half- Slot Number Half- Slot Stolen Half-Slot Stolen by Encryption unit Initialization Value Key Stream Generator Key Stream Segment Layer 1 Layer 2 Layer 3 Medium Access Control Mobile Station Plain Text Service Access Point Stolen Half-Slot Id
27、entifier Stolen Channel Synchronization Value Trunked or Direct Mode A Service Access Point Trunked or Direct Mode C Service Access Point Trunked or Direct Mode D Service Access Point Trunked Mode D Service Access Point Transmit User-plane Voice + Data ETSI 7 ETSI ES 202 109 VI .I .I (2003-01) 4 E n
28、d-to-e n d en crypt i on 4.1 I n trod u ction End-to-end encryption algorithms and key management are outside the scope of the present document. This clause describes a standard mechanism for synchronization of the encryption system that may be employed when using a synchronous stream cipher. The me
29、chanism also permits transmission of encryption related and other signalling information. The mechanism shall apply only to U-plane traffic and U-plane signalling. The method described uses the Stealing Channel, STCH, for synchronization during transmission (see EN 300 392-2 i, clause 23.8.4). NOTE:
30、 This mechanism does not apply for self-synchronizing ciphers, or for block ciphers. The following are requirements on the end-to-end encryption mechanism: - - - - the same mechanisms shall apply in both directions; the synchronization processes shall be independent in each direction; end-to-end enc
31、ryption shall be located in the U-plane (above the MAC resident air-interface encryption); transport of plain text and cipher text shall maintain the timing and ordering of half-slot pairing (half slots shall be restored in the same order and with the same boundary conditions at each end of the link
32、); the encryption mechanisms described in this clause are valid for one call instance. - 4.2 Voice encryption and decryption mechanism Figure 1 shows a functional diagram of the voice encryption and decryption mechanism based on the synchronous stream cipher principle. This demonstrates the symmetry
33、 of transmitter and receiver with each side having common encryption units. It is assumed that the encryption unit shall generate a key stream in a similar way to the AI encryption unit. The encryption unit is then termed the End-to-end Key Stream Generator (EKSG). EKSG shall have two inputs, a ciph
34、er key and an initialization value. The initialization value should be a time variant parameter (e.g. a sequence number or a timestamp) that is used to initializes synchronization of the encryption units. The output of EKSG shall be a key stream segment termed EKSS. Function F, shall combine the Pla
35、in Text (PT) bit stream and EKSS resulting in an encrypted Cipher Text (CT) bit stream. Function F,-l shall be the inverse of F, and shall combine the bit streams CT and EKSS resulting in the decrypted bit stream PT. Function F, shall replace a half slot of CT with a synchronization frame provided b
36、y the “sync control“ functional unit. Function F, shall recognize a synchronization frame in the received CT, and shall supply them to “sync detect“ functional unit. ETSI 8 ETSI ES 202 109 VI .I .I (2003-01) Synch Control EKSG Synchronization frame Figure 1 : Functional diagram of voice encryption a
37、nd decryption mechanisms Associated with the functional mechanism shall be a crypto-control interface that shall allow the following: - - - selection of CK by use of a key selection value; selection of algorithm by use of an algorithm number; selection of encryption state (odofI). 4.2.1 Protection a
38、gainst replay Protection against replay should be obtained by use of a time variant initialization value or a similarly time variant cipher key. Possible examples for a time variant initialization value are a timestamp or sequence number. Time variance of the cipher key may be achieved by deriving a
39、 key for each encrypted call. The manner in which time variance is achieved is not addressed by the present document. Recording and replaying of an entire call can be prevented by use of additional data. For example a shared call-id range, or a shared real time clock, that validates messages may be
40、used. Means of protecting against call replay are outside the scope of the present document. 4.3 Data encryption mechanism Encryption of circuit mode data preferably should be implemented in the application requiring transport of data. However encryption of circuit mode data may also be achieved by
41、using the voice encryption mechanism. Using the voice encryption mechanism can only gain confidentiality. In order to achieve data integrity other precautions should be taken. NOTE: Any frame stealing will result in loss of some user application data and alternative mechanisms for recovery of the da
42、ta should be taken. ETSI 9 ETSI ES 202 109 VI .I .I (2003-01) Half slot content 4.4 Exchange of information between encryption units M M Two different cases shall be identified by an appropriate MAC header (see clause 4.4.2): - - encrypted information. synchronization information in clear; or The us
43、e of exchanged encrypted information between encryption units is out of the scope of the present document. Half slot position (HSN) 4.4.1 Synchronization of encryption units Figure 1 shows the processing blocks “synchronization control“ and “synchronization detect“ and their associated functions F,
44、and F, that shall provide the means of synchronizing the EKSG. C C IlSt half slot or 2nd half slot There shall be two synchronization cases to consider: - initial synchronization; and - re-synchronization. NOTE: Late entry may be considered a special case of re-synchronization. Both cases shall use
45、frame stealing as a means of inserting synchronization data in the traffic path. Occurrence of stealing in the receiver shall be locally reported to the U-plane application at the TMD-SAP in TETRA V+D and at the DMD-SAP in TETRA DMO. In each case the primitive shall be of type UNITDATA. Table 1 show
46、s the DMD-UNITDATA primitive (for DMO) that shall be used by the frame stealing mechanism to address the MAC (request) and to inform the U-plane (indication). The parameters in the TMD-UNITDATA primitive in TETRA V+D are identical and are not repeated here. Stolen indication (HSS) Table 1: Parameter
47、s used in the DMD-UNITDATA primitive M M INot Stolen, Stolen by C-plane, or Stolen by U-plane I Parameter I Reauest I Indication I Remark I Half slot condition (HSC) I M IGOOD, BAD, NULL IHalf slot imDortance (HSI I M I IMav be defined as: No imDortance. Low. Medium or Hiah I Parameter Half slot syn
48、chronization Report Circuit Mode information Indication Remark O O M Table 2 shows the parameters of the DMD-REPORT primitive that shall be used for any further communication from MAC to the U-plane. The parameters in the TMD-REPORT primitive in TETRA V+D are identical and are not repeated here. Tab
49、le 2: Parameters used in the DMD-REPORT primitive The transfer of synchronization data shall be achieved by stealing speech frames (half-slots) from the U-plane traffic. Synchronization frames shall be transmitted as individual half-slots via STCH for initial as well as for re-synchronization. A half-slot stolen (HSS) indication shall be associated with each speech frame of a pair making up a transmission slot. The valid combinations shall be: - neither half-slot stolen; - fiist half-slot stolen; ETSI 10 ETSI ES 202 109 VI .I .I (2003-01) - both half-slots stolen; - sec
