gmane.science.cryptography.a51

reflextor files reuploaded

zero uncool — 2013-05-31T19:18:24

Folks,

It looks like a few files that used to be available on reflextor.com are no
longer present. So I've reuploaded them on Google Drive.

Original a51_table_torrents.tgz (still active):
https://docs.google.com/file/d/0B0qU_6hXMacZMnJkREdxWDZfdzA/edit?usp=sharing

Original vf_call6_a725_d174_g5_Kc1EF00BAB3BAC7002.cfile demonstration
capture (see https://srlabs.de/airprobe-how-to/):
https://docs.google.com/file/d/0B0qU_6hXMacZVEptMnlkeklBUEk/edit?usp=sharing

A recent version (late 2012) of tmto-svn:
https://docs.google.com/file/d/0B0qU_6hXMacZLURkN2RSRURBcnM/edit?usp=sharing

This thesis is worth reading as it presents a fairly complete picture of
the state of the art:
https://docs.google.com/file/d/0B0qU_6hXMacZVS1nQmFteUVheGM/edit?usp=sharing

I wish I had a copy of the wiki... does anybody?

Please note, the kraken git is still available at git://
git.srlabs.de/kraken.git

UCZ
_______________________________________________
A51 mailing list
A51-9cLeXjskusuFzESapgPWAg< at >public.gmane.org
http://lists.srlab

Re: New here

Thomas C — 2013-05-29T17:16:26

My bad, the Kraken git seems to contains everything that I need :)

Nevertheless I'm missing the wiki explanations that were on reflextor, as
the wiki at srlabs seems to be way lighter.
I'll go through the mailing list for more information on specific utilities
but is there any chance to retrieve the "old" reflextor wiki pages ?

Thanks again,
Tom.


On Wed, May 29, 2013 at 12:42 PM, Thomas C <tom.apero-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org> wrote:

_______________________________________________
A51 mailing list
A51-9cLeXjskusuFzESapgPWAg< at >public.gmane.org
http://lists.srlabs.de/cgi-bin/mailman/listinfo/a51

New here

Thomas C — 2013-05-29T10:42:42

Hi guys,

I am new here and have gone through a lot of the archives but could not
find an answer to my question.
I have downloaded the torrents for the rainbow tables but I have a slow
connection and there seems to be very few seders left nowadays.
Torrent client estimates that it will take more than one year to get only
the first table at this pace !

So the question is, would be possible to have access to the program that
generated the latest "ATI" tables and short explanation of parameters
(ideally with the Excel that allows to measure TMTO choice and impacts) ?
I figure that if you guys computed the tables in one month back then, I
could achieve similar results with my hardware which will be great :)
Plus I would be very intersted to dig in how this rainbow table work and
what better than to try it by myself.
It seems that most of it (complete wiki + sources) was hosted on reflextor
but is not available anymore ?

Thanks again for your help,
Tom.
_______________________________________________
A51 mailin

Re: GSM-Analyzer

Georg Hofstetter — 2013-05-27T22:02:55

Hi,

that hardware is built by a friend and a bit too expensive for normal use.

BR,
Georg

Re: GSM-Analyzer

MLO — 2013-05-27T21:12:18

Georg,


This is much appreciated.

What are you planning on doing with the SDR device you've created awhile
ago?

I am interested in that too!

:-)

Sincerely,






On Mon, May 27, 2013 at 4:01 PM, Georg Hofstetter <a5-mEnASQE5oGQ< at >public.gmane.org> wrote:

_______________________________________________
A51 mailing list
A51-9cLeXjskusuFzESapgPWAg< at >public.gmane.org
http://lists.srlabs.de/cgi-bin/mailman/listinfo/a51

GSM-Analyzer

Georg Hofstetter — 2013-05-27T21:01:34

Hello everyone.

Finally i decided to release the source code of my GSM-Analyzer to the
public. Feel free to use it in your projects. But please inform me about
what you use it for.

I wont release a binary, so please build it yourself.
If you cannot compile it, maybe you are the wrong one for this tool ;)

http://www.g3gg0.de/wordpress/uncategorized/gsm-source-code-of-rx-fft-and-gsm-analyzer/

It is capable of reading .cfile files from USRP.

Best Regards,
g3gg0

Re: kraken with 5970 (2 GPU)

Dinos Pastos — 2013-05-14T11:52:22

Have your split the tables on multiple disks?


On Tue, May 14, 2013 at 2:50 PM, Bert Boshe <bertboshe-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org> wrote:

_______________________________________________
A51 mailing list
A51-9cLeXjskusuFzESapgPWAg< at >public.gmane.org
http://lists.srlabs.de/cgi-bin/mailman/listinfo/a51

kraken with 5970 (2 GPU)

Bert Boshe — 2013-05-14T11:50:38

Hi!

When i crack a burst with the Radeon HD 5870 (1GPU) it is faster
than using the Radeon HD 5970 (2GPU).

I expected the the HD 5970 doíng the job in half of the time.

Can anyone tell me what is wrong?

See the following:


RADEON HD 5870
====================================================================================================================================================
Kraken> Initialized CAL
CAL Runtime version 1.4.1741
Running on 1 GPUs
Num threads 1152
Running 256 rounds pr kernel invocation.
test

Cracking
001101110011000000001000001100011000100110110110011011010011110001101010100100101111111010111100000110101001101011
Found de6bb5e60617f95c < at > 12  #0  (table:340)
Found 6fb7905579e28bfc < at > 23  #0  (table:372)
crack #0 took 17007 msec

Kraken> test

Cracking
001101110011000000001000001100011000100110110110011011010011110001101010100100101111111010111100000110101001101011
Found de6bb5e60617f95c < at > 12  #1  (table:340)
Found 6fb7905579e28bfc < at > 23  #0  (table:372)
crack #1 took 9641 msec


R

error building kraken

Karin Klepper — 2013-05-13T12:00:35

Hello List!

I tried to build kraken, but got the following error:

pwr< at >pwr-MS-7640:~/GSM/kraken/Kraken$ ./build.sh
a5cpu_test.cpp: In Funktion »int main(int, char**)«:
a5cpu_test.cpp:44:16: Fehler: »sleep« wurde in diesem Gültigkeitsbereich
nicht definiert
a5cpu_test.cpp:50:90: Warnung: Format »%llx« erwartet Argumenttyp »long
long unsigned int«, aber Argument 2 hat Typ »uint64_t {aka long unsigned
int}« [-Wformat]
a5cpu_test.cpp:50:90: Warnung: Format »%llx« erwartet Argumenttyp »long
long unsigned int«, aber Argument 3 hat Typ »uint64_t {aka long unsigned
int}« [-Wformat]
Kraken.cpp: In Konstruktor »Kraken::Kraken(const char*, int)«:
Kraken.cpp:65:74: Warnung: Format »%llu« erwartet Argumenttyp »long long
unsigned int*«, aber Argument 5 hat Typ »uint64_t* {aka long unsigned
int*}« [-Wformat]
Kraken.cpp: In Funktion »int main(int, char**)«:
Kraken.cpp:415:19: Fehler: »usleep« wurde in diesem Gültigkeitsbereich
nicht definiert
DeltaLookup.cpp: In Konstruktor »DeltaLookup::Delt

Re: MS '1' is up, service is limited

Karsten Nohl — 2013-04-04T04:50:03

Hi there,

This list is concerned with A5/1 decryption.

Your question on using Osmocom to connect to a network may be answered more competently at:
http://bb.osmocom.org/trac/wiki/Community/Mailing_lists

Cheers,     -Karsten


On Apr 4, 2013, at 5:02 , Hoàng Mạnh Hùng <hunghm.vn< at >gmail.com> wrote:


_______________________________________________
A51 mailing list
A51< at >lists.srlabs.de
http://lists.srlabs.de/cgi-bin/mailman/listinfo/a51

MS '1' is up, service is limited

Hoàng Mạnh Hùng — 2013-04-04T03:02:53

Hi all,

I connected, sent and made call successful with osmocombb.

But, now, I always get error, always be rejected:

OsmocomBB# show ms
MS '1' is up, service is limited
  IMEI: 357337016773249
     IMEISV: 3573370167732490
     IMEI generation: fixed
  automatic network selection state: A0 null
  cell selection state: PLMN search
  radio ressource layer state: idle
  mobility management layer state: MM idle, PLMN search

OsmocomBB#
% (MS 1)
% Trying to registering with network...


in my config file (/root/.osmocom/bb/mobile.cfg):
!
! OsmocomBB () configuration saved from vty
!!
!
line vty
 no login
!
gps device /dev/ttyACM0
gps baudrate default
no gps enable
!
no hide-default
!
ms 1
 layer2-socket /tmp/osmocom_l2
 sap-socket /tmp/osmocom_sap
 sim reader
 network-selection-mode auto
 imei 357337016773249 0
 imei-fixed
 emergency-imsi 452040399998391
 sms-service-center +84980200030
 no call-waiting
 no auto-answer
 no force-rekey
 no clip
 no clir
 tx-power auto
 no simulated-delay
 no stick
 location-upd

Re: Rainbow Tables

isa 56k — 2013-04-02T19:51:17

Actually, if anyone is going to be at HITB next week I would be happy to swap some £'s $'s or €'s for a disk with the content on :)

Thx // isa56k

On 2 Apr 2013, at 16:26, isa 56k <isa56k-mVuRI66OGLPQT0dZR+AlfA< at >public.gmane.org> wrote:


_______________________________________________
A51 mailing list
A51-9cLeXjskusuFzESapgPWAg< at >public.gmane.org
http://lists.srlabs.de/cgi-bin/mailman/listinfo/a51

Rainbow Tables

isa 56k — 2013-04-02T15:26:19

Hello,

Has anyone on this list got a copy of the tables here:

http://opensource.srlabs.de/projects/a51-decrypt/files

I have been trying to download them for the last month or two but only got 6 out of the 40. :(

Happy to pay for a 2TB disk and shipping to UK if someone can assist.

TIA//isa56K._______________________________________________
A51 mailing list
A51-9cLeXjskusuFzESapgPWAg< at >public.gmane.org
http://lists.srlabs.de/cgi-bin/mailman/listinfo/a51

Re: Errors connecting to svn repo

Karsten Nohl — 2013-03-21T07:45:08

Hi there,

On Mar 20, 2013, at 12:14 , Margilca <gilcamar< at >gmail.com> wrote:


The svn moved a while ago to a Git on another server [1]:

git clone git://git.srlabs.de/kraken

Cheers,

     -Karsten


[1] http://opensource.srlabs.de/projects/a51-decrypt/wiki/


_______________________________________________
A51 mailing list
A51< at >lists.srlabs.de
http://lists.srlabs.de/cgi-bin/mailman/listinfo/a51

Errors connecting to svn repo

Margilca — 2013-03-20T11:14:07

Hi,
just a few words to introduce myself.
I am Marco from Italy and I would like to get to know more
about GSM internals.

I did have some issues connecting to repository to checkout branches:
==============================
==================================
[gilcamar< at >centos2t63-64 kraken]$ svn co https://svn.reflextor.com/tmto-svn
Error validating server certificate for 'https://svn.reflextor.com:443':
 - The certificate hostname does not match.
Certificate information:
 - Hostname: *.srlabs.de
 - Valid: from Fri, 31 Aug 2012 05:49:35 GMT until Mon, 01 Sep 2014
12:29:04 GMT
 - Issuer: Secure Digital Certificate Signing, StartCom Ltd.,
IL
 - Fingerprint:
eb:eb:78:cb:90:65:c0:7b:a5:81:b3:0e:af:e8:f4:80:7c:97:55:ae
(R)eject, accept (t)emporarily or accept (p)ermanently?
t
svn: Server sent unexpected return value (403 Forbidden) in response to
OPTIONS request for 'https://svn.reflextor.com/tmto%E2%88%92svn'

[gilcamar< at >centos2t63-64 kraken]$ svn co https://svn.reflextor.com
Error validating server certificate fo

USB hardware for Mobile capturing

javier falbo — 2013-03-16T14:03:48

Hi, Someone from the group was able to test this new hardware to capture?http://www.funcubedongle.com/coverage of the FUNcube Dongle Pro+ is from 150kHz to 1.9GHz It is a small radio receiver compatible with open source and very cheap.Instead of using ettus which is a big case and not mobile, this small usb stick seems a good solution.If someone already have it, please confirm. More info here:http://adamsblog.aperturelabs.com/2013/03/you-can-ring-my-bell-adventures-in-sub.html regards.         _______________________________________________
A51 mailing list
A51-9cLeXjskusuFzESapgPWAg< at >public.gmane.org
http://lists.srlabs.de/cgi-bin/mailman/listinfo/a51

Re: Kraken Cracking

Alex — 2013-03-14T17:39:05

Karsten,

Thanks for your help, that gives me an idea of how to get started.

Alex

Re: Kraken Cracking

Karsten Nohl — 2013-03-07T23:11:01

Hi Alex,


The SI5 messages are a good candidate. SI messages can only appear in very specific positions, so you would not have to try very many different places.

Another good candidate are empty frame (0303012b2b...). These often appear at the beginning and/or end of SDCCH traces.

It would probably be best if you looked at a few decrypted transactions first -- some phone disclose the key, as do SIM card proxies. This will give you a better planning grounds for your guessing strategy.

Cheers,

     -Karsten

On Mar 7, 2013, at 23:48 , Alex <a.interrantegrant-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org> wrote:

Re: Kraken Cracking

Alex — 2013-03-07T22:48:04

that's the case: There is nothing to crack.
encrypted frame could be an SI5,
the result of that (=pure A5/1
finds the key in some cases, so you
you find a key.
seems 
http://lists.srlabs.de/pipermail/a51/2010-
on my 
them 
00100000000111000010000000110010001100000110000011000000011010100100000010101001
00100000000111000010000000110010001100000110000011000000011010100100000010101001
00000000000000000000000000000000000000000000000000000000000000000000000000000000
00000000010100100010000000000010100000000110101101000010101000010100001000110100
00000000010100100010000000000010100000000110101101000010101000010100001000110100
00000000000000000000000000000000000000000000000000000000000000000000000000000000
10000001010010100000000111100000000001010000010001000000000101000011000000000100
10000001010010100000000111100000000001010000010001000000000101000011000000000100
00000000000000000000000000000000000000000000000000000000000000000000000000000000
1100000001001001000001010000110101010010000001000001000000000101100010

Re: Kraken Cracking

Karsten Nohl — 2013-03-06T23:36:22

Dear Alex,

From the sound of it, you may be trying to crack an unencrypted frame. If that's the case: There is nothing to crack.

Instead of finding an SI5 message in Wireshark, you'd have to _guess_ which encrypted frame could be an SI5, then XOR the SI5 burst with the suspected encrypted SI5 burst, and then run the result of that (=pure A5/1 key stream if you guessed right) through Kraken

One more complication: Even if you did all of this correctly, Kraken only finds the key in some cases, so you may have to try several times with different correct guesses/locations until you find a key.

Cheers,

     -Karsten

On Mar 7, 2013, at 24:22 , Alex <a.interrantegrant-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org> wrote:

Kraken Cracking

Alex — 2013-03-06T23:22:09

Hello,

I'm having some trouble knowing which bursts to run through Kraken to try to 
discover the key. I have the rainbow tables written to HD and everything seems 
to be working. I tried this tutorial: http://lists.srlabs.de/pipermail/a51/2010-
July/000688.html and everything worked nicely but when I try to run kraken on my 
own bursts I can't seem to get them to crack no matter which burst I pick. 
Here's what I'm doing:

1) Use airprobe to decode unencrypted SACCH packets to a text file and view them 
in wireshark

Exported packets look like this (System Information Type 5):
C1 862242 1332356: 
00100000000111000010000000110010001100000110000011000000011010100100000010101001
0001001000110100000000101000000110
P1 862242 1332356: 
00100000000111000010000000110010001100000110000011000000011010100100000010101001
0001001000110100000000101000000110
S1 862242 1332356: 
00000000000000000000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000
C0 862243 1332389: 
000000000