SIST EN 302 109 V1.1.1:2003

• Abstract:

  Transpose the current ES 202 109 to an EN with the same content.

• Status: Published
• Publication Date: 30-Nov-2003
• ICS: 33.070.10 - Terrestrial Trunked Radio (TETRA)
• Technical Committee: SS EIT - Technical Board for the electrotechnical, information technology and telecommunications fields
• Current Stage: 6060 - National Implementation/Publication (Adopted Project)
• Start Date: 01-Dec-2003
• Due Date: 01-Dec-2003
• Completion Date: 01-Dec-2003
• Ref Project: ETSI EN 302 109 V1.1.1 (2003-10) - Terrestrial Trunked Radio (TETRA); Security; Synchronization mechanism for end-to-end encryption

SIST EN 302 109 V1.1.1:2003 is the SIST version of the ETSI European Standard for TETRA security. It specifies the synchronization mechanism for end-to-end encryption in Terrestrial Trunked Radio, for voice and circuit mode data, and it is intended for systems using Direct Mode Operation (DMO) and Trunked Mode Operation (TMO/V+D).

What does SIST EN 302 109 V1.1.1:2003 specify?

SIST EN 302 109 V1.1.1:2003 defines how a TETRA end-to-end encryption system keeps the transmitter and receiver synchronized when a synchronous stream cipher is used. It focuses on the U-plane and on the exchange of synchronization and encryption-related information, while leaving the encryption algorithms and key management outside the main scope.

The document is organized into:

• Clause 1: Scope
• Clause 2: References
• Clause 3: Definitions and abbreviations
• Clause 4: End-to-end encryption
• Annex A: Bibliography

Annex A is informative and lists related TETRA documents for DMO, V+D, and security.

What are the key requirements of SIST EN 302 109 V1.1.1:2003?

SIST EN 302 109 V1.1.1:2003 sets out a practical synchronization method built around frame stealing and synchronization values (SV). In practice, it tells implementers where the encryption unit sits in the TETRA stack, how it exchanges control information, and how the receiver recovers if synchronization is damaged.

Synchronization applies only to the U-plane

Clause 4.1 limits the mechanism to U-plane traffic and U-plane signalling, with the same method used in both directions and with independent synchronization processes in each direction. This matters because the encryption layer must be placed above the MAC resident air-interface encryption and must preserve half-slot timing and ordering.

Voice encryption uses an EKSG, CK and IV

Clause 4.2 describes a voice encryption and decryption mechanism based on an End-to-end Key Stream Generator (EKSG) fed by a cipher key (CK) and an Initialization Value (IV). The EKSG produces an End-to-end Key Stream Segment (EKSS) that is combined with Plain Text (PT) to produce Cipher Text (CT), and reversed at the receiver.

Replay protection depends on time-variant data

Clause 4.2.1 recommends using a time-variant IV or a time-variant cipher key to reduce replay risk. For an operator or integrator, this means the system needs some changing call-related value, such as a timestamp or sequence number, and may also need extra message validation data for call replay protection.

Data encryption is preferably done at the application level

Clause 4.3 says circuit mode data encryption should preferably be implemented in the application that carries the data. If the voice encryption mechanism is reused for data, it provides confidentiality only, so data integrity needs other measures.

Synchronization information is carried by frame stealing

Clauses 4.4.1 and 4.4.2 define initial synchronization and re-synchronization by stealing half-slots from U-plane traffic and sending the information via the Stealing Channel (STCH). The receiver reports stolen frames locally through TMD-SAP in V+D or DMD-SAP in DMO, so the application can react to synchronization loss or signalling.

Transmission and reception have specific handling rules

Clause 4.4.3 limits synchronization frame insertion to no more than four half-slots per second and says the first transmitted SV at the start of each transmission is called the IV. Clause 4.4.4 defines receiver behavior: if a received SV is bad, the unit can use a flywheel mechanism and locally generated SVs until a valid one arrives.

Stolen frames have a defined format and destination

Clause 4.4.5 defines fields such as Half-Slot Stolen by encryption unit (HSSE) and Stolen Half-Slot Identifier (SHSI), and shows how the frame is routed depending on those values. This is important for implementation because the codec, the encryption synchronization path, and the signalling path each treat stolen half-slots differently.

Key transfer uses TETRA Short Data Service

Clause 4.6 says end-to-end key management uses the standard TETRA Short Data Service with user-defined data content. The key management message should carry an Encryption key number, an Encryption unit identity, and a Sealed encryption key.

What terms does SIST EN 302 109 V1.1.1:2003 define?

SIST EN 302 109 V1.1.1:2003 defines the terms needed to implement and test the synchronization scheme correctly.

• Cipher key (CK) - the cryptographic value used to drive the transformation between plain text and cipher text.
• End-to-end encryption - encryption at the source end system with decryption only at the destination end system.
• Flywheel - a receiver-side mechanism that keeps the KSG synchronized when a synchronization value is missed.
• Initialization Value (IV) - the sequence used to initialize the KSG inside the encryption unit.
• Key Stream Generator (KSG) - the algorithm that generates the stream used for encipherment and decipherment.
• Synchronization value (SV) - the value sent to align the receiver KSG with the transmitter KSG.
• Stolen Half-Slot Identifier (SHSI) - the indicator that distinguishes a synchronization frame from other signalling data in a stolen half-slot.

Who uses SIST EN 302 109 V1.1.1:2003?

SIST EN 302 109 V1.1.1:2003 is used by TETRA equipment designers, security engineers, protocol implementers, and test laboratories. It is relevant for people building or verifying TETRA terminals, encryption units, codecs, and signalling handling for DMO and V+D.

It also helps procurement and quality teams check whether a TETRA solution supports the expected end-to-end encryption synchronization behavior, frame stealing behavior, and key-transfer mechanism.

What changed in SIST EN 302 109 V1.1.1:2003 from the previous edition?

SIST EN 302 109 V1.1.1:2003 transposes the current ES 202 109 into an EN with the same content. The introduction also says that it replaces the end-to-end encryption clause in EN 300 392-7 and ETS 300 396-6.

Which standards are used with SIST EN 302 109 V1.1.1:2003?

SIST EN 302 109 V1.1.1:2003 refers to these related standards:

• ETSI EN 300 392-2 - provides the TETRA Voice plus Data (V+D) air interface reference, including the Stealing Channel and the SAP context used in the mechanism.
• ISO 7498-2 - provides the security architecture definitions used for terms such as encipherment and decipherment.
• ETSI ETS 300 395-1 - provides the speech codec description used when the traffic source/sink is a speech codec.
• ETSI EN 300 396 and ETSI EN 300 392 - provide the DMO and V+D frameworks named in the scope and bibliography.
• ETSI EN 300 392-7 and ETSI ETS 300 396-6 - are the security parts whose end-to-end encryption clauses are replaced by this document.

What does the SIST EN 302 109 V1.1.1:2003 document contain?

SIST EN 302 109 V1.1.1:2003 contains a functional model of voice encryption and decryption, a transmitter sync-control flow chart, and a receiver sync-detect state diagram. It also includes tables for primitive parameters, stolen frame format, and the mapping of stolen-frame values to the terminating device.

The document gives the technical structure needed to design, integrate, or test the synchronization path, the signalling path, and the encryption control interface. It also shows where the end-to-end encryption unit sits in the mobile station architecture and how it relates to the traffic source/sink, DMD-SAP, and the MAC.

2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.Prizemni snopovni radio (TETRA) – Varnost – Mehanizem za sinhronizacijo šifriranja zveze konec-konecTerrestrial Trunked Radio (TETRA); Security; Synchronization mechanism for end-to-end encryption33.070.10Prizemni snopovni radio (TETRA)Terrestrial Trunked Radio (TETRA)ICS:Ta slovenski standard je istoveten z:EN 302 109 Version 1.1.1SIST EN 302 109 V1.1.1:2003en01-december-2003SIST EN 302 109 V1.1.1:2003SLOVENSKI
STANDARD
ETSI ETSI EN 302 109 V1.1.1 (2003-10) 2
Reference DEN/TETRA-06117 Keywords air interface, data, DMO, security, speech, TETRA ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE
Tel.: [phone]
Fax: [phone]
Siret N° 348 623 562 00017 - NAF 742 C Association à but non lucratif enregistrée à la Sous-Préfecture de Grasse (06) N° 7803/88
Important notice Individual copies of the present document can be downloaded from: http://www.etsi.org The present document may be made available in more than one electronic version or in print. In any case of existing or perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF). In case of dispute, the reference shall be the printing on ETSI printers of the PDF version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at http://portal.etsi.org/tb/status/status.asp If you find errors in the present document, send your comment to: [e-mail] Copyright Notification No part may be reproduced except as authorized by written permission. The copyright and the foregoing restriction extend to reproduction in all media.
© European Telecommunications Standards Institute 2003. All rights reserved.
DECTTM, PLUGTESTSTM and UMTSTM are Trade Marks of ETSI registered for the benefit of its Members. TIPHONTM and the TIPHON logo are Trade Marks currently being registered by ETSI for the benefit of its Members. 3GPPTM is a Trade Mark of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. SIST EN 302 109 V1.1.1:2003

ETSI ETSI EN 302 109 V1.1.1 (2003-10) 3
Contents Intellectual Property Rights.4 Foreword.4 Introduction.4 1 Scope.5 2 References.5 3 Definitions and abbreviations.5 3.1 Definitions.5 3.2 Abbreviations.6 4 End-to-end encryption.7 4.1 Introduction.7 4.2 Voice encryption and decryption mechanism.7 4.2.1 Protection against replay.8 4.3 Data encryption mechanism.8 4.4 Exchange of information between encryption units.9 4.4.1 Synchronization of encryption units.9 4.4.2 Encrypted information between encryption units.10 4.4.3 Transmission.10 4.4.4 Reception.12 4.4.5 Stolen frame format.12 4.5 Location of security components in the functional architecture.13 4.6 End-to-end Key Management.15 Annex A (informative): Bibliography.16 History.17
ETSI ETSI EN 302 109 V1.1.1 (2003-10) 4
Intellectual Property Rights IPRs essential or potentially essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (http://webapp.etsi.org/IPR/home.asp). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Foreword This European Standard (Telecommunications series) has been produced by ETSI Project Terrestrial Trunked Radio (TETRA).
National transposition dates Date of adoption of this EN: 3 October 2003 Date of latest announcement of this EN (doa): 31 January 2004 Date of latest publication of new National Standard or endorsement of this EN (dop/e):
31 July 2004 Date of withdrawal of any conflicting National Standard (dow): 31 July 2004
Introduction The present document replaces the end-to-end encryption clause in each of EN 300 392-7 and ETS 300 396-6. SIST EN 302 109 V1.1.1:2003

ETSI ETSI EN 302 109 V1.1.1 (2003-10) 5
1 Scope The present document defines the Terrestrial Trunked Radio system (TETRA) synchronization operation for end-to-end encryption algorithms that employ streaming ciphers for voice. The method defined applies equally to Direct Mode Operation (as defined in EN 300 396 (see bibliography)) and to Trunked Mode Operation (as defined in EN 300 392 (see bibliography)). 2 References The following documents contain provisions which, through reference in this text, constitute provisions of the present document. • References are either specific (identified by date of publication and/or edition number or version number) or non-specific. • For a specific reference, subsequent revisions do not apply. • For a non-specific reference, the latest version applies. Referenced documents which are not found to be publicly available in the expected location might be found at http://docbox.etsi.org/Reference. [1] ETSI EN 300 392-2: "Terrestrial Trunked Radio (TETRA); Voice plus Data (V+D); Part 2: Air Interface (AI)". [2] ISO 7498-2: "Information processing systems - Open Systems Interconnection - Basic Reference Model - Part 2: Security Architecture". [3] ETSI ETS 300 395-1: "Terrestrial Trunked Radio (TETRA); Speech codec for full-rate traffic channel; Part 1: General description of speech functions". 3 Definitions and abbreviations 3.1 Definitions For the purposes of the present document, the following terms and definitions apply: cipher key: value that is used to determine the transformation of plain text to cipher text in a cryptographic algorithm cipher text: data produced through the use of encipherment NOTE: The semantic content of the resulting data is not available (ISO 7498-2 [2]). decipherment: reversal of a corresponding reversible encipherment (ISO 7498-2 [2]) encipherment: cryptographic transformation of data to produce cipher text (ISO 7498-2 [2]) encryption state: encryption on or off end-to-end encryption: encryption within or at the source end system, with the corresponding decryption occurring only within or at the destination end system flywheel: mechanism to keep the KSG in the receiving terminal synchronized with the Key Stream Generator (KSG) in the transmitting terminal in case synchronization data is not received correctly Initialization Value (IV): sequence of symbols that initializes the KSG inside the encryption unit key stream: pseudo random stream of symbols that is generated by a KSG for encipherment and decipherment SIST EN 302 109 V1.1.1:2003

ETSI ETSI EN 302 109 V1.1.1 (2003-10) 6
Key Stream Generator (KSG): cryptographic algorithm which produces a stream of binary digits which can be used for encipherment and decipherment NOTE: The initial state of the KSG is determined by the initialization value. Key Stream Segment (KSS): key stream of arbitrary length plain text: unencrypted source data NOTE: The semantic content is available. proprietary algorithm: algorithm which is the intellectual property of a legal entity synchronization value: sequence of symbols that is transmitted to the receiving terminal to synchronize the KSG in the receiving terminal with the KSG in the transmitting terminal synchronous stream cipher: encryption method in which a cipher text symbol completely represents the corresponding plain text symbol NOTE: The encryption is based on a key stream that is independent of the cipher text. In order to synchronize the KSGs in the transmitting and the receiving terminal synchronization data is transmitted separately. time stamp: sequence of symbols that represents the time of day 3.2 Abbreviations For the purposes of the present document, the following abbreviations apply: AI Air Interface CK Cipher Key C-plane Control-plane CT Cipher Text DMD-SAP Direct Mode D Service Access Point DMO Direct Mode Operation EKSG End-to-end Key Stream Generator EKSS End-to-end Key Stream Segment F Function HSC Half-Slot Condition HSI Half-Slot Importance HSN Half-Slot Number HSS Half-Slot Stolen HSSE Half-Slot Stolen by Encryption unit IV Initialization Value KSG Key Stream Generator KSS Key Stream Segment L1 Layer 1 L2 Layer 2 L3 Layer 3 MAC Medium Access Control MS Mobile Station PT Plain Text SAP Service Access Point SHSI Stolen Half-Slot Identifier STCH Stolen Channel SV Synchronization Value T/DMA-SAP Trunked or Direct Mode A Service Access Point T/DMC-SAP Trunked or Direct Mode C Service Access Point T/DMD-SAP Trunked or Direct Mode D Service Access Point TMD-SAP Trunked Mode D Service Access Point Tx Transmit U-plane User-plane V+D Voice + Data SIST EN 302 109 V1.1.1:2003

ETSI ETSI EN 302 109 V1.1.1 (2003-10) 7
4 End-to-end encryption 4.1 Introduction End-to-end encryption algorithms and key management are outside the scope of the present document. This clause describes a standard mechanism for synchronization of the encryption system that may be employed when using a synchronous stream cipher. The mechanism also permits transmission of encryption related and other signalling information. The mechanism shall apply only to U-plane traffic and U-plane signalling. The method described uses the Stealing Channel, STCH, for synchronization during transmission (see EN 300 392-2 [1], clause 23.8.4). NOTE: This mechanism does not apply for self-synchronizing ciphers, or for block ciphers. The following are requirements on the end-to-end encryption mechanism: • the same mechanisms shall apply in both directions; • the synchronization processes shall be independent in each direction; • end-to-end encryption shall be located in the U-plane (above the MAC resident air-interface encryption); • transport of plain text and cipher text shall maintain the timing and ordering of half-slot pairing (half slots shall be restored in the same order and with the same boundary conditions at each end of the link); • the encryption mechanisms described in this clause are valid for one call instance. 4.2 Voice encryption and decryption mechanism Figure 1 shows a functional diagram of the voice encryption and decryption mechanism based on the synchronous stream cipher principle. This demonstrates the symmetry of transmitter and receiver with each side having common encryption units. It is assumed that the encryption unit shall generate a key stream in a similar way to the AI encryption unit. The encryption unit is then termed the End-to-end Key Stream Generator (EKSG). EKSG shall have two inputs, a cipher key and an initialization value. The initialization value should be a time variant parameter (e.g. a sequence number or a timestamp) that is used to initialize synchronization of the encryption units. The output of EKSG shall be a key stream segment termed EKSS. Function F1 shall combine the Plain Text (PT) bit stream and EKSS resulting in an encrypted Cipher Text (CT) bit stream. Function F1-1 shall be the inverse of F1 and shall combine the bit streams CT and EKSS resulting in the decrypted bit stream PT. Function F2 shall replace a half slot of CT with a synchronization frame provided by the "sync co
...