SIST EN 300 392-7 V2.1.1:2003

• Abstract:

  To update the standard in light of discovered shortcomings and to realign with update of ETS 300 392-2.

• Status: Published
• Publication Date: 30-Nov-2003
• ICS: 33.070.10 - Terrestrial Trunked Radio (TETRA)
• Technical Committee: SS EIT - Technical Board for the electrotechnical, information technology and telecommunications fields
• Current Stage: 6060 - National Implementation/Publication (Adopted Project)
• Start Date: 01-Dec-2003
• Due Date: 01-Dec-2003
• Completion Date: 01-Dec-2003
• Ref Project: ETSI EN 300 392-7 V2.1.1 (2001-02) - Terrestrial Trunked Radio (TETRA); Voice plus Data (V+D); Part 7: Security

SIST EN 300 392-7 V2.1.1:2003 is the Slovenian adoption of ETSI EN 300 392-7 Version 2.1.1 for Terrestrial Trunked Radio (TETRA) Voice plus Data (V+D) security. It specifies how TETRA Switching and Management Infrastructure (SwMI) and Mobile Station (MS) equipment authenticate, manage air-interface keys, control enable/disable states, protect air-interface traffic, and provide end-to-end confidentiality for users.

What does SIST EN 300 392-7 V2.1.1:2003 specify?

SIST EN 300 392-7 V2.1.1:2003 defines the security part of TETRA V+D. The scope focuses on authentication, over-the-air key management, air-interface encryption, enable/disable control, and end-to-end confidentiality.

The document is organized around four main clauses:

• Clause 4 - authentication and air-interface key management
• Clause 5 - enable and disable mechanisms
• Clause 6 - air-interface encryption and mobility procedures
• Clause 7 - end-to-end encryption

It also includes normative annexes that carry the protocol details and timer definitions.

Annex	What it covers
Annex A	PDU and element definitions for authentication, OTAR, key association, key change, enable/disable, and security-related coding
Annex B	Boundary conditions for cryptographic algorithms and procedures
Annex C	Timers T354, T371 and T372

The scope also leaves out protocol-error handling in degraded mode, detailed handling of the Authentication Centre, the electrical and physical aspects of the end-to-end interface, and the end-to-end algorithms and keys themselves.

What are the key requirements of SIST EN 300 392-7 V2.1.1:2003?

The standard is built around three security classes. Class 1 allows authentication but no air-interface encryption, class 2 uses Static Cipher Key (SCK) encryption and Encrypted Short Identity (ESI) with SCK, and class 3 uses Derived Cipher Key (DCK) encryption and ESI with Common Cipher Key (CCK). In practice, this tells an operator which features must be provisioned in each cell and which security services a terminal can expect.

Authentication and key derivation

Clause 4 describes air-interface authentication as a challenge-response exchange between the SwMI and the MS. The user authentication and infrastructure authentication procedures are separate, and mutual authentication is also defined. This matters because successful authentication is what creates the DCK used in class 3 cells.

The document states that the authentication key K must stay within the Authentication Centre, and that K can be made available in an MS from an Authentication Code (AC), a User Authentication Key (UAK), or both. For a buyer or implementer, this means the terminal design must support the chosen key-entry and key-storage method.

OTAR and key management

Clause 4 also defines Over The Air Re-keying (OTAR) for five key types: DCK, CCK, Group Cipher Key (GCK), Group Session Key for OTAR (GSKO), and SCK. DCK comes from authentication; the others are delivered over the air, often in sealed form. This is the core of field key replacement and fleet management.

The document defines how keys are associated with ITSI, LA-id and GTSI, and how group keys are handled with sealing keys and version numbers. In practice, this is what lets a network distribute keys to one MS or to groups while protecting against replay and manipulation.

Enable/disable and key-change control

Clause 5 defines mechanisms to disable or enable MS equipment, MS subscription, or both. It uses MM service primitives so that network and terminal state stay aligned. This is the part to check if a project needs remote deactivation, reactivation, or subscription control.

Clause 6 defines how the SwMI controls air-interface encryption and how key changes are synchronized. D-CK-CHANGE-DEMAND and U-CK-CHANGERESULT carry the timing of the change, and the document allows change at an absolute IV, at network time, or immediately. That matters in live networks because the MS and SwMI must switch keys at the same moment.

Air-interface encryption and ESI

Clause 6 also defines the Encryption Cipher Key (ECK), derived from the selected cipher key and radio parameters. It covers voice, data, packet data, control information, and mobility procedures such as cell re-selection. The ESI mechanism protects short identities on the air interface, so addressing can be concealed while still supporting registration and mobility.

End-to-end confidentiality

Clause 7 covers end-to-end encryption for voice and data between users or groups of users. It describes the logical interface to the encryption units, the exchange of synchronization information, replay protection, and where security components sit in the functional architecture. It does not define the algorithms or keys themselves.

What terms does SIST EN 300 392-7 V2.1.1:2003 define?

• DCK - the key derived during authentication and used to protect individual signalling and traffic in class 3 cells.
• CCK - the cipher key used by the infrastructure and MS for group-addressed protection in class 3 cells and for ESI generation.
• SCK - a static cipher key used in class 2 cells and in Direct Mode operations.
• GCK - a group cipher key known by the infrastructure and MS to protect group-addressed signalling and traffic.
• GSKO - the Group Session Key for OTAR, used to distribute keys securely to groups of users.
• OTAR - the method for transferring secret keys securely to terminals over the air interface.
• ESI - Encrypted Short Identity, which protects short subscriber identities on the air interface.
• KSG - the KeyStream Generator that produces the keystream used for encipherment and decipherment.

Who uses SIST EN 300 392-7 V2.1.1:2003?

This standard is used by TETRA network operators, SwMI designers, MS and base-station implementers, and security architects. It is also relevant for test and conformance teams that need to verify authentication, OTAR, encryption control, key change timing, and class-dependent behavior.

What changed in SIST EN 300 392-7 V2.1.1:2003 from the previous edition?

SIST EN 300 392-7 V2.1.1:2003 replaces ETS 300 392-7 (1996). The scope says this edition updates the standard in light of discovered shortcomings and realigns it with the update of ETS 300 392-2.

Which standards are used with SIST EN 300 392-7 V2.1.1:2003?

• ETSI ETS 300 392-1 - general TETRA Voice plus Data network design.
• ETSI EN 300 392-2 and ETSI ETS 300 392-2 - the TETRA air interface and the mobility procedures used by this security part.
• ETSI ETR 086-3 - the earlier technical requirements baseline for TETRA security aspects.
• ISO 7498-2 - the security architecture concepts used for ciphering and confidentiality terms.
• ETSI ETS 300 395-1 - speech codec context for full-rate traffic channels.
• ETSI ETS 300 812 - security aspects for the SIM-ME interface.
• ETSI ETS 300 396-6 - security for Direct Mode Operation (DMO).

What does the SIST EN 300 392-7 V2.1.1:2003 document contain?

The document contains authentication procedures, key management workflows, OTAR message sequences, enable/disable procedures, air-interface encryption control, and end-to-end confidentiality architecture. It uses Message Sequence Charts, protocol data units, and coded information elements to show how MS and SwMI exchange security information.

Annex A gives the PDU and element codings used by the procedures. Annex B gives cryptographic boundary conditions and parameter sizing. Annex C defines the timers used by authentication and key distribution.

2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.Prizemni snopovni radio (TETRA) – Govor in podatki (V+D) – 7. del: VarnostTerrestrial Trunked Radio (TETRA); Voice plus Data (V+D); Part 7: Security33.070.10Prizemni snopovni radio (TETRA)Terrestrial Trunked Radio (TETRA)ICS:Ta slovenski standard je istoveten z:EN 300 392-7 Version 2.1.1SIST EN 300 392-7 V2.1.1:2003en01-december-2003SIST EN 300 392-7 V2.1.1:2003SLOVENSKI
STANDARD
ETSIEN300392-7V2.1.1(2001-02)EuropeanStandard(Telecommunicationsseries)TerrestrialTrunkedRadio(TETRA);VoiceplusData(V+D);Part7:SecuritySIST EN 300 392-7 V2.1.1:2003

ETSIETSIEN300392-7V2.1.1(2001-02)2ReferenceREN/TETRA-06001-7KeywordsTETRA,V+D,SecurityETSI650RoutedesLuciolesF-06921SophiaAntipolisCedex-FRANCETel.:[phone]Fax:[phone]SiretN°34862356200017-NAF742CAssociationàbutnonlucratifenregistréeàlaSous-PréfecturedeGrasse(06)N°7803/88ImportantnoticeIndividualcopiesofthepresentdocumentcanbedownloadedfrom:http://www.etsi.orgThepresentdocumentmaybemadeavailableinmorethanoneelectronicversionorinprint.Inanycaseofexistingorperceiveddifferenceincontentsbetweensuchversions,thereferenceversionisthePortableDocumentFormat(PDF).Incaseofdispute,thereferenceshallbetheprintingonETSIprintersofthePDFversionkeptonaspecificnetworkdrivewithinETSISecretariat.Usersofthepresentdocumentshouldbeawarethatthedocumentmaybesubjecttorevisionorchangeofstatus.InformationonthecurrentstatusofthisandotherETSIdocumentsisavailableathttp://www.etsi.org/tb/status/Ifyoufinderrorsinthepresentdocument,sendyourcommentto:[e-mail]opartmaybereproducedexceptasauthorizedbywrittenpermission.Thecopyrightandtheforegoingrestrictionextendtoreproductioninallmedia.©EuropeanTelecommunicationsStandardsInstitute2001.Allrightsreserved.SIST EN 300 392-7 V2.1.1:2003

ETSIETSIEN300392-7V2.1.1(2001-02)3ContentsIntellectualPropertyRights.9Foreword.91Scope.101.1Securityclasses.101.2Documentlayout.102References.113Definitions,symbolsandabbreviations.123.1Definitions.123.2Abbreviations.144AirInterfaceauthenticationandkeymanagementmechanisms.164.1Airinterfaceauthenticationmechanisms.164.1.1Overview.164.1.2Authenticationofauser.164.1.3Authenticationoftheinfrastructure.174.1.4Mutualauthenticationofuserandinfrastructure.184.1.5Theauthenticationkey.204.1.5.1MakingKavailableinanMS.214.1.6Equipmentauthentication.214.2AirInterfacekeymanagementmechanisms.214.2.1TheDCK.224.2.2TheGCK.224.2.3TheCCK.234.2.4TheSCK.244.2.5TheGSKO.254.2.5.1SCKdistributiontogroupswithOTAR.264.2.5.2GCKdistributiontogroupswithOTAR.264.2.6EncryptedShortIdentity(ESI)mechanism.264.2.7EncryptionCipherKey.274.2.8SummaryofAIkeymanagementmechanisms.284.3Servicedescriptionandprimitives.294.3.1Authenticationprimitives.294.3.2SCKtransferprimitives.304.3.3GCKtransferprimitives.304.3.4GSKOtransferprimitives.314.4Authenticationprotocol.324.4.1Authenticationstatetransitions.324.4.1.1Descriptionofauthenticationstates.354.4.2Authenticationprotocolsequencesandoperations.354.4.2.1MSCsforauthentication.364.4.2.2MSCsforauthenticationType-3element.424.4.2.3ControlofauthenticationtimerT354atMS.464.5OTARProtocols.474.5.1CCKdelivery-protocolfunctions.474.5.1.1SwMI-initiatedCCKprovision.484.5.1.2MS-initiatedCCKprovisionwithU-OTARCCKDemand.494.5.1.3MS-initiatedCCKprovisionwithannouncedcellreselection.504.5.2OTARprotocolfunctions-SCK.504.5.2.1MSrequestsprovisionofSCK(s).514.5.2.2SwMIprovidesSCK(s)toindividualMS.524.5.2.3SwMIprovidesSCK(s)togroupofMSs.534.5.3OTARprotocolfunctions-GCK.544.5.3.1MSrequestsprovisionofGCK.554.5.3.2SwMIprovidesGCKtoanindividualMS.564.5.3.3SwMIprovidesGCKtoagroupofMSs.57SIST EN 300 392-7 V2.1.1:2003

ETSIETSIEN300392-7V2.1.1(2001-02)44.5.4Cipherkeyassociationtogroupaddress.594.5.4.1SCKassociationforDMO.594.5.4.2GCKassociation.604.5.5Notificationofkeychangeovertheair.614.5.5.1ChangeofDCK.634.5.5.2ChangeofCCK.634.5.5.3ChangeofGCK.634.5.5.4ChangeofSCKforTMO.634.5.5.5ChangeofSCKforDMO.634.5.5.6SynchronizationofCipherKeyChange.644.5.6Securityclasschange.644.5.6.1Changeofsecurityclasstosecurityclass1.644.5.6.2Changeofsecurityclasstosecurityclass2.644.5.6.3Changeofsecurityclasstosecurityclass3.655Enableanddisablemechanism.665.1Generalrelationships.665.2Enable/disablestatetransitions.665.3Mechanisms.675.3.1DisableofMSequipment.685.3.2DisableofMSsubscription.685.3.3DisableanMSsubscriptionandequipment.685.3.4EnableanMSequipment.685.3.5EnableanMSsubscription.685.3.6EnableanMSequipmentandsubscription.685.4Enable/disableprotocol.695.4.1Generalcase.695.4.2Statusofcipherkeymaterial.695.4.3Specificprotocolexchanges.695.4.3.1DisablinganMSwithauthentication.705.4.3.2EnablinganMSwithauthentication.715.4.4EnablinganMSwithoutauthentication.725.4.5DisablinganMSwithoutauthentication.735.4.6Rejectionofenableordisablecommand.735.4.7MMserviceprimitives.745.4.7.1TNMM-DISABLINGprimitive.745.4.7.2TNMM-ENABLINGprimitive.756AirInterface(AI)encryption.766.1Generalprinciples.766.2Securityclass.776.2.1ConstraintsonLAarisingfromcellclass.786.3KeyStreamGenerator(KSG).786.3.1KSGnumberingandselection.796.3.2Interfaceparameters.796.3.2.1InitialValue(IV).796.3.2.2CipherKey.806.4Encryptionmechanism.806.4.1AllocationofKSStologicalchannels.816.4.2AllocationofKSStologicalchannelswithPDUassociation.816.4.3Synchronizationofdatacallswheredataismulti-slotinterleaved.836.4.4Recoveryofstolenframesfrominterleaveddata.836.5Useofcipherkeys.846.5.1IdentificationofencryptionstateofdownlinkMACPDUs.856.5.1.1Class1cells.856.5.1.2Class2cells.856.5.1.3Class3cells.856.5.2IdentificationofencryptionstateofuplinkMACPDUs.866.6Mobilityprocedures.866.6.1Generalrequirements.866.6.1.1Additionalrequirementsforclass3systems.866.6.2Protocoldescription.86SIST EN 300 392-7 V2.1.1:2003

ETSIETSIEN300392-7V2.1.1(2001-02)56.6.2.1Negotiationofcipherparameters.876.6.2.1.1Class1cells.876.6.2.1.2Class2cells.876.6.2.1.3Class3cells.876.6.2.2Initialandundeclaredcellre-selection.876.6.2.3Unannouncedcellre-selection.896.6.2.4Announcedcellre-selectiontype-3.896.6.2.5Announcedcellre-selectiontype-2.896.6.2.6Announcedcellre-selectiontype-1.906.6.2.7Keyforwarding.906.7Encryptioncontrol.926.7.1Datatobeencrypted.926.7.1.1Downlinkcontrolchannelrequirements.926.7.1.2EncryptionofMACheaderelements.926.7.1.3Trafficchannelencryptioncontrol.926.7.2Servicedescriptionandprimitives.936.7.2.1MobilityManagement(MM).946.7.2.2MobileLinkEntity(MLE).946.7.2.3Layer2.966.7.3Protocolfunctions.966.7.3.1MM.966.7.3.2MLE.966.7.3.3LLC.966.7.3.4MAC.966.7.4PDUsforciphernegotiation.977End-to-endencryption.977.1Introduction.977.2Voiceencryptionanddecryptionmechanism.987.2.1Protectionagainstreplay.997.3Dataencryptionmechanism.997.4Exchangeofinformationbetweenencryptionunits.997.4.1Synchronizationofencryptionunits.997.4.2Encryptedinformationbetweenencryptionunits.1007.4.3Transmission.1017.4.4Reception.1037.4.5Stolenframeformat.1037.5Locationofsecuritycomponentsinthefunctionalarchitecture.1047.6End-to-endKeyManagement.106AnnexA(normative):PDUandelementdefinitions.107A.1AuthenticationPDUs.107A.1.1D-AUTHENTICATIONDEMAND.107A.1.2D-AUTHENTICATIONREJECT.107A.1.3D-AUTHENTICATIONRESPONSE.108A.1.4D-AUTHENTICATIONRESULT.108A.1.5U-AUTHENTICATIONDEMAND.108A.1.6U-AUTHENTICATIONREJECT.109A.1.7U-AUTHENTICATIONRESPONSE.109A.1.8U-AUTHENTICATIONRESULT.110A.2OTARPDUs.110A.2.1D-OTARCCKProvide.110A.2.2U-OTARCCKDemand.110A.2.3U-OTARCCKResult.111A.2.4D-OTARGCKProvide.111A.2.5U-OTARGCKDemand.112A.2.6U-OTARGCKResult.112A.2.7D-OTARSCKProvide.113A.2.8U-OTARSCKDemand.113A.2.9U-OTARSCKResult.114A.2.10D-OTARGSKOProvide.114SIST EN 300 392-7 V2.1.1:2003

ETSIETSIEN300392-7V2.1.1(2001-02)6A.2.11U-OTARGSKODemand.114A.2.12U-OTARGSKOResult.115A.3PDUsforkeyassociationtoGTSI.115A.3.1D-OTARKEYASSOCIATEDEMAND.115A.3.2U-OTARKEYASSOCIATESTATUS.116A.4PDUstosynchronisekeyorsecurityclasschange.116A.4.1D-CKCHANGEDEMAND.116A.4.2U-CKCHANGERESULT.117A.5OthersecuritydomainPDUs.118A.5.1U-TEIPROVIDE.118A.5.2U-OTARPREPARE.118A.5.3D-OTARNEWCELL.119A.6PDUsforEnableandDisable.119A.6.1D-DISABLE.119A.6.2D-ENABLE.120A.6.3U-DISABLESTATUS.120A.7MMPDUtype3informationelementscoding.121A.7.1Authenticationdownlink.121A.7.2Authenticationuplink.121A.8PDUInformationelementscoding.122A.8.1Acknowledgementflag.122A.8.2Addressextension.122A.8.3Authenticationchallenge.122A.8.4Authenticationrejectreason.122A.8.5Authenticationresult.122A.8.6Authenticationsub-type.123A.8.7CCKidentifier.123A.8.8CCKinformation.123A.8.9CCKLocationareainformation.123A.8.10CCKrequestflag.124A.8.11Changeofsecurityclass.124A.8.12Cipherparameters.124A.8.13CKprovisionflag.124A.8.14CKprovisioninginformation.125A.8.15CKrequestflag.125A.8.16ClassChangeflag.125A.8.17DCKforwardingresult.125A.8.18Disablingtype.125A.8.19Enable/Disableresult.126A.8.20Encryptionmode.126A.8.20.1Class1cells.126A.8.20.2Class2cells.126A.8.20.3Class3cells.127A.8.21Equipmentdisable.127A.8.22Equipmentenable.127A.8.23Equipmentstatus.127A.8.24Framenumber.127A.8.25Futurekeyflag.128A.8.26GCKdata.128A.8.27GCKkeyandidentifier.128A.8.28GCKNumber(GCKN).128A.8.29GCKselectnumber.128A.8.30GCKVersionNumber(GCK-VN).129A.8.31Groupassociation.129A.8.32GSKOVersionNumber(GSKO-VN).129A.8.33GSSI.129A.8.34Hyperframenumber.129A.8.35Intent/confirm.129SIST EN 300 392-7 V2.1.1:2003

ETSIETSIEN300392-7V2.1.1(2001-02)7A.8.36IV.130A.8.37Keyassociationstatus.130A.8.38Keyassociationtype.130A.8.39Keychangetype.131A.8.40Keytypeflag.131A.8.41KSG-number.131A.8.42Locationarea.131A.8.43Locationareabitmask.131A.8.44Locationareaselector.132A.8.45Locationarealist.132A.8.46Locationarearange.132A.8.47Mobilecountrycode.132A.8.48Mobilenetworkcode.132A.8.49Multiframenumber.132A.8.50Mutualauthenticationflag.133A.8.51Networktime.133A.8.52NumberofGCKschanged.133A.8.53Numberofgroups.133A.8.54Numberoflocationareas.133A.8.55NumberofSCKschanged.134A.8.56NumberofSCKsprovided.134A.8.57NumberofSCKsrequested.134A.8.58OTARsub-type.135A.8.59PDUtype.135A.8.60Proprietary.136A.8.61Provisionresult.136A.8.62Randomchallenge.136A.8.63Randomseed.136A.8.64RandomseedforOTAR.136A.8.65Rejectcause.137A.8.66Responsevalue.137A.8.67SCKdata.137A.8.68SCKinformation.137A.8.69SCKkeyandidentifier.138A.8.70SCKnumber(SCKN).138A.8.71SCKnumberandresult.138A.8.72SCKprovisionflag.138A.8.73SCKselectnumber.139A.8.74SCKuse.139A.8.75SCKversionnumber.139A.8.76SealedKey(SealedCCK,SealedSCK,SealedGCK,SealedGSKO).139A.8.77Securityinformationelement.140A.8.78Sessionkey.140A.8.79SlotNumber.140A.8.80SSI.140A.8.81Subscriptiondisable.141A.8.82Subscriptionenable.141A.8.83Subscriptionstatus.141A.8.84TEI.141A.8.85TEIrequestflag.142A.8.86Timetype.142A.8.87Type3elementidentifier.142SIST EN 300 392-7 V2.1.1:2003

ETSIETSIEN300392-7V2.1.1(2001-02)8AnnexB(normative):Boundaryconditionsforthecryptographicalgorithmsandprocedures.143B.1Dimensioningofthecryptographicparameters.148B.2Summaryofthecryptographicprocesses.149AnnexC(normative):Timers.151C.1T354,authorisationprotocoltimer.151C.2T371,DelaytimerforgroupaddresseddeliveryofSCKandGCK.151C.3T372,Keyforwardingtimer.151AnnexD(informative):Bibliography.152History.153SIST EN 300 392-7 V2.1.1:2003

ETSIETSIEN300392-7V2.1.1(2001-02)9I
...