I've been trying to figure this out for days now, by reading the specs. I originally thought the same as you - the shared symmetric key is used only for authentication. But reading descriptions of the protocol closely I don't believe they are really using forward secrecy at all.
The problem is that whilst, yes, unique and constantly rotating randomness is used to establish unique session keys, the session keys are derived from the random nonce that's an encryption of the network selected randomness. In other words if you have the SIM key, you can figure out what the session keys also were. Ultimately the standard SIMs don't seem to use asymmetric crypto anywhere, meaning a compromise of the SIM key still allows you to undo all the encryption. Ultimately everything is derived from these shared keys.
And yes the problem of 2G downgrade attacks remain. There doesn't seem to be any good solution for those short of phasing out 2G entirely.
I was also taken aback by this Perfect Forward Secrecy claim, and I hate how "anything goes" in this context because outright lies are hard to refute...
It would be a huge service to humanity if you summarized your findings and published them, with references to the specs...
There's a lot of legacy hardware that still uses 2G, like alarm systems and ATMs. There's no doubt it'll have to be sunset at some point, but the cell & tower companies will need to see what percentage of their traffic it makes up before coming to a decision.
Except that they haven't 'phased out' 2G, because that would be a nightmare for their customers when they're in poor reception. Instead, they've just subcontracted it to another company.
Comments
I've been trying to figure this out for days now, by reading the specs. I originally thought the same as you - the shared symmetric key is used only for authentication. But reading descriptions of the protocol closely I don't believe they are really using forward secrecy at all.
The problem is that whilst, yes, unique and constantly rotating randomness is used to establish unique session keys, the session keys are derived from the random nonce that's an encryption of the network selected randomness. In other words if you have the SIM key, you can figure out what the session keys also were. Ultimately the standard SIMs don't seem to use asymmetric crypto anywhere, meaning a compromise of the SIM key still allows you to undo all the encryption. Ultimately everything is derived from these shared keys.
And yes the problem of 2G downgrade attacks remain. There doesn't seem to be any good solution for those short of phasing out 2G entirely.
I was also taken aback by this Perfect Forward Secrecy claim, and I hate how "anything goes" in this context because outright lies are hard to refute...
It would be a huge service to humanity if you summarized your findings and published them, with references to the specs...
Phasing out 2G isn't such a bad idea... Three in the UK have already done this with their 3G / 4G only network.
There's a lot of legacy hardware that still uses 2G, like alarm systems and ATMs. There's no doubt it'll have to be sunset at some point, but the cell & tower companies will need to see what percentage of their traffic it makes up before coming to a decision.
Except that they haven't 'phased out' 2G, because that would be a nightmare for their customers when they're in poor reception. Instead, they've just subcontracted it to another company.
They phased out that partnership with orange a couple of years back, now it's 3G or nothing