FAQ - DECT Security
Valid for: | N530 | N610 | N670 | N770 | N870 | N870E | Embedded Integrator | Virtual Integrator |
Introduction
- The security aspects in the DECT standard have been improved after concerns were raised in the market since early 2009
- The DECT Forum Security Working Group has worked closely with deDECTed.org, who were instrumental in raising the concerns and providing their expertise on the legacy security mechanisms
- Security enhancements are being introduced in a step-wise manner to address immediate, mid-term and long-term concerns
- Over the past years the DECT Forum has developed a certification program that is being launched at the annual DECT Conference
- This presentation will provide an overview of the certification program and also touches upon the future steps in the DECT Security Roadmap
STEP A:
- Improvement of the DECT standard to rectify a number of security weaknesses
- Step A was ratified by ETSI early 2010
STEP B:
- Software 2.53 or higher is needed
- Improvement of the authentication algorithm
- The improved algorithm is called DECT Standard Authentication Algorithm 2 (DSAA2) was published during 2012
STEP C:
- Improvement of the encryption algorithm
- The improved version is called DECT Standard Cypher 2 (DSC2)
- Introduction time of Step C is not yet decided
SECURITY FEATURES – STEP A
Note: M = Mandatory, O = Optional
Feature | DECT GAP | DECT Security | WHAT DO THESE FEATURES MEAN? |
|---|---|---|---|
Registration procedure and time limits for setting of a44 bit | O | M | The base station will not be kept “open for registration” for longer than 120 seconds |
"Encryption activation FT initiated" (Base & Handset) Note : all voice calls encrypted | O | M | The base station and handset will support encryption activation, and the base will activate it for all |
On air key allocation (Base & Handset) | O | M | The base station will create and allocate a (64 bit) authentication key (UAK) when the |
Authentication of PP (Base & Handset) | O | M | The base can authenticate the handset (utilizing its UAK), to ensure it is the genuine handset, and not |
Evaluation of peer sides behavior regarding encryption including timeout values for triggering of call release | O | M | If the peer behaves differently as expected, e.g. it doesn’t initiate encryption in a timely manner, |
Early encryption | O | M | Guarantees encryption activation immediately after connection establishment, before any higher |
Procedure for re-keying with a new derived cipher key during a call | O | M | The cipher key used by the encryption engine is updated at least once per 60 seconds, to foil any |