Airbus Statement to TETRA Security Algorithms Research Findings Publication on 24 July 2023

On July 24th, the findings of a group of security researchers (Midnight Blue) about the TETRA Air Interface Algorithms, which are part of the ETSI standard used by the whole TETRA industry, were made public. Those TETRA Air Interface Algorithms themselves will be made public at the beginning of August.

Airbus wants to reassure its customers about the nature of those findings. Indeed, none of them is critical for the security of Airbus Tetra products. Airbus recommendation is that its customers perform an impact analysis, in relation with their national security agencies and, if needed, with the support of Airbus, to decide whether actions need to be taken.

More precisely, the status regarding the main issues found by the Midnight Blue researchers is the following:

• Two issues can be solved by software updates of the existing TETRA systems. Airbus software currently includes these modifications and can be installed as part of the normal software update process.
• A third issue is related to the authentication algorithm. If the impact analysis recommends it, this issue can be solved by migrating to the newest version of the TETRA standard, which has been published in 2022 and will be implemented by TETRA vendors.
• The fourth issue is related to the fact that one of the TETRA Air Interface Encryption Algorithms, TEA1, has been designed to comply with export control regulations and has thus a reduced entropy. As a consequence, the confidentiality of communications encrypted with TEA1 relied on the secrecy of the algorithm, and, since this algorithm will become public at the beginning of August, mitigations might be needed depending on the impact analysis.

More information on the TETRA standard can be obtained from ETSI, and Airbus is at the disposal of its customers to answer questions related to its products.

Visit the European Telecommunications Standards Institute (ETSI) website for more information: 

https://www.etsi.org/newsroom/news/2260-etsi-and-tcca-statement-to-tetra-security-algorithms-research-findings-publication-on-24-july-2023