Sources: We were pressured to weaken mobile security in the 80's

From what I understood, it wasn't the intelligence community that directly requested the changes, but rather the British part of the GSM working group (whatever that was called at the time).

>This sounds suspiciously like modern context being retrofitted to an ancient story.

This sounds like you're too young to remember that the "modern context" is what's actuall "ancient" -- it has been around since the fifties -- with several mass surveillance scandals along the way back in those decades.

As for the "ancient story" -- people in their early forties were active in the eighties tech world man. We still use tons of technologies from that era. Nothing ancient about it.

"This sounds suspiciously like modern context being retrofitted to an ancient story"

You do realize that the NSA spent most of the cold war trying to keep good cryptography out of civilian and foreign hands, right? The day after Rivest, Shamir, and Adleman published their paper, government agents showed up and put police tape around their lab. Also, this:

https://www.schneier.com/blog/archives/2008/01/nsa_backdoors...

And this:

http://www.usnews.com/usnews/news/articles/950403/archive_01...

AFAIK LTE/3G security is way better, but as you say it's possible to intercept calls in other ways, either by tapping lines or by doing MITM.

It would be interesting to know if LTE, being packed based, is is susceptible to attacks such as there: http://boingboing.net/2008/06/19/listen-in-on-encrypt.html

Didn't Karsten Nohl give a presentation about cracking A5/1? Of course NSA can crack A5/1.

From what little I could find, it is generally agreed that LTE uses the "SNOW 3G" stream cipher as part of the UEA2 confidentiality and UIA2 integrity algorithms from ETSI. Another source claims Release 8 requires the UMTS AKA (authentication and key agreement) procedure to support AES and no encryption options as well.

But is SNOW better than KASUMI aka A5/3? Why not just use AES? When I see non-standard and untested encryption algorithms, I think of the NSA and GCHQ. In any event, that's why I want E-ULTRA (the LTE communications protocol) implemented in GNU Radio: to disable SNOW 3G and null ciphers.

I should also note that, from what I can tell, in GSM/LTE all keys (including that for the link between the cell and the tower) are (statically/algorithmically) derived from the symmetric private key shared between the SIM and the service provider's Home Subscriber Server. Which, if I understand correctly, means it would be trivial to decrypt any surreptitiously intercepted but encrypted communications by using a NSL or subpoena to obtain those keys from the service provider or the access provider (assuming it wasn't already lawfully intercepted by the access provider of course). I assume that also holds true for any Joe Blow with subpoena power and the ear of a sympathetic judge (think "Doe subpoena"). So make sure your service is from a company located in an unfriendly nation, even if your access already is!

But if they would have just used (ephemeral) Diffie-Hellman for the cell-to-tower communications, they couldn't do that. Which is why when I see any GSM/LTE standards, I think of the NSA and GCHQ. The same goes for IPsec and the magic numbers used in some of these encryption algorithms.

Edit: more technical and legal discussion of consequences

Matthew Green wrote about GSM and LTE a few months ago:

http://blog.cryptographyengineering.com/2013/05/a-few-though...

TL;DR: GSM security is a joke. LTE is okay, except for two critical issues: One, an attacker can jam LTE and cause a downgrade to GSM. Two, it doesn't offer forward secrecy, so an attacker can record your traffic, obtain the private key from your carrier, and decrypt it. It's a reasonable assumption that NSA and your local sigint agency routinely make copies of your carrier's key database.

Edit: Reword last sentence.