Diffie-Hellman Picture Show: Key Exchange Stories from Commercial VoWiFi Deployments

Gabriel Karl Gegenhuber,Florian Holzbauer,Philipp Frenzel,Edgar Weippl,Adrian Dabrowski

2024-08-07

Abstract:Voice over Wi-Fi (VoWiFi) uses a series of IPsec tunnels to deliver IP-based telephony from the subscriber's phone (User Equipment, UE) into the Mobile Network Operator's (MNO) core network via an Internet-facing endpoint, the Evolved Packet Data Gateway (ePDG). IPsec tunnels are set up in phases. The first phase negotiates the cryptographic algorithm and parameters and performs a key exchange via the Internet Key Exchange protocol, while the second phase (protected by the above-established encryption) performs the authentication. An insecure key exchange would jeopardize the later stages and the data's security and confidentiality. In this paper, we analyze the phase 1 settings and implementations as they are found in phones as well as in commercially deployed networks worldwide. On the UE side, we identified a recent 5G baseband chipset from a major manufacturer that allows for fallback to weak, unannounced modes and verified it experimentally. On the MNO side -- among others -- we identified 13 operators (totaling an estimated 140 million subscribers) on three continents that all use the same globally static set of ten private keys, serving them at random. Those not-so-private keys allow the decryption of the shared keys of every VoWiFi user of all those operators. All these operators deployed their core network from one common manufacturer.

Cryptography and Security,Networking and Internet Architecture

What problem does this paper attempt to address?

The problems that this paper attempts to solve are: to analyze and evaluate the security and configuration issues of VoWiFi (Voice over Wi-Fi) in actual deployments, especially the key exchange methods used in the first - stage IPsec tunnel establishment process and their security.

Specifically, the paper focuses on the following aspects:

1. **Use of weak encryption algorithms**: It has been found in the research that some mobile phones and network operators still support and use the obsolete and weaker Diffie - Hellman (DH) groups (such as DH1768 and DH21024), and the security of these groups is no longer sufficient to withstand modern attack means. For example, some 5G baseband chips allow fallback to an unpublished weak mode, and this has been verified by experiments.

2. **Security configuration issues of operators**: The paper points out that there are 13 operators worldwide (covering about 140 million users) using the same set of static private keys on three continents, which makes the shared keys of all VoWiFi users of these operators decryptable. The core network devices of these operators are from the same manufacturer, presenting a serious security risk.

3. **Risk of key exchange downgrade attacks**: The paper explores how secure VoWiFi connections are in the real world and whether there is a possibility of downgrading to weaker and crackable key exchange methods. For example, only 42% of operators will try to upgrade to a stronger group when the client selects a weaker DH group.

### Research questions
To conduct in - depth analysis of these issues, the paper proposes the following research questions:
- **RQ1**: What VoWiFi key exchange methods and security parameters are preset by mobile phones for mobile network operators (MNO)?
- **RQ2**: What key exchange methods are actually supported by operators on their ePDG, and will they always give priority to the strongest method?
- **RQ3**: How strong are VoWiFi connections in the real world, and what is the probability of downgrading to weaker and crackable key exchange methods?

### Main findings
- Most operators do not comply with 3GPP regulations and are still announcing and supporting obsolete DH groups smaller than 2048 bits.
- Only 42% of operators will try to upgrade to a stronger group when the client selects a weaker DH group.
- Some mobile phone manufacturers silently support the very weak DH1768 group, although they will not propose it during the handshake process.
- At least 13 operators use the same set of private keys globally, making all VoWiFi users of these operators face potential security risks.

Through these studies, the paper reveals the technical debt and security vulnerabilities existing in the VoWiFi ecosystem and puts forward some improvement suggestions.