For this reason, Murgatroyd has observed that radio buyers based in Tetra are free to distribute other solutions for end-to-end encryption on their radio, but recognizes that the one produced by the TCCA and approved by Eti “is widely used for what we can say”.
Although the radio devices based in Tetra are not used by the police and military in the United States, most of the police forces are using them. These include police forces in Belgium and Scandinavian countries, as well as Eastern Europe countries such as Serbia, Moldova, Bulgaria and Macedonia and in the Middle East in Iran, Iraq, Lebanon and Syria. Defense ministries in Bulgaria, Kazakhstan and Syria use them, as well as the Polish military counterintelligence agency, the Finnish defense forces and the intelligence services of Lebanon and Saudi Arabia. It is not clear, however, how many of these also distribute an end-to-end decryption with their radio.
The Tetra standard includes four encryption algorithms – Tea1, Te2, Tea3 and Tea4 – which can be used by radio producers in different products, depending on the customer and the use provided. Algorithms have different levels of safety according to the fact that the radio will be sold inside or outside Europe. Tea2, for example, is limited for use on radio used by police, emergency services, military and intelligence agencies in Europe. Te3 is available for police radio and emergency services used outside Europe, but only in the countries deemed “friendly” for the EU. Only Tea1 is available for radios used by public security agencies, police officers and military agencies in countries deemed unspoken for Europe, such as Iran. But it is also used in critical infrastructures in the United States and in other countries for machine machine communication in industrial control contexts such as pipelines, railways and electric networks.
All four tetra encryption algorithms use 80 -bit keys to ensure communication. But Dutch researchers revealed in 2023 that Tea1 has a feature that makes the key laugh at only 32 bit, which has allowed researchers to break it in less than a minute.
In the case of the Index, the researchers discovered that the implementation they examined starts with a more confident key than those used in the tetra algorithms, but is reduced to 56 bit, which would potentially allow you to decryst the voice and data communications. They also found a second vulnerability that would have allowed someone to send fraudulent messages or to reproduce legitimate ones to spread disinformation or confusion to the staff using radio.
The ability to inject vocal traffic and the reproduction of messages affects all users of the TCCA end-to-end encryption scheme, according to researchers. They say this is the result of defects in the design of the TCCA E2EE protocol rather than a particular implementation. They also say that the “end users of the police” have confirmed them that this defect is on radio produced by seats other than sepura.
But researchers say that only a subset of end-to-end encryption users is probably influenced by reduced key vulnerability because it depends on how encryption has been implemented on radio sold to various countries.