Protecting the link before the conversation
Automatic Link Establishment helps HF radios find and establish a usable connection. Its linking-protection facility protects link-establishment traffic. A weakness can therefore affect authentication and availability, even before considering the confidentiality of voice or data carried over the resulting link.
Marcus Dansarie’s 2021 paper studies SoDark’s 24-bit block, 56-bit key and 64-bit tweak. Its practical result targets the eight-round cipher used by 2G ALE. The sixteen-round 3G variants must be treated separately.
What the attack assumes
| Experiment | Data and success point | Reported time |
|---|---|---|
| GPU known-plaintext attack | About 212.7 plaintext–ciphertext–tweak tuples at the paper’s 50% success point in its oracle model, with tuples generated for two suitable related tweaks. | 42 minutes |
| GPU chosen-ciphertext attack | 28 queries at the 50% success point, with an oracle returning plaintext for selected ciphertext/tweak inputs. | 42 minutes |
| Reference GPU brute force | Two known tuples; full-keyspace comparison. | About five days |
These are the paper’s dated Table 4 measurements on its six-Nvidia-GPU computer, not promises for a visitor’s laptop. The known-plaintext and chosen-ciphertext models provide different access. Capturing ordinary radio traffic is not automatically equivalent to possessing the chosen-ciphertext oracle.
What the result establishes
The small tuple count in Table 4 is not the passive interception requirement. For ordinary ALE frames, §3.4 derives about 221.9 intercepted three-word frames for a 50% chance of the needed pair; §3.5 carries that data complexity into the eight-round attack. Collection time is additional to the reported computation.
The implemented attacks undermine the stated linking-protection goals of the eight-round 2G system under their data assumptions. The paper does not demonstrate the same attack against the sixteen-round 3G versions. Nor is this a blanket claim that HF voice encryption has been broken.
The 24-bit block size, tweak structure, number of rounds and operational protocol all belong in the explanation. A key-length headline alone hides the properties the cryptanalysis actually uses.
Primary source and connections
Marcus Dansarie, “Cryptanalysis of the SoDark Cipher for HF Radio Automatic Link Establishment”, IACR Transactions on Symmetric Cryptology 2021(3), pp. 36–53. Peer-reviewed journal paper. See §3.4–3.6, §4 and Table 4, PDF pp. 8–15, for the oracle/passive distinction and implementation results. Author’s implementation.
Continue to NFC authentication and deployment to compare another gap between primitive-level protection and a system’s actual security goal, or visit modern cryptography.