Short Message Service (sms) security solution for mobile devices

III. 
ENCRYPTION SCHEME SELECTION 
A. OVERVIEW 
Encryption is the process of disguising information in such a way as to 
hide its substance [28]. Modern encryption methods can be divided into 
symmetric key algorithms and asymmetric key algorithms. The One Time Pad is 
unique because it is the only encryption scheme that is unbreakable even in 
theory. The discussion in the rest of this Chapter will focus on these three types 
of encryption. 
This Chapter is comprised of four main parts. The first part of this Chapter 
provides an overview of the different schemes of encryption and their relevance 
to securing SMS. The second part discusses the key considerations when 
selecting an encryption scheme for deployment. The third part describes an 
experiment that was conducted to measure the performance of symmetric and 
asymmetric encryption schemes on a modern cell phone. The final part 
summarizes the findings in a selection matrix that may be useful for application 
developers, who plan on deploying encryption for SMS messages. 
B.
ENCRYPTION SCHEMES 
1. Symmetric 
Cryptography 
In symmetric encryption, the sender and receiver must have a pre-shared 
key that is kept secret from all other parties. The sender uses the key for 
encryption, and the receiver uses the same key for decryption. The key 
advantage of symmetric encryption is that it is computationally fast and efficient. 
This makes symmetric encryption the ideal choice for mobile devices. The A3, A8 
and A5 algorithms used in GSM are all symmetric encryption algorithms. Other 
strong symmetric algorithms available today include Triple Data Encryption

---

 32
Standard (TripleDES) and Advanced Encryption Standard (AES), which have 
been approved for use by National Institute of Standards and Technology (NIST), 
and are publicly available. 
The key disadvantages of symmetric encryption are the need to pre-share 
the keys among the senders and recipients and the keys must be exchanged 
securely via some trusted communications channel or through some key 
exchange mechanisms. In an infrastructure setup like GSM, this is manageable 
because all the subscribers share common keys with the service provider. If the 
subscribers need to communicate with each other, the service provider acts as 
the middleman and encrypts/decrypts the messages, as required. However, if 
symmetric encryption were to be used at the application layer, the key exchange 
would have to be managed separately and this can be quite a challenge because 
all the users of a group must use the same key. If the key is compromised, a new 
key must be redistributed to every user. If there is a need to partition the 
communications into sub-groups, different sets of keys must be created and 
distributed for each sub-group. A separate key is still required for the entire 
group. This complexity grows as the number of users and sub-groups increases.
Secure key exchange mechanisms, such as Internet Key Exchange (IKE) 
and Secure Socket Layer, have been developed to facilitate key exchanges 
across public networks. However, these protocols assume relatively high 
bandwidth, real-time connectivity between the sender and recipient. For example, 
the set up of an SSL session requires an exchange of at least four messages, as 
shown in Figure 12, before the secure session is established. For SMS, sending 
each message may take a few seconds. The exchange of four SMS messages 
for each session will affect the usability severely. 
Therefore, the ability to deploy symmetric encryption at the application 
layer for SMS will depend on the ability to exchange keys securely. The key 
exchange can take place through physical transfer via storage devices, or if the 
device is cradled and connected to a PC, with a VPN connection. In order to 
reduce the key distribution complexity, a star topology may be adopted, such that 

---

 33
all the clients will send all SMS messages to an application server for relay. The 
disadvantage of such a set up is the delay in transmission of messages because 
each message is effectively transmitted twice. However, it offers the advantage 
of simplifying key exchange. 
compute 
K=f(S, R
Alice
, R
Bob
)
Choose secret, S, 
compute 
K=f(S, R
Alice
, R
Bob
)
Alice
Bob
I want to talk, cipher I support, R
Alice
certificate, cipher I choose, R
Bob
{S}
Bob
, {keyed hash of handshake msgs)
{keyed hash of handshake msgs)
Data protected with keys derived from K
Figure 12. Secure Socket Layer (From Ref. [29])