Tech Tracker: Can Passive Radio Eavesdroppers Listen In On Your Company?

DECT TO THE RESCUE?
Digital Enhanced Cordless Telephony phones may provide additional protection. DECT is a telecommunications standard develop by the European Telecommunications Standards Institute that standardizes communications protocols between handsets and base stations. In the United States, DECT uses a dedicated frequency band, 1,920 to1,930 MHz, which is well outside the unlicensed 2.4-GHz and 5.8-GHz spectrums.

DECT provides for better interference management and mobility in addition to security features, including authentication and encryption. The authentication component is used to pair a handset with a base station. For example, today's digital phones pair to base stations using a subaudio tone that identifies which signals the handset or base station should accept. If a signal that doesn't have the correct subaudio tone is received, the device won't listen. DECT takes this a huge step forward by specifying that two devices actually authenticate each other before establishing a communications channel. Optionally, the handset and base station can also encrypt communications (see diagram, p. 51).

DECT authentication and encryption algorithms are available to equipment manufacturers only after they agree not to publically disclose technical details. However, what cryptography experts like Bruce Schneier have told us, and experience with proprietary algorithms and poor implementations like WEP has demonstrated, is that getting cryptography right is hard, and hiding the algorithm provides no protection against reverse engineering.

DECT's authentication and encryption implementations may stop some eavesdropping, but we wouldn't recommend them in situations where secure communications are needed until the implementation details have been analyzed by experienced cryptographers and the cryptographic mechanisms are proven strong.