Karsten works with Chris Paget at H4RDW4RE, a consulting firm they started to focus on hardware security. While all the high-end pentest firms will do hardware, only a couple have a practice focus in hardware; they compete with Nate Lawson's Root Labs and after that there's pretty much just Paul Kocher's Cryptography Research. These guys are going to have a blast.
The long and the short of it, they're going to take the academic result that you can precompute A5 and use a GPU cluster to build a rainbow table cracking implementation.
This result is a couple steps away from apocolyptic, but not all the way there:
* They haven't subverted GSM base stations (this is going to turn out to be doable, though). They can't pick a phone at random.
* They aren't publishing the GNU Radio code to sniff GSM. There are several free GSM projects, but putting the pieces together still requires talent, unlike wifi cracking.
* Regardless of whether these attacks are ever used in the wild, this will probably have a big effect on financial security, where GSM is used as a safe out-of-band authentication mechanism.
I have first-hand knowledge that this exploit is currently in use in the Middle East and is purchasable from at least one American corporation. It must be assumed that intelligence agencies have had this capability for the entirety of the GSM deployment.
Base station security is a separate matter. Why do you think A5/1 influences that?
A direct link to the presentation:
http://www.scribd.com/doc/18668509/HAR2009-Cracking-A5-GSM-E...
The long and the short of it, they're going to take the academic result that you can precompute A5 and use a GPU cluster to build a rainbow table cracking implementation.
This result is a couple steps away from apocolyptic, but not all the way there:
* They haven't subverted GSM base stations (this is going to turn out to be doable, though). They can't pick a phone at random.
* They aren't publishing the GNU Radio code to sniff GSM. There are several free GSM projects, but putting the pieces together still requires talent, unlike wifi cracking.
* Regardless of whether these attacks are ever used in the wild, this will probably have a big effect on financial security, where GSM is used as a safe out-of-band authentication mechanism.