Problems with A5/3 encryption

This is merely a historical archive of years 2008-2021, before the migration to mailman3.

A maintained and still updated list archive can be found at

Bruckner Jan (ETAS-SEC/ECT-Mu) Jan.Bruckner at
Tue Mar 6 09:58:08 UTC 2018

Dear list,

I'm having trouble using the A5/3 encryption in my setup. A5/1 works perfectly fine [attachment a5_1.pcapng]. As soon as I switch to A5/3 and e.g. send an SMS, the last valid message I see in the Wireshark traces of the GSMTAP of osmo-bts-trx is the Ciphering Mode Command requesting A5/3. After that, several messages arrive at the bts, but it seems like it can't make any sense of them. The MS repeatedly tries to send the SMS but never succeeds  [attachment a5_3.pcapng]. Both MSs are connected to the same bts.

According to the Classmarks of all MSs, A5/1 as well as A5/3 are supported.

This is my Setup:

-       USRP N210

-       osmo-trx

-       osmo-bts-trx

-       osmo-nitb

-       osmo-pcu

-       osmo-sgsn

-       osmo-ggsn

I'm using a Debian 9 VM and tried both the packages from osmocom-latest as well as osmocom-nightly.

The MSs I've tested are two Nexus 6 and one Samsung Galaxy S I9000. All three with sysmocom nano USIMs.

Could the decryption at the bts be incorrect? Has anyone tested/used it recently?

I'll be happy to provide additional information if needed.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: a5_3.pcapng
Type: application/octet-stream
Size: 69644 bytes
Desc: a5_3.pcapng
URL: <>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: a5_1.pcapng
Type: application/octet-stream
Size: 11644 bytes
Desc: a5_1.pcapng
URL: <>

More information about the OpenBSC mailing list