One Key, Two Key, I Just Stole Your goTenna Key

One Key, Two Key, I Just Stole Your goTenna Key

Speakers: Erwin Karincic, Dale Wooden

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=DvtFoREyB0A

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Erwin%20Karincic%20Dale%20Wooden%20-%20One%20Key%2C%20Two%20Key%2C%20I%20Just%20Stole%20Your%20goTenna%20Key.pdf

Overview

When traditional communications infrastructure fails during disasters, first responders and emergency personnel turn to off-grid mesh radio networks like those provided by goTenna. These devices form device-to-device networks requiring no cellular or internet infrastructure — a critical capability during hurricanes, earthquakes, or terrorist events. At DEF CON 33, security researchers Erwin Karincic and Dale Wooden (with acknowledgment to Clayton Smith for his assistance) disclosed a critical cryptographic vulnerability in the goTenna Pro device that allows an attacker to recover private encryption keys through radio-frequency side-channel analysis.

The implications are severe: an attacker who recovers the encryption keys for a goTenna Pro mesh network can decrypt all historical and future communications on that network, forge or spoof messages, and potentially shut down communications in scenarios where lives depend on those radios. The researchers emphasized that the vulnerability generalizes beyond goTenna — any RF system with similar cryptographic implementation weaknesses is potentially susceptible to the same class of attack.

Background

▶ Watch: Vulnerability timeline: responsible disclosure to goTenna post-DEF CON 32 (0:54)

goTenna Pro: Architecture and Use Cases

The goTenna Pro is a portable, battery-powered device that creates infrastructure-free mesh networks using radio frequencies in the ISM or licensed bands. Messages are encrypted end-to-end and routed hop-by-hop through other goTenna nodes. The device is marketed to and used by:

• Military and law enforcement agencies
• Emergency management and FEMA-level disaster response teams
• Search and rescue operations
• Commercial enterprises in remote environments

The security model of goTenna Pro relies on strong end-to-end encryption between devices. The cryptographic keys are provisioned through the goTenna Pro app and stored on the device. Users reasonably assume that if the radio transmissions are captured by an eavesdropper, the content remains confidential because the traffic is encrypted.

The Threat Model

The researchers highlighted a specific and realistic threat scenario: an adversary who wants to intercept, modify, or disrupt first-responder communications during a critical incident. This could include:

• Arsonists monitoring fire department coordination
• Terrorists disrupting law enforcement during an event they orchestrated
• Nation-state actors targeting military field communications

The attack disclosed in this research requires the adversary to be within radio range of a goTenna device — a condition easily met in many first-responder deployment scenarios where the attacker is physically proximate to the incident.

Cryptographic Background

The goTenna Pro uses elliptic curve cryptography (ECC) for key agreement and digital signature operations. ECC, when correctly implemented, provides strong security. However, the security of ECC depends critically on the quality and secrecy of the scalar multiplication step: the private key is used as the scalar, and any information leakage about the scalar during the multiplication operation can be used by an attacker to reconstruct the full private key.

The researchers focused on power analysis and RF side-channel attacks — a class of attacks that exploit measurable physical signals emitted during cryptographic operations. While traditional power analysis requires physical access to the device (measuring current draw via a probe), RF side-channel attacks work at a distance, observing unintentional radio emissions from the device's processor and RF circuitry during computation.

Key Findings

▶ Watch: Cryptographic protocol: how goTenna Pro performs key exchange (8:39)

The core finding is a correlation power analysis (CPA) / electromagnetic side-channel vulnerability in the goTenna Pro's implementation of elliptic curve scalar multiplication. Specifically:

1. The device leaks measurable information about the private key scalar through variations in its RF emissions during the key operation phase.
2. By collecting a sufficient number of electromagnetic traces during observed cryptographic operations (key exchanges or signature generation), an attacker can apply statistical analysis to recover the private key.
3. Once the private key is recovered, the attacker can decrypt any captured traffic encrypted for that key and impersonate the device — forging signed messages that recipients will treat as authentic.
4. The vulnerability is not limited to a single-trace attack but requires multiple traces (the number was discussed in terms of practical feasibility with commodity SDR hardware).
5. The attack is passive during the collection phase — the attacker only needs to be near a device that is actively using its keys, without sending any packets to the target.

The researchers also noted that key provisioning in goTenna Pro involves symmetric "group keys" distributed to all members of a mesh network (e.g., a fire department's tactical net). Recovery of one device's key material can expose the group key, compromising the entire mesh.

Technical Deep Dive

▶ Watch: Impact: key recovery enables full mesh traffic decryption in tactical ops (20:17)

Side-Channel Attack Methodology

The attack follows a standard EM side-channel workflow adapted for the goTenna Pro's form factor and frequency:

Step 1: Trace Collection

An attacker positions a software-defined radio (SDR) with a directional antenna near a goTenna Pro device. The device must be performing cryptographic operations — this occurs during:

• Initial key establishment (device pairing/provisioning)
• Message authentication (each outgoing message triggers a signing operation)
• Key agreement for new group members joining the mesh

The SDR records I/Q samples (in-phase and quadrature components of the electromagnetic signal) during these operations. Each recording is called a "trace." Modern SDR hardware (e.g., HackRF, USRP, or even a low-cost RTL-SDR) is sufficient for initial collection, though higher-quality hardware improves signal-to-noise ratio.

Step 2: Signal Processing

Raw I/Q traces contain noise from the RF environment. Signal processing steps include:

• Bandpass filtering around the frequency range where processor-correlated emissions appear
• Trace alignment — synchronizing multiple traces to a common reference point (e.g., a preamble transmission) so that corresponding clock cycles line up across traces
• Demodulation to extract the power envelope or specific harmonic components that correlate with computation

Step 3: Correlation Power Analysis

CPA is applied to the aligned traces. The attacker creates a hypothetical power model for each possible key hypothesis (guessing one sub-key byte or bit at a time) and computes the statistical correlation between the predicted power value and the actual measured trace for that time sample. The hypothesis with the highest correlation coefficient is the correct sub-key value.

For ECC scalar multiplication, the Montgomery ladder or double-and-add algorithms used internally have operation-dependent data paths that produce measurable differences. The researchers demonstrated that goTenna Pro's implementation does not employ algorithmic countermeasures (such as scalar blinding, point blinding, or a constant-time ladder) that would defeat CPA.

Step 4: Key Recovery

After processing sufficient traces, the attacker iterates through the key hypothesis space and reconstructs the full private scalar (private key). The researchers measured the number of traces required under realistic noise conditions (outdoor RF environment at a specified distance) and confirmed the attack is feasible with non-specialized, commercially available equipment.

Downstream Attack: Traffic Decryption and Spoofing

With the private key in hand:

• Decryption: All messages on the mesh that were encrypted using the compromised device's key (or the group key derivable from it) can be decrypted. This includes retroactive decryption of any previously captured encrypted traffic.
• Impersonation/Spoofing: The attacker can construct valid signed messages that appear to come from the compromised device, potentially issuing false orders (e.g., falsely reporting a fire is extinguished, redirecting responders) to other mesh members who have no way to distinguish the forged message from a genuine one.
• Denial of service: By injecting crafted messages or replay attacks, the attacker can consume channel bandwidth or trigger application-layer confusion that disrupts coordination.

Generalizability

The researchers stressed that the goTenna-specific findings point to a broader class of vulnerability in field-deployed cryptographic devices:

• Devices designed primarily for ruggedness and battery life often trade off cryptographic implementation security.
• RF devices inherently emit more measurable side-channel information than devices with dedicated shielding.
• First-responder and military equipment frequently operates in environments where adversaries are physically present — exactly where side-channel attacks are feasible.

Any system using ECC without constant-time scalar multiplication and appropriate masking techniques is potentially vulnerable to this methodology.

Demo / Proof of Concept

▶ Watch: Live demo setup: intercepting goTenna Pro encrypted mesh message (21:53)

The live demonstration involved:

1. A goTenna Pro device actively exchanging messages with a second device on the same mesh network.
2. A receive antenna positioned at a practical standoff distance, connected to an SDR receiver.
3. Collection of electromagnetic traces while the device performed key operations.
4. Offline analysis applying CPA to the collected traces — shown on screen with correlation graphs indicating where the key bits were recovered.
5. The recovered private key used to decrypt a previously captured, encrypted message — displayed in plaintext.
6. A forged signed message injected into the mesh, accepted by the recipient device as authentic.

The demo validated the end-to-end attack chain from passive observation to full key recovery and message forgery.

Defensive Implications

▶ Watch: Surprising result: device wipes key and accepts forged messages (33:45)

For goTenna and Device Vendors

• Implement constant-time ECC scalar multiplication: Algorithmic countermeasures (scalar blinding, point blinding, Montgomery ladder with dummy operations, or adoption of a constant-time library) are the root-fix for side-channel leakage.
• EM shielding: Physical shielding of the crypto module reduces leakage amplitude.
• Key rotation: Frequent key rotation limits the window of exposure if keys are recovered. Automatic rotation on a short schedule (per incident or per time period) reduces the value of any single key compromise.
• Session key derivation: Use per-session ephemeral keys (ECDHE) so that long-term key compromise does not enable retroactive decryption of past sessions.

For Users and Operators

• Treat all goTenna Pro traffic as potentially compromised until goTenna releases a firmware update addressing the vulnerability.
• Rotate group keys after any suspicious activity or after a device has been in proximity to unknown individuals.
• Operational security: Avoid performing key provisioning operations in contested environments where adversaries may be within radio range.
• Defense-in-depth: Do not transmit information in goTenna messages that would cause irreversible harm if intercepted. Use out-of-band authentication (voice confirmation) for any message directing personnel to potentially dangerous actions.

Broader Industry Implications

Side-channel attacks are well-known in academic cryptography but are frequently treated as impractical in product design. This research demonstrates that the assumption no longer holds for radio-based field devices — SDR hardware is cheap, widely available, and increasingly capable. Device security programs for critical-infrastructure communications equipment should explicitly scope side-channel resistance testing as part of their security evaluation.

Key Takeaways

• goTenna Pro devices are vulnerable to electromagnetic side-channel key recovery by a proximate attacker using commodity SDR hardware.
• Recovered keys allow full decryption of all mesh traffic and message forgery, directly threatening mission-critical communications used by first responders.
• The attack requires no interaction with the target device — collection is passive during normal operation.
• The root cause is a lack of side-channel countermeasures in the ECC implementation, a common weakness in field-deployed cryptographic hardware.
• The methodology is generalizable to any RF-communicating device with similar implementation shortfalls.
• Vendors should adopt constant-time cryptographic primitives, hardware shielding, and frequent key rotation as baseline mitigations.
• The researchers reported the vulnerability through appropriate channels and coordinated with goTenna before public disclosure.

About the Speakers

Erwin Karincic is a security researcher with expertise in radio frequency (RF) security, hardware hacking, and cryptographic analysis of wireless communication systems. He has evaluated security in devices ranging from consumer IoT to tactical communications equipment.

Dale Wooden brings background in RF engineering and applied signal processing, with particular depth in software-defined radio platforms and side-channel attack tooling. Together, the team combines hardware and software expertise to attack the intersection of RF communications and cryptographic implementation — a space that receives far less scrutiny than traditional networked systems. Clayton Smith contributed to the project and was specifically acknowledged by the speakers during the presentation.