Export compliance
“The key reduction was therefore needed to comply with the Wassenaar Arrangement.”
TCCA says TEA1 was conceived to be easily exportable and that its equivalent 32-bit key length permitted worldwide export.
Read the TCCA responseExport Grade
TETRA · TEA1 · Key Reduction
Run real TEA1, watch its 80-bit key collapse into a 32-bit register, then recover that effective key against the same cipher.
FIELD NOTE / TETRA AIR INTERFACE
The cipher works. The key is still reduced.
TETRA is an ETSI trunked-radio standard used in more than 100 countries by police, military, transport, industry, and critical infrastructure. TEA1 is one air-interface stream cipher: it accepts ten key bytes, but its generator receives only one four-byte register.
- STANDARDIZED
- 1995
- INPUT KEY
- 80 bits
- WORKING KEY
- 32 bits
PANE 01 / COMPLIANCE FIRST
The Cipher
TEA1 is a stream cipher: a key and frame number produce bytes that are XORed with radio traffic. This implementation is a TypeScript port of Midnight Blue's Apache-2.0 reference.
TEA1 / OUTPUT10 BYTES
Reference KAT pending
Fixture: frame 0x11111111, zero key, expected d3 3f d8 a6 05 a0 a1 bb 90 23.
PANE 02 / THE HEADLINE
The Reduction
Feed the ten key bytes into the exact initialization loop. Each round shifts the register and appends one S-box byte; after all ten rounds, only four bytes remain.
NOMINAL INPUT bits
EFFECTIVE REGISTER bits
KEY BYTES0 / 10 loaded
GENERATOR REGISTER4 bytes
Register starts at 0x00000000.
Load all ten bytes to inspect the working key.
| Round | Input | S-box index | S-box byte | Register after |
|---|
PANE 03 / SEARCH AND RECORD
The Break
For browser tractability, the page selects the 216 window containing its local fixture's register. Every candidate in that window is checked with the same TEA1 core; the full space contains 65,536 such windows.
Default bytes spell “RADIO”. All-zero and short fixtures are rejected.
- CIPHERTEXT
- —
- KNOWN XOR CIPHER
- —
- BROWSER WINDOW
- —
WORKER / 65,536 CANDIDATES0.0%
0 / 65,536 tested
Ready. The full 32-bit space contains 65,536 windows of this size.
A previous result was retired because an input changed.
EFFECTIVE KEY RECOVERED
0x00000000
0 / 0 bytes reproduced
OK-AND-BROKEN — the cipher output matches byte-for-byte, and the working key is only 32 bits.
ONE LINE OF CODE / TWO FRAMINGS
Compliance or backdoor?
Intentional weakness
“A computational step which serves no other purpose than to reduce the key's effective entropy.”
The researchers characterize that intentional reduction as a backdoor. This lab shows the step and leaves the label to the evidence.
Read TETRA:BURSTTHE DISCLOSURE RECORD
From air interface to end-to-end
-
ETSI standardizes TETRA.
The professional radio standard goes on to serve public safety, military, transport, industry, and critical infrastructure in more than 100 countries.
-
TETRA:BURST · USENIX Security 2023.
Carlo Meijer, Wouter Bokslag, and Jos Wetzels disclose CVE-2022-24402, the TEA1 80→32-bit reduction, and CVE-2022-24401, an unauthenticated network-time route to induced keystream reuse.
-
2TETRA:2BURST · Black Hat USA 2025.
The same researchers report algorithm ID 135 reducing AES-128 traffic-key entropy to 56 bits (associated with CVE-2025-52941), alongside replay and injection findings. This lab reports that result; it does not re-derive it.
Record status checked 22 September 2026: the central 2025 CVE entries remain reserved, so these mappings are attributed to the researchers.
REAL-WORLD BOUNDARY
A lab, not an interception tool
This page uses local fixtures only. It includes no radio receiver, no deployed-network traffic, no TEA2, and no full TETRA stack. It does not imply that AES or modern radio cryptography shares TEA1's flaw.
PANE 04 / EXTRAPOLATION
The Wall
Exhibit 3 tested a measured number of candidates in a measured amount of time. That is one rate, from one browser, on one machine. This pane divides larger keyspaces by that rate. Nothing here is a second search and nothing here is a prediction — every row is an extrapolation, and the arithmetic is printed beside it.
NO MEASURED RATE YET — run the search in Exhibit 3 (The Break). This pane stays empty until your own machine has produced a number; it does not ship a default rate.
MEASURED IN THIS BROWSER
candidates/second
—
Bar length is the keyspace exponent on a log2 scale, 0 to 256 bits. The two marks are your own machine’s: the keyspace this rate clears in one second, and in one year.
Extrapolation pending.
WHAT THIS PANE DOES NOT SHOW
One machine is not a forecast
- The rate is one browser on one machine, measured once. These rows are order-of-magnitude illustrations, not predictions of what any attacker can do.
- The multipliers are assumptions you typed. The page renders whatever you enter and labels an absurd one as absurd; it does not know what hardware exists.
- Classical search only. Grover’s algorithm changes the exponent rather than the constant, and this pane does not model it — see Grover.
PANE 05 / PUBLISHED CRYPTANALYSIS
Paper vs Practice
“Broken” means one thing in a paper and another on a radio. Every row below is a published key-recovery attack on AES at its full round count, read out of the primary paper’s own summary table. Each sits under its brute-force line — and none of them finishes.
Bar length is log2 of the attack’s stated time complexity, 0 to 256. The dashed rule in each group is that key size’s brute-force line.
Attack table pending.
| Target | Attack | Model | Goal | Time | Data | Memory | Source |
|---|
SAME WORD / DIFFERENT UNIVERSES
Two things called a break
TEA1: the cost moved
The reduction in Exhibit 2 moves the real cost of TEA1 to 232. At the rate your own browser measured, that is —. Exhibit 3 already finished a window of it while you watched.
Run Exhibit 3 to fill in your machine’s number.
AES: the cost barely moved
The best published single-key attack moves AES’s cost to — — — below the brute-force line. At your measured rate that is —.
Academically broken. Practically untouched. The reduction in TEA1 was a different kind of event.
WHAT THIS PANE DOES NOT SHOW
Scoped to the algorithm, and to the classical setting
- “Practically secure” here is scoped to published cryptanalysis of the AES algorithm. It says nothing about any implementation: padding oracles, nonce reuse, and timing side channels break real systems whose block cipher is untouched. See AES Modes and Blind Oracle.
- Full-round key recovery only. The reduced-round attack frontier and what round counts buy is the security-margin view, and it belongs to Iron Serpent — this pane does not restate it.
- Classical figures only. Quantum search changes the exponent; this pane does not model it. See Grover.
- Nothing here certifies any deployed system, and nothing here transfers TEA1’s weakness to AES. The two ciphers share a page, not a flaw.