Key reallocation Changing the encryption key for every transaction prevents impersonation and significantly raises intercept effort. This makes sense, once encryption is implemented. TMSI reallocation The temporary mobile subscriber identity (TMSI) is an identification number used in particular during call setup. Once an attacker is able to intercept the TMSI, they can impersonate their victim if the network does not renegotiate a new TMSI on every transaction. Furthermore, user location tracking is facilitated if TMSIs are not rotated frequently. Include IMEI in cipher command During encryption handshake, the mobile's first response is predictable. SALTing it with the IMEI increases entropy and mitigates known plaintext attacks. HLR lookup prevention We were unable to track a mobile number from the Internet using the HLR query "send routing info for short message." This is good, but can have multiple causes: 1. MPT blocks such queries in general (best practice), 2. MPT blocks such queries from certain providers / countries (okay, but not sufficient), and 3. We used inactive phone numbers for the test (error possibility). So, let's assume that the tracking protection is actually at 55 percent. 31