Adding low-cost ADP encryption could be a pricy decision

[radioman2001]

An interesting article about how easy ADP encryption can be broken. Any body have more info on the supposed software to do it? Also sounds like someone doesn't like Motorola ( He is a Harris dealer) and their attempt to make thier radio radios propriatary within a P-25 system. Adding low-cost ADP encryption could be a pricy decision -- Urgent Communications article

 

[dizwiz]

Harris stinks. I used to work for them one time.

thumbs down.

Motorola all the way.

 

[bezking]

ADP is based on RC4 encryption, which is 40-bit. By contrast, AES-256 (the strongest commercially-available encryption algo you can use with Moto's P25 gear) is, you guessed it, 256 bits. This represents an astronomical difference in how hard it is to "crack" the algorithm. While it is certainly easier to break ADP, the real difference is if they catch you doing it - you are committing a federal crime and they can toss you in jail.

ADP is sold to departments who would otherwise be unencrypted but want to kick the scanner users and feed listeners. I seriously doubt you'll ever see the Secret Service, etc using ADP for any kind of sensitive communications.

 

[grem467]

say what you want about motorola vs harris vs kenwood, having a competitive environment is good for public safety, taxpayers and the industry as a whole. Anything you add that vendor locks you into one brand of subscrbers typically defeats the advantages of an open standard radio system. DES and AES are standards specified in TIA102. While ADP rides on top of P25, it is a non P25 compliant encryption mechinism. While i understand why TIA chose to allow optional vendor "secret sauce" features, i think vendors (not just Moto, but many others) have used this as a way to make the systems proprietary to ther own line of radios.

 

[ki4gyw]

I need to call that place if they have a $125.00 P25 scanner! I guess he is making reference to DSD plus a linux based pc, lol...

 

[Forts]

....and I'm curious what this 'hacker program' is that will pop ADP in a few hours.

 

[902]

Random thoughts from a random man

One must always be suspicious of the bias introduced by any author - and any personal opinion and interpretation. I've come to hate writing as "me" in real life (not as "902") because I have to be extremely careful that I minimize any personal bias, and that I fact check things. It takes a very long time and I usually run it by several people before I send it to the editor. I've had a number of things that I thought were harmless and amusing come back to bite me (read: you'd think it might have advanced me professionally, but noooo...).

Glenn should have labeled this as an editorial.

The only people who should be interpreting SAFECOM are SAFECOM and the SAA (state administrative agency... the people who administer the grant locally)/SWIC (state[wide] wireless interoperability coordinator). Otherwise, it's an opinion, just like this is.

But, Tschetter misses the point. ADP is a proprietary adulteration that thwarts an open competitive standard. You can buy equipment that meets the standard, call yourself standards-based, and then be completely incompatible with whatever else is supposed to meet the standard. I'm sure others have theirs, too. Someone probably got a nice dark blue blazer with a U-shaped crest on the left pocket for that trick.

DES(-OFB) shouldn't even be mentioned anymore, as it's only current reason for existence is retrocompatibility with pre-AES legacy equipment.

As for one manufacturer being good and the other not, I've seen really, really good things from both of the ones mentioned, and I've seen really, really bad things. Motophiles - would you ever want to buy a VHF Mostar?

 

[brownlab]

Yes, where do we get that $125 scanner? LOL

 

[slash]

It's a giant waste of money. It will do nothing to stop criminals and will only punish and anger the legitimate listeners.

 

[radiomanNJ1]

It's a giant waste of money. It will do nothing to stop criminals and will only punish and anger the legitimate listeners.

How is it a big waste of money? It doesn't cost much if anything today from Motorola. If you can't hear it then how are the criminals? Are they going to be carrying a computer with them? Most of them don't have the brains to work at McDonalds. Aren't the ones with scanners getting caught?

You are not going to stop the wave of encryption. I know of a place that will be encrypting everything in their city soon, including fire and possibly public works.
They are tired of the press jumping on everything.

 

[SCPD]

They are tired of the press jumping on everything.

If they do their job right, they won't get pounced by the press. They just might get recognition for their hard work.

 

[slash]

How is it a big waste of money? It doesn't cost much if anything today from Motorola. If you can't hear it then how are the criminals? Are they going to be carrying a computer with them? Most of them don't have the brains to work at McDonalds. Aren't the ones with scanners getting caught?

You are not going to stop the wave of encryption. I know of a place that will be encrypting everything in their city soon, including fire and possibly public works.
They are tired of the press jumping on everything.

I realize it's not going to stop the wave of encryption, but it's not going to stop the wave of tech savvy criminals from listening either. Anything more than free, to me personally, is a waste of money.

It might make things more dangerous if police suddenly assume that they can use their encrypted radios to disclose sensitive information that they might otherwise have omitted from the air waves, particularly with low-grade encryption and especially against the likes of well-funded organized crime. I read somewhere once that the Mexican cartels have equipment that can listen in on Nextel (iDen) two-ways near the border. I've also heard that P25 encryption has been broken, too by researchers in Australia.

Regarding the press, that's understandable -- if not a little eyebrow-raising as to what exactly they don't want being disclosed since they are public servants. I've never heard of any press people being arrested for interfering with emergency calls, let alone scanner listeners, only reporting facts. There simply isn't always good communication between the media and public safety if there's an imminent threat or breaking news.

All a criminal needs is a smart phone to listen remotely and a tech-savvy criminal with a decrypted radio to set up a dedicated internet feed (not on this site, obviously). All I'm saying is it sort of defeats the purpose if it truly doesn't put an end to criminals being able to listen in. It didn't take long before RC4-based wifi encryption (WEP and WPA) was cracked.

 

[MTS2000des]

the right to listen mantra falls on deaf ears.
it's no secret, online streaming widens the audience for public safety radios.
This includes unwanted persons who might not likely be tuned in, including media organizations far off from the scene of an incident.

ADP is a cheap answer to preventing online streaming and unwanted monitoring. It requires no maintenance. Keys are loaded in the subscriber CPS, no special cables or key loading hardware needed. It's very user friendly, does not degrade audio quality or range, and keeps scanners out.

That being said, it is proprietary. And if an agency uses ADP, they lock out any other P25 CAI from interoperating on an ADP encrypted network, trunked or conventional. It also prevents those nearby agencies with say, a Harris P25 radio, from scanning. This defeats the purpose of P25 to begin with.

Allowing manufacturers the "proprietary features" is completely contrary to the point of an established standard.

But I can certainly understand why ADP is so popular with Motorola Astro 25 customers. It's dirt cheap, easy to manage, and does what it is advertised to do: make P25 eavesdropping useless.

 

[slash]

the right to listen mantra falls on deaf ears.

I think you're right. That said, I know encryption is inevitable and no amount of contrary evidence that it's not truly secure will convince them, but it certainly would be nice for departments to implement policies that open up their emergency communications to selected civilians who undergo a background check and have a legitimate interest (like neighborhood watch types). RR would make a great platform for that, especially with the plans to allow private feeds in the future. Civilians can be helpful people, and sometimes having the scanner on when things are going sour in your neck of the woods, having an non-intervening set of eyes and ears can be very valuable.

 

[balibago]

Where is the software?

You can get anything on the internet if you look long enough; child porn,call girls, narcotics,even other peoples identities so where is the software to crack this ADP? I assume some hacker is out there making it right now.

 

[bezking]

It's not that it can be "broken," per se. With the technology available today (cluser computing, GPU cores, etc), it's not entirely unreasonable that you could decrypt something encrypted to a 40-bit key by taking a sample and literally guessing every possible key (notwithstanding federal laws against decoding encrypted comms).

It's time-consuming and could be expensive, but it's not impossible. And, of course, you have to go through the process again if they change the keys.

 

[902]

It's not that it can be "broken," per se. With the technology available today (cluser computing, GPU cores, etc), it's not entirely unreasonable that you could decrypt something encrypted to a 40-bit key by taking a sample and literally guessing every possible key (notwithstanding federal laws against decoding encrypted comms).

It's time-consuming and could be expensive, but it's not impossible. And, of course, you have to go through the process again if they change the keys.

And that was the real premise behind some agencies encrypting. It's not that they had state secrets to protect, but by the time anyone bothered to decode things, the information wouldn't be relevant anymore.

 

[jets1961]

not accountable

So according to your logic this "city" is not accountable to their taxpayers. As far as I am concerned encryption of communication, police in particular for general dispatch should be illegal in any free country in the world.

Our government(s) should be standing up for our right to know, not preventing it, what happen to the freedom of information?

Where I live the police encrypted just to stop bad press getting out about our city.

snip
You are not going to stop the wave of encryption. I know of a place that will be encrypting everything in their city soon, including fire and possibly public works.
They are tired of the press jumping on everything.[/QUOTE]

 

[radioman2001]

First the author works for a Harris dealer, the largest one in the NYC Metro area, and they are probably getting killed on bids since they can't provide a cheap alternative to AES. (typical Motorola stategy) Maybe Harris should come out with one. Second ADP is easy to break not because the encryption itself is weak, it's because they store the key in clear text in the codeplug. (reason author states easily broken by program from internet it's called Hexedit and note pad) A 40 bit key is still pretty formidable, but is a lot easier to brute force break than even good old DES. Now as far as getting caught, not very likely.

 

[mk262]

And that was the real premise behind some agencies encrypting. It's not that they had state secrets to protect, but by the time anyone bothered to decode things, the information wouldn't be relevant anymore.

That assumes they rekey and frequently at that.