Encryption On P25 Radios

[Ozzyjim]

Gday, I have been doing some research on Motorola radios such as the XTS3000, spectra etc and have been looking into how the encryption modules are interfaced with the radio. The analog radio's that I have seen with encryption (all older models) seem to be from the baseband (Discriminator) circuit as the input source on the decode side. My question is, is this the same for Digital P25 radio's also or is the encryption done after the P25 codec?. Please note this IS NOT wanting to decode anything etc or the legalities of it (there has been enough talk about that already), but learning about the technical side of how things work.

Any help is appreciated,

Thanks, James.

[JnglMassiv]

Based soley on the fact there's absolutely no audio degradation or artifacts, I'm going to go out on a limb and say that the encoding must be applied to the digitized data.

[mancow]

The Astro radios have no conventional discriminator. It's a chip that digitizes the IF then passes it along to another chip that decodes the data packets and then sends them along to the dsp processor. The encryption is done via dedicated lines that lead from the DSP through the encryption module and back in to the DSP. What happens inside that DSP, I don't know but I assume that it's stripping out just the voice data and sending it to the module for encoding or decoding. There is a block diagram and theory of operation portion of the service manual that describes the RX and TX paths. You can see the data lines in the actual schematic. The radio is smart enough to detect a fault in the system and will fail if one of the lines are lifted during operation.

[MattSR]

JnglMassiv is correct in his assumption..

The daneils P25 manual reveals all - The audio is digitized by the IMBE codec, then the digital data that comes out of the is encrypted by the DES/AES Algorithm.

The reason the older radios used the Disc as a source is because the old encryption modules contained the Codec as well as the crypto algorithm (usually an old codec called CVSD) the audio was internally converted to digital in the EMC module, then encrypted.

[Ozzyjim]

thanks for your help,

Is there anywhere I can obtain a copy of the schematic or the daneils P25 manual?, if the encryption is done on the digital data I would assume all the header information before the voice data is also encrypted?. Is there anyway to tell what type of encryption is being used on a radio just by runing trunker software, I know the local police do use digital encryption and that it has a stauts bit of 8. Also mentioned is that the encryption units use the IF circuit (presume 10.7MHz) - the fact that there was a product manufactured a few years ago (AOR?) that used 10.7 output to reproduce the P25 audio on a analog radio, there was a post here describing how it could be used on a normal discriminator circuit with good results - Is it really necessary to use 10.7 on P25 radio systems?.

Sorry if I have rambled a bit, It's nearly 2:30am and am tired. Thanks again for your help,

James.

[MattSR]

Originally Posted by Ozzyjim

thanks for your help,

Is there anywhere I can obtain a copy of the schematic or the daneils P25 manual?, if the encryption is done on the digital data I would assume all the header information before the voice data is also encrypted?. Is there anyway to tell what type of encryption is being used on a radio just by running trunker software, I know the local police do use digital encryption and that it has a stauts bit of 8. Also mentioned is that the encryption units use the IF circuit (presume 10.7MHz) - the fact that there was a product manufactured a few years ago (AOR?) that used 10.7 output to reproduce the P25 audio on a analog radio, there was a post here describing how it could be used on a normal discriminator circuit with good results - Is it really necessary to use 10.7 on P25 radio systems?.

Sorry if I have rambled a bit, It's nearly 2:30am and am tired. Thanks again for your help,

James.

Gday James, The daniel's P25 manual is available in a few places - heres one --> http://www.p25.com/resources/P25TrainingGuide.pdf

The header is still in the clear. Thats why you can still see RIDs on an ENC transmission even if you dont have the key. The Algorithm ID is transmitted in the clear also, $80 = clear, $81 = DES, $84 = AES. The Daniels guide gives you more information on this.

You have misread what mancow is saying, the secure modules don't use the 10.7Mhz IF at all. They work off a digital bit stream sent from a DSP, once the data is secured its sent straight back to the DSP and then to the RF section.

To date none of the Trunker type programs have any "support" for giving info about a P25 voice stream. Rick came close with the kNACk, but for the info you want (algorithm type) nothing short of a $25,000 P25 service monitor is going to help.

Cheers,
Matt

[Ozzyjim]

Thanks for the info mate, so it is only the voice packets that are encrypted - not what I was expecting after reading other info on the net.

James