"Official" standards documents for DMR encryption

[morton1566]

Hey guys, I tried looking at the DMR Association's standards documents (Digital Mobile Radio Association | The DMR Standards, developed by ETSI) for information on how encryption is done within the DMR standard and interoperability (eg. if AES is used in CFB/OFB mode, what is used as the IV). I've only been able to determine from the standards documents that encrypted transmissions would usually have the Privacy Indicator (PI) header, but there's no information on how the encryption is done and no other technical specifications. I've also tried Google, but either my Google-fu is crap or there is simply scarce information on this online.

This is in stark contrast to the P25 standards, which have details on encryption mentioned in TIA-102 which is freely available, as well as Matt Blaze et al's paper on the security analysis of P25.

I'm not sure if encryption is intended to be a proprietary (and hence not publically available standard) part of DMR, but surely various radios that can interoperate on DMR encryption (eg. Motorola radios being able to talk to Hytera radios using DMRA AES-256) would need to follow a standard on how this encryption is done right?
It would be great if someone could point me in the right direction, or at least a brain dump on the technical details of DMR encryption as I'd be interested in learning about it. Of course, if this info is proprietary then I'd understand and not pursue this line of inquiry any further.

 

[SteveSimpkin]

I came to the same conclusion several years ago when I reviewed the DMR standards documents. Unlike P25, I assumed that the choice of encryption method implementation used with DMR was left up to the discretion of the manufacturer. If two or more manufacturers wanted to get together and agree to use the same encryption method for interoperability, that was fine. If they didn't and ended up using incompatible encryption methods, that was fine too.

 

[morton1566]

I came to the same conclusion several years ago when I reviewed the DMR standards documents. Unlike P25, I assumed that the choice of encryption method implementation used with DMR was left up to the discretion of the manufacturer. If two or more manufacturers wanted to get together and agree to use the same encryption method for interoperability, that was fine. If they didn't and ended up using incompatible encryption methods, that was fine too.

I did a little more digging since my last post, and I've come to the following conclusion (TLDR): the DMRA actually has interoperability standards for encryption, but for some reason the documents were simply not published on their site.

The story is, I decided to take a look on Google at where else any mention of DMR encryption would lead me back to the DMRA's site. By chance, I found mention of DMR encryption in MOTOTRBO - AES256 - Facts (note: site is US-accessible only) that led back to the DMRA's site, specifically the link http://dmrassociation.org/1-2/.
That said, that link leads back to the DMRA site homepage, not any mention of encryption.

Thinking that the DMRA site may have removed that link previously, I decided to go Web Archive hunting, and lo and behold it did exist previously. The most recent archive that actually contained content related to DMR encryption was Technical Working Group Activities before the site was revamped sometime in Jul/Aug 2016. Unfortunately, there is still no technical documentation on the actual implementation of DMRA encryption in that archive, but from what I can tell from that archive and the history of that page:
- the DMR Technical Working Group (TWG) (and by extension the DMRA) did have a interoperability standard after 2011,
- the standard defined ARC4, DES and AES128/256 as the interoperable encryption algorithms.
- that standard also has a "common definition for security"...which reads like "technical documentation" to me.

Now the question is: why was there a standard but no technical documentation published on it in public? And somehow, Motorola and Hytera (and recently Anytone) got access to this "documentation" and their implementation was official enough to be called "DMRA AES". Very interesting indeed...

 

[slicerwizard]

You should be reviewing the Motorola patents on DMR encryption...

 

[morton1566]

You should be reviewing the Motorola patents on DMR encryption...

Thanks for the tip, I didn't know DMRA standard encryption is actually Motorola patented technology...

Anyway, I looked up patents related to DMR encryption, and its been one interesting ride. I'm still running through the patents, but so far these are what I've got:

US8422679B2 - Method and device for sending encryption parameters - Google Patents - seems to be the main Motorola patent for DMR encryption.
US9351157B2 - Methods, systems, and devices to reduce audio truncation during transcoding - Google Patents - seems to be related to how Motorola's DMR encryption embeds encryption-related information in the DMR frames/superframes.
US8781132B2 - Method and device for managing encrypted group rekeying in a radio network link layer encryption system - Google Patents - related to Motorola's implementation of OTAR (rekeying)
CN106878277A - A kind of method and device based on DMR standard implementation voice encryptions - Google Patents - also related to OTAR, but a different implementation (note: original patent in Chinese)
CN102307075A - Voice transmission encryption method of DMR (digital mobile radio) communication terminal - Google Patents - Kirisun implementation of multi-key encryption, changes key every superframe (note: original patent in Chinese)

Let me know if I'm missing something or if you've got more info.

PS: @slicerwizard did DMRA just straight up use US8422679 and US9351157, or do you know of any changes they made prior to actual implementation?

 

[slicerwizard]

I don't know if DRMA did anything. The other manufacturers may have just used the same patents and some reverse engineering to get on the same page.

I don't think there are too many more details to find - it's very similar to P25 encryption, which is well documented, except for the MI being half the size and ES data being stored in stolen bits.