Decryting Emcrypted IMBE

[opus]

I have just been pondering encryption and decrypting of such. These are just ponderings on my limited knowledge of such.

Basically encryption is running an algorithm on some data to get encrypted data. With IMBE this is done on the 144 bit voice frame I guess.

A scanner or radio without decryption capability will still decode the voice frame to some kind of audio.

I propose that some audio algorithm/transformation could be applied to the resulting audio to recover the original unencrypted audio.

It could be tricky, but a different method of decryption of IMBE.

Any thoughts on my ponderings.....

Opus

 

[mr_hankey]

...confused.

you mean DECODING, right?

and yes, a scanner does render IMBE into some kind of audio - some UGLY kind of audio!

 

[SCPD]

No, I think he means decrypting an encrypted IMBE encoded audio stream.

Interesting idea Opus but I can't begin to imagine how to go about accomplishing this. As long as the encrypting party is disciplined enough to frequently changes keys - the most you can hope for is listening to something many months old.

-rick

 

[zgafford]

After it has been rendered to the crappy audio by the scanner any chance of decrypting it would be destroyed I would guess. You would need the unfiltered audio. Kinda like you need the unfiltered audio for a discriminator to work.

The information needed to decrypt it would be imbedded in the signal but any changed to the signal with render the imbedded information useless

Just my thoughts

 

[ianw]

As RFmobile pointed out this might not be as straight forward as it initially looks. Even if a single unchanging encryption key is used that key is very unlikely to be used to say XOR against the datastream from the vocoder or as the key to DES encrypt the vocoder datastream. Far more likely the key will be used initialise a pseudo random number generator of some form. So unless you know say the frame number then you aren't going to make much progress.

Don't get me wrong I'm not saying this is impossible just very very difficult. Even so its something that advanced hobbyists are going to be thinking about quite a lot in the years to come.

Ian

 

[opus]

No confusion here. I do mean decrypting. But another fun project would be to decode APCO-25 to get RIDs etc. But that is another topic.

Thanks all for your thoughts. I think it would be quite difficult too, but not impossible. I was talking to someone who said that encrypted IMBE would never be decrypted. I am not one to say never. I agree it is a bit difficult thing to do but give it a few years.....

I like to get minds thinking.

Opus

 

[N_Jay]

No confusion here. I do mean decrypting. But another fun project would be to decode APCO-25 to get RIDs etc. But that is another topic.

Thanks all for your thoughts. I think it would be quite difficult too, but not impossible. I was talking to someone who said that encrypted IMBE would never be decrypted. I am not one to say never. I agree it is a bit difficult thing to do but give it a few years.....

I like to get minds thinking.

Opus

The problem is not decypting the IMBE, it is breaking the DES3 or AES in less time than the agency changes codes given the little pieces of fairly random data that you have to work with.

Maybe some don't grasp the sophistication of modern encryption systems, but you are not going to stumble into the answer with out many years of post-graduate level mathmatics.

I would guess that the encryption is not just done on the IMBE stream, but on the entire payload. Since the IMBE is a non-linear transform, there would be no way to decrype the audio post the incorrect IMBE conversion.

 

[ianw]

This is an interesting thread. Out of interest has anyone ever monitored
a fully encrypted APCO25 system (i.e where all the users are encrypted).
If so is only the actual voice data encrypted ? Is the signalling encrypted ? and are radio identities encrypted ?

Tetra/Tetrapol make a big play of encrypting the the entire control channel and in some cases encrypting radio identities to prevent any kind of traffic analysis.

Regards

Ian

 

[N_Jay]

This is an interesting thread. Out of interest has anyone ever monitored
a fully encrypted APCO25 system (i.e where all the users are encrypted).
If so is only the actual voice data encrypted ? Is the signalling encrypted ? and are radio identities encrypted ?

Tetra/Tetrapol make a big play of encrypting the the entire control channel and in some cases encrypting radio identities to prevent any kind of traffic analysis.

Regards

Ian

This stuff was designed from the ground up with the US Gov encryptions needs in mind.

What do you think?

 

[ianw]

This stuff was designed from the ground up with the US Gov encryptions needs in mind.
What do you think?

I don't know since I have never seen any trade advert mentioning any APCO25 system with these capabilities. Since APCO25 was never designed never appears to have been designed for military or para-military use it may not have them. Also since APCO25 seems to have encryption almost as an "bolt on" afterthought makes me wonder.

Regards

Ian

 

[mr_hankey]

This stuff was designed from the ground up with the US Gov encryptions needs in mind.

never assume anything.

about 7 years ago, i was in Laredo, TX, which is infamous for having DES encrypted their entire PD channel set when i noticed PERIODICALLY i would get an officer in the clear...

a little poking around hinted that early in the deployment of the system, there was a concern about the Mobiles not being able to sync properly if DES was used all the way around, so i BELIEVE the mobiles were in the clear...the encryption seemed to be taking place at the repeaters...

i couldn't find any other way to explain this phenomenon at the time...

now, on a recent trip, i heard nothing but DES on every channel regardless of how close i was to the mobiles...

perhaps i was right?

either way, it shows that the human factor still plays a major role in system deployment (and communication encryption capabilities)

 

[N_Jay]

This stuff was designed from the ground up with the US Gov encryptions needs in mind.
What do you think?

I don't know since I have never seen any trade advert mentioning any APCO25 system with these capabilities. Since APCO25 was never designed never appears to have been designed for military or para-military use it may not have them. Also since APCO25 seems to have encryption almost as an "bolt on" afterthought makes me wonder.

Regards

Ian

Take a look at the TIA Standards that make up P25.
Take a look at the organizations and agencies involved in P25 from teh start.

 

[N_Jay]

This stuff was designed from the ground up with the US Gov encryptions needs in mind.

never assume anything.

Nope, don't assume, but make logical extensions to your knowlege and test for errors.

In other words, "Assuming and ASSUMPTION is wrong, is no better than an untested assumption."

This stuff was designed from the ground up with the US Gov encryptions needs in mind.

about 7 years ago, i was in Laredo, TX, which is infamous for having DES encrypted their entire PD channel set when i noticed PERIODICALLY i would get an officer in the clear...

a little poking around hinted that early in the deployment of the system, there was a concern about the Mobiles not being able to sync properly if DES was used all the way around, so i BELIEVE the mobiles were in the clear...the encryption seemed to be taking place at the repeaters...

i couldn't find any other way to explain this phenomenon at the time...

Either that or some foeld equipment was incorectly programmed or used.
(MUCH more likely)

This stuff was designed from the ground up with the US Gov encryptions needs in mind.

now, on a recent trip, i heard nothing but DES on every channel regardless of how close i was to the mobiles...

perhaps i was right?

either way, it shows that the human factor still plays a major role in system deployment (and communication encryption capabilities)

The older DES/DVP systems were signififcantly different than P25 ystems.

In either case, I do not know of any system that would be designed with clear comms in and DES out.

(For security reasons most repeaters are set up as "transparent" and do not have the hardware nor keys to encrypt or decrypt.)

 

[SCPD]

Out of interest has anyone ever monitored a fully encrypted APCO25 system (i.e where all the users are encrypted). If so is only the actual voice data encrypted ? Is the signalling encrypted ? and are radio identities encrypted?

On P25, both voice and control channel information *can* be encrypted - it's up to the system manager to take advantage of these features. Also, encryption - on P25 systems at least - should not impact sound quality.

-rick

 

[ianw]

On P25, both voice and control channel information *can* be encrypted - it's up to the system manager to take advantage of these features. Also, encryption - on P25 systems at least - should not impact sound quality.
-rick

Thanks Rick. Has anyone come across an encrypted control channel in the mainland US yet ?

Regards

Ian

 

[INDY72]

Umm one word, three letters.. ESK.. thus CC on EDACS is encrypted,... on the EDACS Provoice format.. which is a IMBE with modifications if I understand it right.. thus a sorta P-25 system.. add the ESK,.. and you have an Encrypted CC on a P-25 system. ?????

 

[N4DES]

Umm one word, three letters.. ESK.. thus CC on EDACS is encrypted,... on the EDACS Provoice format.. which is a IMBE with modifications if I understand it right.. thus a sorta P-25 system.. add the ESK,.. and you have an Encrypted CC on a P-25 system. ?????

State of Florida is doing just this with their new system currently in operation in the north areas of the state.

 

[INDY72]

The State of Florida's System is even worse than that... EDACS Provoice in all digital mode with ESK, and most State Agencies full time Encrypted.... I guess thier being extra paranoid of both drug dealers (the big timers) and homeland security issues. Any way, this makes this the most unmonitorable system in the USA.

 

[N_Jay]

Umm one word, three letters.. ESK.. thus CC on EDACS is encrypted,... on the EDACS Provoice format.. which is a IMBE with modifications if I understand it right.. thus a sorta P-25 system.. add the ESK,.. and you have an Encrypted CC on a P-25 system. ?????

You don't get it do you?

Sorry, for the attitude, but we have been round this topic many times.

Lets, at least, TRY not to confuse the people on this board.

P-25 is a set of standards.
The minimum set for compliance is called the CAI (Common Air Interface).
It includes;
a SPECIFIC MODULATION (Not just one related or close)
a SPECIFIC VOCODER (Not just one from the same family)
SPECIFIC CHANNEL CODING (Not just any 9600 bps rate)
It also includes encryption and trunking control standards, although they are not mandatory.

Yes IMBE was selected for the vocoder, but that does NOT make any other system using IMBE "sorta P-25"!

PROVOICE is NOT P25!
EDACS is not P-25 Trunking.

 

[mr_hankey]

of COURSE provoice is P25!

on conventional talkarounds with your 7100!

yuk yuk yuk!