OK, first off, as was stated before, it is illegal to decrypt an encrypted radio transmission. Has been since the 1930's. What follows will therefore be for educational purposes only. It's also based on alot of educated guesswork, so it may or may not be 100% correct.
On this site is a transcript of the famous "digital scanner" usenet post from a LOOOOONG time ago.
http://www.trunkedradio.net/trunked/stuff/astro.txt
Here's the part that we're interested in for this thread:
Now if the IMBE voice is encrypted we are out of luck, sort of... APCO-25 calls for a the DES encryption method with 56bit keys. I guess there are public domain DES rotines out there, anyone what to try and decode a DES encrypted call, might take years. I have a theory, since I have noticed that IMBE voice calls always begin and end with a fixed pattern we have information that makes it tons easier to decrypt. We can try different keys on the data until it matches this fixed pattern at the begining and end of the IMBE voice call... once we have the key its simple to run the DES decoder and get the raw unencrypted IMBE voice data.
Sounds wonderful, doesn't it? Well unfortunately for this guy (and the rest of us) Motorola was smarter than that. I know, I know... total bummer.
Judging by how my BC250D behaves while receiving an encrypted comm, the description given by the anonymous college kid isn't even remotely true or possible. It can't be. The scanner still recognizes that the transmission is P25 digital, it even syncs up and starts decoding audio without skipping a beat - the only problem is, it has no way to know the bits have been rearranged
within each packet, so it ends up decoding garbage. Only when the decoded audio hits a certain frequency threshold does the scanner realize it's encrypted. That's why it can take up to 4 seconds of drunken R2D2 noises before you see ENC on the 250D's LCD screen. This tells me the "fixed pattern" he is referring to remains unencrypted and only the bits in between are scrambled. ARGH!
So does that mean it's impossible to do?
In a word: No. It CAN be done. It is most certainly NOT impossible. But, is it practical? IMHO, no way. But who knows, someone here may not think so.
OK, you're asking, how do you do it Mr. Wizard?
Well, I'll try to keep this brief.
1. You will need to create or acquire some software capable of decrypting the raw data using the DES standard. (there are free source code libraries that you can use - google will give you a list). For the real techno-geek, here's a link to the DES standard itself:
http://www.itl.nist.gov/fipspubs/fip46-2.htm
2. You need a way to store a sample of the encrypted voice data from your scanner into the computer. A 4 level interface and a discriminator tapped scanner can provide this.
3. You need to write a program that will try random 56 bit keys on the data and feed the processed result out to a digital scanner (see step 4). In addition, the program has to be smart enough to detect whether or not the scanner still says it's encrypted or not. That means you'd have to use a Uniden model so you could poll it under computer control. Remember also that the frame sync patterns remain in the clear - only the data packets themselves are encrypted. This means you'll need to know the P25 CAI standard too. You can purchase the relevant documents online, but they are not cheap.
4. You need to figure out a way to get the processed result out to your digital scanner so you can recover the voice audio. It's not too tough to simply feed that data to a wave file that could be output via the sound card but the trick would be getting it into the scanner from there! You could hack into the scanner and tap the vocoder input, but a much simpler method would be to hack the transmit side of a baby monitor (replace the mic with a plug that would go to your line-out on your soundcard) and then tune that channel with your scanner. 8)
5. Lots and lots of free time to run your program, as there are 70 quadrillion possible keys that it could be. Most agencies will change their key periodically, some only do it once in a blue moon, others do it once a day. At any rate, if you somehow managed to guess the right key, it would only work until they change it. Then you're back to spending potentially MONTHS or even YEARS trying to find the new key. But, if you've got the skills and the time, it could be done. The nice thing is, your scanner will tell your program when you got it right - meaning that you could start it running and just check back on it from time to time....
5. If you ever got it right, you'd need another program that applies the key to the raw data as it comes in and then outputs the result to your soundcard. Then, using your baby monitor and scanner, you'd have a crude but working decryption station.
I have no intention of actually trying this. I'm just merely trying to explain how it could theoretically be done. If someone actually does this, as much as I'd love to know about it, you're probably best off keeping it to yourself (unless you've always wanted to go to federal prison).
-AZ
