For anyone using 128 bit encryption, I have a Python script that will generate a cryptographically strong key that involves 14 rounds of randomization, SHA-512, PBKDF2, HMAC, a 64 byte initial token, a 64 byte dynamic salt, and 1 million iterations. They come out strong, when I histogrammed over 100 outputs and the average was remarkable, perfect randomization even distribution, keystream isn't biased, now, should a public agency use this method to pick their keys? No they'll use a library that's a lot more sophisticated than Python. But I assure you these keys are Damn close.
I use them to encrypt my commercial DMR uses (volunteer for various things that use commercial radios) and for others who have a callsign, you could encrypt your transmissions on a DMR repeater as long as you publish the key beforehand. Canadian law says no SECRET key or cipher or method of obfuscation can be used, so it has been accepted that as long as you don't hide the keys, it's okay. Case in point? View the Ontario Canada brandmeister DMR radio reference page. You will see that one repeater went full out encryption, with I believe RAS keys (restricted access to system), and on the voice AES 256, and on the data DES 56. It's perfectly legal.
You can modify the script for different key lengths, bit size, you can mess around with other variables. But this is what I use primarily, as well as one that produces 16 keys, I use that cause my radios can hold 16 keys, so every month I rotate the keys and made a command that spits out not one but 16 keys that are all cryptographically strong. This is one of the outputs I just executed:68FECD3CFCDD9BA1499CAD1684690424.
Here's the script:
import secrets
from hashlib import pbkdf2_hmac
def generate_dynamic_salt(length=64):
return secrets.token_bytes(length)
def generate_key_fixed(token, secret_key, iterations=1000000, salt_length=64):
for _ in range(14):
dynamic_salt = generate_dynamic_salt(salt_length)
if isinstance(token, str):
token = bytes.fromhex(token)
token_bytes = token + secret_key
token = pbkdf2_hmac('sha512', token_bytes, dynamic_salt, iterations)
token = token.hex().upper()[:32]
return token
token = secrets.token_bytes(64)
secret_key = secrets.token_bytes(64)
strong_key = generate_key_fixed(token, secret_key)
print(strong_key)
There you go.Enjoy!
I use them to encrypt my commercial DMR uses (volunteer for various things that use commercial radios) and for others who have a callsign, you could encrypt your transmissions on a DMR repeater as long as you publish the key beforehand. Canadian law says no SECRET key or cipher or method of obfuscation can be used, so it has been accepted that as long as you don't hide the keys, it's okay. Case in point? View the Ontario Canada brandmeister DMR radio reference page. You will see that one repeater went full out encryption, with I believe RAS keys (restricted access to system), and on the voice AES 256, and on the data DES 56. It's perfectly legal.
You can modify the script for different key lengths, bit size, you can mess around with other variables. But this is what I use primarily, as well as one that produces 16 keys, I use that cause my radios can hold 16 keys, so every month I rotate the keys and made a command that spits out not one but 16 keys that are all cryptographically strong. This is one of the outputs I just executed:68FECD3CFCDD9BA1499CAD1684690424.
Here's the script:
import secrets
from hashlib import pbkdf2_hmac
def generate_dynamic_salt(length=64):
return secrets.token_bytes(length)
def generate_key_fixed(token, secret_key, iterations=1000000, salt_length=64):
for _ in range(14):
dynamic_salt = generate_dynamic_salt(salt_length)
if isinstance(token, str):
token = bytes.fromhex(token)
token_bytes = token + secret_key
token = pbkdf2_hmac('sha512', token_bytes, dynamic_salt, iterations)
token = token.hex().upper()[:32]
return token
token = secrets.token_bytes(64)
secret_key = secrets.token_bytes(64)
strong_key = generate_key_fixed(token, secret_key)
print(strong_key)
There you go.Enjoy!
