Encryption - secure communication between different manufacturers

[KI5EDJ]

I just wanted to touch on the radio models you mentioned. I've used several of them on the job without encryption. The GD-77 will not stand up to commercial use. One drop and the battery breaks. It's a great radio to learn and experiment with, but it's not very sturdy. That goes for the 77S as well, which I have yet to see with a part 90 certification.
Baofeng in general offers a good starter radio for the hobbyist. They're a bit on the tough side. I have dunked them in the river, dropped them into shallow water, and they still do their thing, but my experience showed me they're limited.
If you're reading this and are considering starting out as a hobbyist with one of those, go for it. At $100 or less a pop, you're not going to break the bank.
The AnyTone 868 platform radios are a solid choice IMO. This includes the 578, 878, UV, UV2, UV2+, etc. and the BTech DMR 6x2 and 6x2 Pro. If you're going that route and do *not* need the AnyTone specific features, go 6x2 all the way. Customer support on that and the Pro is top notch. The 6x2 Classic will not recognize add on boards fyi. There are better radios out there, but I feel the 868 platform strikes a great balance between hobbyist and professional use. I've carried one on the job for about two years. At first I carried a 6x2 but switched to an 868 because I use the analog APRS while hunting.
The best radio I've used professionally is the Motorola XPR3500e. In fact that's what I have on me now. Motorola and low price do not go together but the things are nigh indestructible, have several useful features, and they wrote the book on DMR. Compared to the 868 security is tighter and you can track the radio better, and presumably the person carrying it if they've been hurt or gotten stranded someplace.
This is all my opinion, though. Others who have posted here are probablyuch smarter than me on the subject.

 

[cbeaumont]

If terrestrial cellular coverage is available, a PTToC app like Zello, Wave on Cloud, or similar would be more feasible. Have employee of the day download app, authorize them on the talkgroup via portal, delete credentials when they quietly quit. LTE is 100 percent encrypted, no worries of unauthorized users nosing in, and the client portals for things like Wave (CAT UI) give the admin total control over who comes and who goes.

No expensive walke-talkies with AES-256 encryption to buy, managing encryption keys, code plugs, worrying about your info being leaked on hobbyist websites, etc.

CAPEX cost is way lower. Everyone has a cellphone. A good quality BT RSM and they can have "cop like" user experience with "better than cop" encryption.

Although a great idea... many on the "team" do not have access to cell phones

 

[cbeaumont]

I just wanted to touch on the radio models you mentioned. I've used several of them on the job without encryption. The GD-77...

The AnyTone 868 platform radios are a solid choice IMO. This includes the 578, 878, UV, UV2, UV2+, etc. and the BTech DMR 6x2 and 6x2 Pro....

Im not sure if any/which of the older Anytones also have AES256... but I do havethe 878uvII plus and AT-D578UVIIIPRO... and agree... probably on the top end of their intended cost.
I have the DMR-6X2 and GD-AT10G on the way to confirm interoperability... and this gets closer to what is probably the supervisors units.
Another post mentioned Maxon... I may look at those, at least to see if they work.
Another manufacturer is coming out with two non-display radios which they say will be AES256 at a< $100 cost... which is far from the $15 disposable radios the clients went to (after repairing Motos for years)... but at least it lowers the entry cost for AES256/compatible encryption between manufacturers (which is long overdue).

Again... for those just tuning in... my focus is not CCR... it DEFINATELY isn't any specific manufacturer (actually the opposite), and it isn't (in this case) duribility... it is secured transmission interoperability... which seems to be landing on AES256.
On that note... it appears that 2022-2023 is bringing AES256 as a common encryption that several manufacturers appear to be starting to move too.

I'll repost once I test (and have some units for the client and myself if they work).

 

[cbeaumont]

How badly is encryption needed?
The sticking point here is the common encryption standard. That's going to push you into more expensive radios. If you can make do with out encryption, and even run analog, you can get durable radios a whole lot cheaper.

Honestly... any lower encryption would've probably been fine (at least simple privacy level)... the main problem became interoperability... they (nor I) want to get stuck to any single (CCR) radio/manufacturer.
The problem was one that the (cheaper) manufacturers themselves created by each choosing to impliment propriatary encryption instead of AT LEAST supporting a common one (at the same time) .... even if it was lower than other options between their own radios.

Additionally... their lack of documentation regarding security/encryption was/is unacceptable.

Regarding Analog... they were actually fine with Analog and beatshift... but this year Retevis CHANGED the chips in the RT21 WITHOUT mentioning anything to anyone.. which made the new units incompatible with ANY previous beatshift radio (their own RT21 or others included as well as TYTs such as the 9800). It actually changed the broadcast pattern on the frequency completely... but thats a different topic.

As for Moto/Kenwood other manufacturers... their problem is cost... both hardware and SOFTWARE... and no offence to the radio pros out there... attitude/ego.
Does Moto have an excellent product... yes... without a doubt. Comparing to the IT world... Cisco made great products... but even they recognized that having Linksys and a lower line/cost was smart. If there was a $100-$200 DMR/AES256 Moto with included CPS (maybe more with display)... even if less durable... I would recommend it in a heartbeat... but there isnt... and the reality is.. they can make a cheap FRS radio... they just choose not to make cheaper commercial ones.

 

[mmckenna]

Does Moto have an excellent product... yes... without a doubt. Comparing to the IT world... Cisco made great products... but even they recognized that having Linksys and a lower line/cost was smart. If there was a $100-$200 DMR/AES256 Moto with included CPS (maybe more with display)... even if less durable... I would recommend it in a heartbeat... but there isnt... and the reality is.. they can make a cheap FRS radio... they just choose not to make cheaper commercial ones.

Since you suggested that you don't need AES256, just a 'standard" encryption means, then it looks like you are chasing the wrong products.

No way I'd use a CCR for any application other than hobby use. Just not the right tool for the job.

Kenwood NX1000 series radios can be had in DMR with a display for a reasonable price. You can add DMR ARC4 encryption for $34 list price (should be able to get it cheaper than that).

That would give you a solid radio at a good price, and it would interoperate with any other legit DMR radio with ARC4.

 

[cbeaumont]

I don't know how MAXON ranks with respect to performance, but they do have two tiers of inexpensive UHF and VHF DMR radios with AES256. They are also eager to gain dealerships.

Thank you for the suggestion. Unfortunately the client does not want to be locked into anyone specific... including having to deal with a specific local dealer... (and as I mentioned, I am not trying to be a dealer myself).

If they sold them directly or on amazon... I would happily evaluate them.

Again... I do appreciate you suggesting them

 

[N4KVL]

Although a great idea... many on the "team" do not have access to cell phones

Many on the "team" do not have access to cell phones? I can think of VERY few demographics where this statement would apply.

Is this a team of 5th grade safety patrol officers? Department of corrections chain gang, weed whacking (lol) the side of the road?

 

[hill]

A lot of secure locations don't allow people to have cell phones within them. We have a many Government Agencies that you can't bring in any electronics or cell phones that I deliver to in Maryland, Northern Virginia and DC. The staff members have to use agencies radios or landline phones to communicate.

The

 

[RFI-EMI-GUY]

Cheap Chinese Radios from Amazon and Information Security are mutually exclusive. I have to wonder what this commercial user does that requires encryption at all. Bad encryption is far worse that no encryption.

 

[alcahuete]

As for Moto/Kenwood other manufacturers... their problem is cost... both hardware and SOFTWARE... and no offence to the radio pros out there... attitude/ego.

If there was a $100-$200 DMR/AES256 Moto with included CPS (maybe more with display)... even if less durable... I would recommend it in a heartbeat... but there isnt... and the reality is..

Firstly, Motorola does not charge for their CPS anymore. It is free. The CP100d comes to mind as being pretty darn close to that price range. You can buy singles for around $250, sometimes lower. The problem is they only have Basic Privacy, which isn't terribly secure...nowhere near what you're going to get with AES256 or the like.

 

[N4KVL]

A lot of secure locations don't allow people to have cell phones within them. We have a many Government Agencies that you can't bring in any electronics or cell phones that I deliver to in Maryland, Northern Virginia and DC. The staff members have to use agencies radios or landline phones to communicate.

The

If you are working somewhere in the Capitol area that enforces NSA smartphone restrictions, you are 100% not bringing in any radio that is not agency issued with acceptable encryption type for your assignment, let alone a chineseium hunk of ****.

 

[FedFyrGuy]

Communication is similar to HIPPA regarding privacy concerns, both between staff, and sometimes between security or from security to staff.

You are being redirected...

 

[RayAir]

I've been several evaluating radios for potential use (with encryption) for a client's deployment and migration.
Regardless of which is chosen, if possible, I would prefer to not lock them into any single manufacturer in case anyone closes, and so they have flexibility in their selection. It would also be nice to have compatibility with some of the radios I personally use, such as the TYT TH9600 AnyTone AT-D878UVII Plus, and Anytone AT-D578UV-PLUS (or for those to work together).

I have been testing and unable to successfully get encryption to work between radio manufacturers. I have tested several configurations and variations with radios such as: TYT MD-UV380, MD-UV-390 or TH9600 s Radioddity GD-73, Radioddity GD-77, AnyTone AT-D878UVII Plus, Anytone AT-D578UV-PLUS, Retevis RT43, Baofeng DM-1701, Baofeng DM-1801, Baofeng DM-5rPlus, and the super low end Cotre cp1, and Cotre cp3 (because client's volunteers tend to destroy radios).

Does anyone have experiance successfully getting encryption to work between different manufacturers, or have any configuration details that would assist with working interoperability with any of those radios, such as detailed information regarding the encryption type(s), key input, hash methods, or anything else related might be helpful?

So far I haven't seen any detailed documentation from any manufacturer in their manuals or seperately regarding encryption, and in some cases there is literally non specifying which they use, or specific key entry details (since key entry in their CPS is also inconsistant).
The only answer I get from the couple of manufacturers, which isn't an answer at all, is that they each use a different cipher/mode/Initial Vector so that you have to use their radios on both ends. In fact, in most cases, they seem to not know much about encryption at all.
While I might appreciate that a manufacturer might include a "in manufacturer" level of security, but it seems to me that encryption (when based on a standard such as AES128, AES256, or ARC04 should be interoperable regardless of whos radio is being used.... or at least they should allow a basic level, even if only ARC04.

Has anyone decrypted or reverse engineered the hash/seed/method for different manufacturers, or is there any software that can allow a common encryption key to generate manufacturer specific keys (accomidating for the difference in cypher/mode) allowing radios to introperate?

I have not tried to use SDR/DSDplus or similar to see or compare output (with a known key).... Icertainly don't want to dive into that if someone already has (and Im not sure I do anyway.)
If I did... (or if someone else has the skills)... conceptually, using the same encryption key in different radios, and sending consistant data (such as a text message), I am wondering if the output data (with the encryption key) could be used to find the cipher/mode (e.g. Base64/Hex; Initial Vector; CBC , GCM, ECB, CTR, etc) used by the manufacturer(s).

Thank you!!

To hopefully head off the common flaming I see whenever encryption is talked about....
This is intended for commercial use on a commercial frequency.
This is not about "how do I decrypt someones transmissions without the encryption key"
This is not about using encryption on HAM/GMRS.
This is not about is encryption good/bad/legal/illegal on a frequency or country.
Qualified, helpful information only PLEASE.
Encryption is in the radios... so lets talk about it and learn about it

PS... it seems like there should be a freestanding encryption topic. I didn't see one, but there have been many posts in other topics.

What are you doing?

 

[cbeaumont]

What Motorola Radios were they using? FRS/GMRS bubble packs? There's a lot of people still using Moto portables made 30-40 years ago, more would probably still be in service if it wasn't for narrow banding.

They were using a mix of Moto 6100/6300/200's which were expensive to repair and had at least one or two go get broken monthly, then switched to Retevis RT21s.

 

[cbeaumont]

You are being redirected...

Pretty sure that is because of the AES256 Encryption on the digital side.

 

[hanlonmi06]

I'm not a radio expert, but I have worked at two companies that made use of radios for day to day operations. They both started out with CCR's and interestingly both had valid FCC licenses. When I explained in clear terms that is was the companies best interest to operate legally, it became much easier to rationalize the higher price points for type accepted gear. In non-threatening, non-grandiose ways I explained how they were required to be compliant and from then on out it wasn't an issue.

 

[cbeaumont]

Firstly, Motorola does not charge for their CPS anymore. It is free. The CP100d comes to mind as being pretty darn close to that price range. You can buy singles for around $250, sometimes lower. The problem is they only have Basic Privacy, which isn't terribly secure...nowhere near what you're going to get with AES256 or the like.

Thank you for the CPS update... I haven't looked into it for a while.
It would be smart for Moto to include AES256 ... the client is versy specific about NOT ending up in a protritary radio. My understanding is that basic privacy may be compatible with a few other manufacturers... but the client is aiming for AES256 as a common ground standard... even if it is beyond their actual secudity requirement... from my perspective... it can never hurt to over secure anything.

 

[mmckenna]

Thank you for the CPS update... I haven't looked into it for a while.
It would be smart for Moto to include AES256 ... the client is versy specific about NOT ending up in a protritary radio. My understanding is that basic privacy may be compatible with a few other manufacturers... but the client is aiming for AES256 as a common ground standard... even if it is beyond their actual secudity requirement... from my perspective... it can never hurt to over secure anything.

There's some challenges dealing with AES256 that is never going to result in it being free. There's some tight controls over export of that kind of technology. The hardware needs to be secure so the keys cannot be easily lifted from the radio.

ARC4 is what you want. If your employer is looking for low cost radios, but insists they need AES256, then they don't understand what they are doing and will probably end up getting took by some salesman. These sorts of situations are usually a big red flag for radio shops. Most know not to get mixed up in a deal like this where the customer *thinks* they know what they are doing, but obviously do not.
This falls under the "ten foot pole" rule for most….

 

[MTS2000des]

It would be smart for Moto to include AES256 ... the client is versy specific about NOT ending up in a protritary radio. My understanding is that basic privacy may be compatible with a few other manufacturers... but the client is aiming for AES256 as a common ground standard... even if it is beyond their actual secudity requirement... from my perspective... it can never hurt to over secure anything.

MSI wants you to buy APX/P25 if you need real comsec. You aren't gonna get that on a Baoturd budget.

 

[cbeaumont]

MSI wants you to buy APX/P25 if you need real comsec.

So... pay extra... for an open standard... to have secure communication... which is benificial for most business communications.

There's some challenges dealing with AES256 that is never going to result in it being free. There's some tight controls over export of that kind of technology. The hardware needs to be secure so the keys cannot be easily lifted from the radio.

Except its already in the radios... so there is no 'cost' to make anything more expensive.

ARC4 is what you want. If your employer is looking for low cost radios, but insists they need AES256, then they don't understand what they are doing and will probably end up getting took by some salesman. These sorts of situations are usually a big red flag for radio shops. Most know not to get mixed up in a deal like this where the customer *thinks* they know what they are doing, but obviously do not.
This falls under the "ten foot pole" rule for most….

As noted earlier, ARC4 was not compatible between manufacturers. If it was, that would've probably been fine. They do not want to get tied to any one manufacturer... or radio shop.
There was a time when IT "professionals" tried to protect their 'business' by acting superior and elitest. The result more often than not was that customers were being defrauded and overcharged. That has somewhat improved... but the average "shop" is below average. A similar attitude came from telephone people as network people (yes, sometimes some of those same IT people) started getting involved with wiring and adding networks to businesses... especially when VOIP (Voice over the internet) started coming out.
Maybe the red flag is that many radio shops are insecure about their place in communication moving forward... especially as so many other forms of mobile communication are taking their marketshare. I do believe there is a place for these shops and professionals... butI also think they should be leading a push for things like AES256 (in the US at least) and standards between manufacturers... especially as more and more manufacturers are closing down.