How often do you change encryption key

[billy2047]

Basically the title, I have seen systems (which I won't name) use the same key (not KID) for years and years. Isn't it a good practice to change key every once a while? And how often do you guys do it? Thanks.

 

[Project25_MASTR]

Depends on the available equipment and infrastructure.

If you have a KMF and the infrastructure to support OTAR, it's a fairly straightforward process to rekey equipment. Schedule it and push the keys. Anyone who missed the keys can always request a rekey OTA (we are assuming there is a functional KEK in the radio and the ID's match what the KMF has). I don't know if Motorola still supports it but they used to have a tactical keyload feature that could also be done over the air with just a KVL on a conventional channel.

If you don't have a KMF and the ability to OTAR, you have to manually touch each radio. The pain with that is just trying to get people to bring radios in. On the state law enforcement side, it can take 3-5 years just to get codeplug updates done from employees not wanting to bring equipment in, imaging attempting to do any sort or manual rekeying process...

 

[noderaser]

We have a fed departmental mandate for every six months, but we do OTAR. It's a pretty straightforward process, but if the user's radios are off the key changeover timeout is very short and they will have to initiate OTAR manually from the radio. We still get radios brought in because they "don't work" and all that's needed is manual OTAR... We're trying to improve the training available but some people just ignore the info.

 

[Project25_MASTR]

We have a fed departmental mandate for every six months, but we do OTAR. It's a pretty straightforward process, but if the user's radios are off the key changeover timeout is very short and they will have to initiate OTAR manually from the radio. We still get radios brought in because they "don't work" and all that's needed is manual OTAR... We're trying to improve the training available but some people just ignore the info.

Out of curiosity, is that a trunked system or conventional system? I need to get some more info about conventional OTAR and the amount of time it takes per radio on average.

 

[rescue161]

We have the same problems that noderaser is experiencing. Ours is trunked for all Marine Corps bases on the East Coast, so there are a lot of users.

 

[noderaser]

Out of curiosity, is that a trunked system or conventional system? I need to get some more info about conventional OTAR and the amount of time it takes per radio on average.

Trunked Harris VIDA. It only takes a few seconds per radio, if it's powered on and either in the queue or initiated manually. We do an all-call before the changeover, advising users to do a radio check and initiate manual OTAR after a few minutes if they're having issues. Also note that we typically push the "new" key (rekey) a day or two before the changeover. That will reduce the (theoretical) time it takes for radios that are frequently used to switch.

 

[billy2047]

have a fed departmental mandate for every six months

The feds are the ones that keep us busy. Local and state guys can get pretty boring unless there's radio problem. we do it manually via KVL, no OTAR just yet. When the radio is in, it's also a good time to check for its condition, hooking it up to the scope srvc monitor for alignment replacin worn or damaged knob, RSM, battery and antenna etc.

 

[billy2047]

conventional OTAR and the amount of time it takes per radio on average.

I've tried OTAR on a different system and it took a few seconds like noderaser mentioned, on conventional however it could take longer depending on how busy it gets interrupted everytime there's voice traffic.