Initialization Vector (MI) in DMR Hytera

[luimixGT]

I am conducting an analysis of the basic ARC4 encryption algorithm implemented by Hytera. A freelancer and I have encountered a limitation: we discovered that, beyond the encryption algorithm itself, Hytera appears to have slightly modified the protocol. We found that it uses an Initialization Vector (IV) at the start of every transmission—designed to ensure that even when the same encryption key is used, the actual encrypted data never looks identical, thereby preventing predictability. We have analyzed the data stream but have been unable to locate the Initialization Vector; it seems Hytera "hides" it within the data stream in a way that only the radios themselves can detect. If anyone has expertise in this area, I would appreciate your assistance, or I am willing to pay for a consultation.

 

[tylerwatt12]

Just throwing this out there:

dsd-fme/src/dmr_pi.c at audio_work · lwvmobile/dsd-fme

Digital Speech Decoder - Florida Man Edition. Contribute to lwvmobile/dsd-fme development by creating an account on GitHub.

github.com

dsd-fme/src/dmr_flco.c at audio_work · lwvmobile/dsd-fme

Digital Speech Decoder - Florida Man Edition. Contribute to lwvmobile/dsd-fme development by creating an account on GitHub.

github.com

The 96-bit PI Header is FEC-encoded and interleaved using BPTC(196,96). You must identify the PI Header from DMR Data Type 0000, deinterleave it, and BPTC-decode it before those five MI bytes become contiguous.

 

[slicerwizard]

IIRC, in EP/RC4 and AES encrypted calls, Hytera subscribers transmit a 32 bit MI value in a PI Header frame as well as one distributed 32 bit MI value in each voice superframe, similar to how Motorola subscribers operate.

 

[racingfan360]

IIRC, in EP/RC4 and AES encrypted calls, Hytera subscribers transmit a 32 bit MI value in a PI Header frame as well as one distributed 32 bit MI value in each voice superframe, similar to how Motorola subscribers operate.

Exactly how I see it eg:
22:51:29 Sync: +DMR MS/DM MODE/MONO | Color Code=01 | PI
Slot 1 DMR PI H- ALG ID: 21; KEY ID: 03; MI(32): 28128B5B; DMRA RC4;
DMR PDU Payload [21][10][03][28][12][8B][5B][00][0B][B8][68][E8]
22:51:29 Sync: +DMR MS/DM MODE/MONO | Color Code=01 | VC*
AMBE 9673F9F3844900 err = [0] [0]
....

Followed up by the predictable:
Slot 1 DMR PI C- ALG ID: 21; KEY ID: 03; MI(32): 4F2A8383; RC4;
22:51:30 Sync: +DMR MS/DM MODE/MONO | Color Code=01 | VC*
AMBE EC3486936C1C80 err = [0] [0]
....

 

[lwvmobile]

Just FYI, this was asked and answered here before it ever made it to the forum by a new user to both github and radio reference, and wanting to hire a 'consultant'. Considering the fly by night nature of this, I would assume the intentions are a little less than above board.

 

[luimixGT]

Para su información, esta pregunta ya se planteó aquí antes de que llegara al foro, por un usuario nuevo tanto de GitHub como de Radio Reference, que buscaba contratar a un "consultor". Dada la naturaleza poco transparente de este asunto, supongo que sus intenciones no son del todo honestas.

Ofrezco mis más sinceras disculpas si, en mi afán por obtener ayuda, expresé cosas que se malinterpretaron o parecieron deshonestas. Soy radioaficionado de Guatemala —mi indicativo es TG4NZB— y quiero aclarar que no tengo ninguna intención de actuar de forma deshonesta; simplemente se trataba de un experimento en el que estábamos trabajando un grupo de radioaficionados locales y yo. Reitero mis disculpas si mi búsqueda de ayuda o conocimiento especializado generó algún malentendido respecto a mis intenciones; esperaba encontrar compañerismo entre radioaficionados en un foro tan amigable, no acusaciones premeditadas.

 

[gary123]

Translated...

I offer my sincerest apologies if, in my eagerness to get help, I expressed things that were misunderstood or seemed dishonest. I am an amateur radio operator from Guatemala —my callsign is TG4NZB— and I want to clarify that I have no intention of acting dishonestly; it was simply an experiment that a group of local amateur radio operators and I were working on. I reiterate my apologies if my search for help or specialized knowledge caused any misunderstanding about my intentions; I was hoping to find camaraderie among amateur radio operators in such a friendly forum, not premeditated accusations.

Ivans post #5 pretty much says it all.