Initialization Vector (MI) in DMR Hytera

[luimixGT]

I am conducting an analysis of the basic ARC4 encryption algorithm implemented by Hytera. A freelancer and I have encountered a limitation: we discovered that, beyond the encryption algorithm itself, Hytera appears to have slightly modified the protocol. We found that it uses an Initialization Vector (IV) at the start of every transmission—designed to ensure that even when the same encryption key is used, the actual encrypted data never looks identical, thereby preventing predictability. We have analyzed the data stream but have been unable to locate the Initialization Vector; it seems Hytera "hides" it within the data stream in a way that only the radios themselves can detect. If anyone has expertise in this area, I would appreciate your assistance, or I am willing to pay for a consultation.

 

[tylerwatt12]

Just throwing this out there:

dsd-fme/src/dmr_pi.c at audio_work · lwvmobile/dsd-fme

Digital Speech Decoder - Florida Man Edition. Contribute to lwvmobile/dsd-fme development by creating an account on GitHub.

github.com

dsd-fme/src/dmr_flco.c at audio_work · lwvmobile/dsd-fme

Digital Speech Decoder - Florida Man Edition. Contribute to lwvmobile/dsd-fme development by creating an account on GitHub.

github.com

The 96-bit PI Header is FEC-encoded and interleaved using BPTC(196,96). You must identify the PI Header from DMR Data Type 0000, deinterleave it, and BPTC-decode it before those five MI bytes become contiguous.