Over the air rekeying?

[poltergeisty]

Not sure where to put this question. Can you rekey a radio that is currently encrypted without the encryption key? In other words is the data sent have to match the current encryption key or is data not voice not encrypted?

Thanks!

 

[grem467]

Without the traffic key? Yes. Without the ukek? No. The radio has to have a key loaded to decrypt the key packets. This prevents eBay radios from being able to snag the encryption keys over the air.

All radios have to be keyloaded manually the first time (and if they drop their ukek)

 

[poltergeisty]

So you have to have the same KVL that was used to program the key the first time in order to OTAR?

 

[wlmr]

No.
KVL used to put in the ukek. The other keys don't need to be put in at this point in time.
The system uses the ukek to put the other key(s) used for encrypting voice into the radio. (Keys are sent to the radio as encrypted data.)
If the keys need to be changed, the system again uses the ukek to make the changes - including a new ukek if the plan is to replace the original one.

 

[poltergeisty]

Here's what I have learned.

UKEK Unique Key Encryption Key - The UKEK is used to encrypt keys transmitted
from the KMF to the KVL. During system initialization a Unique KEK is programmed into
each KVL and that UKEK is associated with that KVL within the KMFÕs database. Once the
system is fully initialized, each UKEK can then be used to communicate with only ONE KVL.
No other KVL will receive keys encrypted with this UKEK. The KMF uses the concept of the
UKEK to created a secure link between itself and any individual unit (KVL) under its
management.

http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp079.pdf

 

[WayneH]

Here's what I have learned.

That as it is can easily be taken out of context. I wouldn't be concerned with KMF to KVL transmission since as a beginner it's not important; if you manage/use a KMF then it is and you would need much better reading material. What needs to be known is that all primary subscriber communication with the KMF is going to be encrypted with the UKEK at the base layer. It's possible to do a "Clear Hello" but that's only to establish general data communication confirmation with the radio. And as long as you know what the UKEK is you can enter it in to any KVL and upload it to the radio.

 

[poltergeisty]

So without the UKEK no one that is rouge can change the key? That is my understanding.

 

[immelmen]

Without the traffic key? Yes. Without the ukek? No. The radio has to have a key loaded to decrypt the key packets. This prevents eBay radios from being able to snag the encryption keys over the air.

All radios have to be keyloaded manually the first time (and if they drop their ukek)

Just to clarify, this is not completely correct with regard to some Motorola. Moto has a feature called "Generate Key Loss Key" which is enabled in the secure hardware general tab in CPS. If enabled, as soon as the radio is hit with a KEK from a KVL, it encrypts the KEK with itself and permanently stores it in nonvolatile memory. This double encrypted key is NOT erasable from the subscriber unit even if all keys are completely zeroed out or via tampering. Instead it is used to OTAR the KEK that is then in-turn able to OTAR the TEKs...basically you can take a radio that has been zeroed (including deleting the KEK) and successfully OTAR with a validated GKLK re-key request(IF the GKLK feature was enabled in CPS.)

...so, if someone got an ebay/second hand radio from a known source and had knowledge of the KMF profile in question, even if the radio had been zeroed but that feature was in play, a competent user could snag keys out of the air. That is a lot of "ifs" but I have personally seen a radio sold on the second hand market that got to the buyer with the codeplug fully programed from the last user and three hardware traffic keys STILL LOADED in the radio, so stranger things have happened.

[tested to work on Astro25 subscriber]

 

[WayneH]

So without the UKEK no one that is rouge can change the key? That is my understanding.

Correct. No UKEK and you won't get your encrypted messages from the KMF.