Tytera MD-380 Enhanced Privacy Recordings

[RayAir]

Wireshark captures the write to the radio just fine. Found where the privacy keys are written.
When I get home from work towards the end of the week I'll do a couple BP writes and the screenshot.

I tested it first using EP, but I'm more curious how the BP key is written,

 

[johnls7424]

Wireshark captures the write to the radio just fine. Found where the privacy keys are written.
When I get home from work towards the end of the week I'll do a couple BP writes and the screenshot.

I tested it first using EP, but I'm more curious how the BP key is written,

Yeah, cool. Let us know how that works. I know people on here have figured out how the file is written for radio parameters and such. They are tinkering with that too. Unfortunately you cannot effectively transmit out of the range of 480mhz without the radio getting wonky and such, but still it's crazy. Anywho yeah let us still know how things work out for you

 

[johnls7424]

Any updates??

 

[EricCottrell]

Hello,

NXDN uses the same codec as DMR, so the encryption techniques might be similar. NXDN has a basic Scramble Encryption that uses a 15 bit shift register, 56 bit DES OFB, and 256 bit AES OFB encryption.

The encyption/decryption is done between the Vocoder and the FEC code processing. This makes sense as you want the FEC to correct the ciphertext. It also means you have to look at things at the vocoder level, after the FEC and bit-shifting is done.

73 Eric

 

[RayAir]

I captured a few writes with Wireshark and looked for my EP key. That was easy to find. I did a few BP writes with a known key and tried to find it. I couldn't determine how it wrote the BP key, but haven't had the opportunity to look more into.

I also made a capture writing a RAS key, but haven't look at the file yet.

I'm working on a Python program that might help.

Also purchased a Hytera PD782 to check its 128 bit Enc to the 128 bit Enc on the Tytera MD-380 for possible compatability.

I'm awaiting programming software.

Unfortunately I haven't had much spare time lately due to work and travel.

 

[RayAir]

Getting the AES-256 enabled on Hytera CPS and testing that is another project in the pipeline.

 

[johnls7424]

Oh okay very good. Guess the Tytera MD-380 has many security flaws, huh

 

[RayAir]

No, the EP key was captured from MotoTRBO CPS while writing the Enc key to my TRBO radio.

Never tried to capture a write to my TYT.

Only issues I see with TYT 128 bit EP are hitting the radio with a BP signal forces the rx radio out of EP mode and the keys can be read from the radio.

You can't read an EP key from a Motorola using Wireshark or trying to read it with CPS.

 

[johnls7424]

No, the EP key was captured from MotoTRBO CPS while writing the Enc key to my TRBO radio.

Never tried to capture a write to my TYT.

Only issues I see with TYT 128 bit EP are hitting the radio with a BP signal forces the rx radio out of EP mode and the keys can be read from the radio.

Oh okay. How do you like your Hytera PD782? I was thinking about investing in one. Someone on here was Selling a demo model for around 400 bucks with the programming software and cable. To my knowledge I do believe Hytera is pretty good about providing the software for its user for free. So I'm told at least

 

[RayAir]

Oh okay. How do you like your Hytera PD782? I was thinking about investing in one. Someone on here was Selling a demo model for around 400 bucks with the programming software and cable. To my knowledge I do believe Hytera is pretty good about providing the software for its user for free. So I'm told at least

Just got it today, but don't have the software. I emailed Hytera last week and received an email from likely a customer service rep overseas that had no idea what I was asking and told me to ask a Hytera dealer.

I don't know any but the guy I bought it from is sending me his disc. I already have a cable.

I will compare it to my 6550 once I get it programmed.

I'll also test all Hytera's Privacy features.

I found the radio slightly used with a charger and programming cable for $300 shipped. UHF (450-512MHz I believe). I was told it will do 70cm but that is not a big deal for me.

It looks good so far. It's a little smaller than my 6550 and of course has a better display.

 

[johnls7424]

Just got it today, but don't have the software. I emailed Hytera last week and received an email from likely a customer service rep overseas that had no idea what I was asking and told me to ask a Hytera dealer.

I don't know any but the guy I bought it from is sending me his disc. I already have a cable.

I will compare it to my 6550 once I get it programmed.

I'll also test all Hytera's Privacy features.

I found the radio slightly used with a charger and programming cable for $300 shipped. UHF (450-512MHz I believe). I was told it will do 70cm but that is not a big deal for me.

It looks good so far. It's a little smaller than my 6550 and of course has a better display.

Exactly the same one I was looking for. The UHF 2 band. 500mhz is nice. Hopefully Hytera prices for used ones are favorable ( 300 dollar range) for the PD782. Motorola is nice for its trunking features, but it's the big M and prices never seem to drop to a reasonable price, plus they rape their customers with the price for CPS for even low end radios. It's redicious in my opinion. At least Chinese companies are free and Hytera I hear is good with getting its customers ( even if purchased through 3rd party) a copy of the CD. I know the CD is sold from dealers with the radio. However people resell the software cause I think on Hyteras you can download to more the one computer ( I maybe wrong on that though)

Good luck with it though.

 

[sycho]

Hello,

NXDN uses the same codec as DMR, so the encryption techniques might be similar. NXDN has a basic Scramble Encryption that uses a 15 bit shift register, 56 bit DES OFB, and 256 bit AES OFB encryption.

The encyption/decryption is done between the Vocoder and the FEC code processing. This makes sense as you want the FEC to correct the ciphertext. It also means you have to look at things at the vocoder level, after the FEC and bit-shifting is done.

73 Eric

You mean encryption is done over u0..3 vocoder streams? I bet not because vocoder frames de/interleaving and FEC is done inside the ambe vocoder chip, so i expected it to work at c0..3 or even over the final 72bit frame when the ambe data is transfered to the phy layer for modulation. Could you point me to any documentation about this on NXDN or DMR?

http://patentimages.storage.googleapis.com/US7734982B2/US07734982-20100608-D00001.png

 

[7312345]

Just got it today, but don't have the software. I emailed Hytera last week and received an email from likely a customer service rep overseas that had no idea what I was asking and told me to ask a Hytera dealer.

I don't know any but the guy I bought it from is sending me his disc. I already have a cable.

I will compare it to my 6550 once I get it programmed.

I'll also test all Hytera's Privacy features.

I found the radio slightly used with a charger and programming cable for $300 shipped. UHF (450-512MHz I believe). I was told it will do 70cm but that is not a big deal for me.

It looks good so far. It's a little smaller than my 6550 and of course has a better display.

I can provide the latest software free Hytera PD78X If you need to message to me

 

[RayAir]

I can provide the latest software free Hytera PD78X If you need to message to me

Thanks for offering, but I was able to get a copy today. Haven't installed it yet. I was able to FPP our t/a channel in the pd782.

I'm liking this radio already.

 

[sycho]

Hello,

NXDN uses the same codec as DMR, so the encryption techniques might be similar. NXDN has a basic Scramble Encryption that uses a 15 bit shift register, 56 bit DES OFB, and 256 bit AES OFB encryption.

The encyption/decryption is done between the Vocoder and the FEC code processing. This makes sense as you want the FEC to correct the ciphertext. It also means you have to look at things at the vocoder level, after the FEC and bit-shifting is done.

73 Eric

You are right! In NXDN, scrambling is done inside the vocoder data path, just before FEC, and 15bit basic encryption LFSR feedback equation is public:

 

[7312345]

You are right! In NXDN, scrambling is done inside the vocoder data path, just before FEC, and 15bit basic encryption LFSR feedback equation is public:

This is a good news can decrypt NXDN? I hope that the software can do so decrypt its basic digital scrambler

 

[sycho]

But i'm afraid that is different in MOTOTRBO BP, because DSD shows many FEC errors when receiving a basic privacy transmission. That means that FEC is not to be done over the cyphertext, but probably over the clear.

And that's good in terms of security (residual inteligibility and key distance) because a small diference in the key generates a lot of errors in FEC if cyphertext is not perfectly de-scambled.

 

[7312345]

Thanks for offering, but I was able to get a copy today. Haven't installed it yet. I was able to FPP our t/a channel in the pd782.

I'm liking this radio already.

Congratulation

 

[7312345]

But i'm afraid that is different in MOTOTRBO BP, because DSD shows many FEC errors when receiving a basic privacy transmission. That means that FEC is not to be done over the cyphertext, but probably over the clear.

If a software I can do the test

 

[sycho]

This is a good news can decrypt NXDN? I hope that the software can do so decrypt its basic digital scrambler

Yes, with that (public) information you could implement decryption (different from cracking) on DSD to decode legit comms with the correct key. This is not different than having an NXDN radio and programming the key, so i don't see any ilegal in this.

I would like to do the same for TRBO and TYTERA basic, not really interested in NXDN as i don't use it in my network. But encryption method (scrambler location and LFSR) is not published and i have not been able to reverse eng. it.