Tytera MD-380 Enhanced Privacy Recordings

[johnls7424]

Yes, with that (public) information you could implement decryption (different from cracking) on DSD to decode legit comms with the correct key. This is not different than having an NXDN radio and programming the key, so i don't see any ilegal in this.

I would like to do the same for TRBO and TYTERA basic, not really interested in NXDN as i don't use it in my network. But encryption method (scrambler location and LFSR) is not published and i have not been able to reverse eng. it.

Do you have the Tytera MD 380? If so, do you like the radio? What are your pro's and cons about it?

 

[sycho]

Do you have the Tytera MD 380? If so, do you like the radio? What are your pro's and cons about it?

Great radio for it's price. Good construction, but not for a lot of abuse (plastic, display...), great receiver that does not overload easily. Few but passable sw bugs.

Some more tests with Tytera basic encryption: it pass fine through Mototrbo repeaters, but it generate a lot of FEC errors in DSD. This is strange because the first implies that FEC must be doing over cipher text so repeater can process the voice frames and correct errors, while DSD FEC reports too many errors.

The only answer i can find for this is that FEC is being done over clear text, and repeater FEC is "incorrectly correcting" 3 bits, that are then restored by the receiving radio FEC after decryption. That could work, although would greatly reduce the range.

 

[johnls7424]

Great radio for it's price. Good construction, but not for a lot of abuse (plastic, display...), great receiver that does not overload easily. Few but passable sw bugs.

Some more tests with Tytera basic encryption: it pass fine through Mototrbo repeaters, but it generate a lot of FEC errors in DSD. This is strange because the first implies that FEC must be doing over cipher text so repeater can process the voice frames and correct errors, while DSD FEC reports too many errors.

The only answer i can find for this is that FEC is being done over clear text, and repeater FEC is "incorrectly correcting" 3 bits, that are then restored by the receiving radio FEC after decryption. That could work, although would greatly reduce the range.

I hear you. There is on RR here in another forum that gives you the link to how to change the radios parameters. Such as WATTS and even the frequency range in the Tytera MD 380. It might help fix the issue if you like to " tinker" with the radios parameters to get maximum efficiency.

 

[sycho]

I hear you. There is on RR here in another forum that gives you the link to how to change the radios parameters. Such as WATTS and even the frequency range in the Tytera MD 380. It might help fix the issue if you like to " tinker" with the radios parameters to get maximum efficiency.

I know, months ago i "hacked" the CPS exe to make the Test Mode menu available.

 

[johnls7424]

I know, months ago i "hacked" the CPS exe to make the Test Mode menu available.

Haha very nice

 

[RayAir]

Hytera 256 bit Basic Encrypt

Here is a DSD screenshot of a Hytera DMR radio signal with 256-bit Basic Encrypt on.
I see DSD indicates encrypted and is displaying the radio ID # correctly, but the talk group number is incorrect. Audio sounds like RC4 but I do not believe basic encrypt uses a secret key appended to an IV.

I tested Hytera 128 bit basic encrypt for compatibility with TYT 128 bit EP and it was a no go.

I believe Hytera Full Encrypt is a paid feature and I'll be looking into sourcing that soon.

Anyone know what XPT shown on the DSD Event Log means? This was a direct mode tx.

Thanks guys.

 

[sycho]

Here is a DSD screenshot of a Hytera DMR radio signal with 256-bit Basic Encrypt on.
I see DSD indicates encrypted and is displaying the radio ID # correctly, but the talk group number is incorrect. Audio sounds like RC4 but I do not believe basic encrypt uses a secret key appended to an IV.

I tested Hytera 128 bit basic encrypt for compatibility with TYT 128 bit EP and it was a no go.

I believe Hytera Full Encrypt is a paid feature and I'll be looking into sourcing that soon.

Anyone know what XPT shown on the DSD Event Log means? This was a direct mode tx.

Thanks guys.

I don't see encryption indicator in your DSD screenshot. Hytera implements standard RDA encryptions: 40bit ARC4, AES128 and AES256.

XPT is the Hytera trademark for trunking.

 

[johnls7424]

Yeah in the screenshot Ray I don't see the " enc" indication either. Also Ray: have you tried to see if Hyteras encryption is compatible with Motorolas encryption standard?

 

[RayAir]

I meant it is indicating voice privacy is in use.
"ENC group call"

The only info I found on Hytera Basic encrypt says it transforms the voice or data using a mathematical algorithm. The key manipulates the voice bits directly (no IV). It says since no enc parameter is set, system access time is the same for clear or basic encrypted voice.


Also goes on to say," the basic encrypt key places an important role. It is recommended to configure a unique key which has at least five different bits from other keys after converted into binary value."

I'm not sure why XPT displayed. No trunking was in use. It was just a direct talk around group.

-v4 logging showed Enc also, but not in that screenshot.

I was just thinking about this because MD-380 Basic or Enhanced will not show up on DSD as being encrypted calls. The Hytera literature says no Enc parameters are sent for Basic Enc, yet DSD saw something in the signalling to indicate Enc is in use.

 

[7312345]

Enc group call sometimes appear after the data show Hytera encryption is not compatible with Motorola

 

[johnls7424]

Enc group call sometimes appear after the data show Hytera encryption is not compatible with Motorola

The big "M" seems to me like they keep their Trunking and Encryption pretty much proprietary. Probably so the end user is forced to purchased only Motorola radios to keep interoprability within these factors.

 

[RayAir]

Yeah in the screenshot Ray I don't see the " enc" indication either. Also Ray: have you tried to see if Hyteras encryption is compatible with Motorolas encryption standard?

Supposedly Motorola EP works with Hytera full encrypt 40 bit Enc but I have to update the firmware in the radio.

All I can put in the Hytera now is Basic encrypt 40,128 or 256 bit.

 

[sycho]

Ok, i've finally concluded the analisys over Moto and TYT Basic encryption. They are very different, it's impossible to interoperate between both.

* Moto basic encode individual ambe voice data frames before FEC, and then FEC is added.
* TYT basic do the xor'ing over the DMR frame payload (3 voice frames with FEC).

How is TYT basic able to pass thru Moto repeaters? I'm afraid that it just works, but repeater receiver FEC will add errors, so range should be reduced.

BTW, TYT enhanced (128 bit) is NOT AES, and encoding is done before FEC, so it should work fine over Moto or Hytera repeaters as they were in the clear. I will analyze it in the future, but i'm afraid that it's just a static keystream encryption.

 

[sycho]

BTW, TYT enhanced (128 bit) is NOT AES, and encoding is done before FEC, so it should work fine over Moto or Hytera repeaters as they were in the clear. I will analyze it in the future, but i'm afraid that it's just a static keystream encryption.

I can confirm that it's a static encryption, over ambe frames before FEC, just like Moto Basic. Only difference is that Moto uses a keystream generated from the 8bit key (1-255 user selectable keys) and TYT use a 128bit key to generate the 49bit keystream to xor the ambe frame (nonsense). It's not a transposition cipher.

So there could be two or more different keys which result in the same keystream. And knowing how the TYT EP keystream algorithm works, i'm nearly sure that it could be made to interoperate with Moto Basic.

There is just one issue to investigate the TYT algorithm: the silence frames generated by the TYT Ambe vocoder are not consistent. There are silence frames as per the standard, but some bits changes from ptt to ptt. I would need to build a tone/noise generator to produce static and known Ambe frames continously.

 

[johnls7424]

Wonder if the MD-390 will have upgraded encryption standard. To fix the issues and concerns some users have with the MD-380

 

[sycho]

Wonder if the MD-390 will have upgraded encryption standard. To fix the issues and concerns some users have with the MD-380

I bet not. Don't expect too much from it. They (TYT) don't write the fw themselves, so the less changes the cheaper. To upgrade encryption algorithm, they would have to pay the consultant to develop it. Implementing AES or even DMRA AES over the existing firmware is not easy nor cheap. They have important cpu constraints due to the AMBE vocoder implemented in software.

They told 390 will come with GPS, then not in first batches... they did the same with 380, i saw first MD-380 advertisements with "GPS Included" and then it dissapeared, although the MD380 PCB has the space for the GPS module.

 

[johnls7424]

I bet not. Don't expect too much from it. They (TYT) don't write the fw themselves, so the less changes the cheaper. To upgrade encryption algorithm, they would have to pay the consultant to develop it. Implementing AES or even DMRA AES over the existing firmware is not easy nor cheap. They have important cpu constraints due to the AMBE vocoder implemented in software.

They told 390 will come with GPS, then not in first batches... they did the same with 380, i saw first MD-380 advertisements with "GPS Included" and then it dissapeared, although the MD380 PCB has the space for the GPS module.

Yeah that is true. I always felt that they wouldn't change much. Only good thing they got going for them besides the price is the free programming cable and software. Motorola software prices added on top of the cost of the radio sometimes is discouraging

 

[RayAir]

I can confirm that it's a static encryption, over ambe frames before FEC, just like Moto Basic. Only difference is that Moto uses a keystream generated from the 8bit key (1-255 user selectable keys) and TYT use a 128bit key to generate the 49bit keystream to xor the ambe frame (nonsense). It's not a transposition cipher.

So there could be two or more different keys which result in the same keystream. And knowing how the TYT EP keystream algorithm works, i'm nearly sure that it could be made to interoperate with Moto Basic.

There is just one issue to investigate the TYT algorithm: the silence frames generated by the TYT Ambe vocoder are not consistent. There are silence frames as per the standard, but some bits changes from ptt to ptt. I would need to build a tone/noise generator to produce static and known Ambe frames continously.

Do you think processing MotoTRBO Basic Privacy signals through a MD-380 set to Enhanced Privacy would produce any results if you somehow guessed a close key?

Just made a test zone in my 380 with 8 different EP keys and tried a couple dozen BP codes through the 380.

Results varied, but nothing I would consider close.

Thanks for your work on this.

 

[sycho]

Do you think processing MotoTRBO Basic Privacy signals through a MD-380 set to Enhanced Privacy would produce any results if you somehow guessed a close key?

Just made a test zone in my 380 with 8 different EP keys and tried a couple dozen BP codes through the 380.

Results varied, but nothing I would consider close.

Thanks for your work on this.

Yes, it should. But take in mind that MotoTRBO Basic has 255 different keystreams, while TYT EP has 562949953421312 different keystreams.

 

[RayAir]

Yes, it should. But take in mind that MotoTRBO Basic has 255 different keystreams, while TYT EP has 562949953421312 different keystreams.

It seems getting TYT EP and Moto BP to work together might be possible. I just don't know how practical it will be unless someone can figure out which keys would be best to try without blind testing.

See if you can understand any of these. I think the TRBO BPkey processed through 380 EP is somewhat intelligible:

MotoTRBO Basic Privacy Key Processed Through MD-380 EP Key:

https://www.dropbox.com/s/f9fe2bcjxfsyhd0/MotoBP-TYT380EP.wma?dl=0


TYT MD380 Enhanced Privacy Processed Through MotoTRBO BP:

https://www.dropbox.com/s/9flj9txucol232s/TYT380EP-through-MotoBP.wma?dl=0


Hytera has something on their DMR radios called "Basic Encrypt" and it comes in 3 flavors, 40, 128, or 256 bit. I believe the only difference between Hytera Basic Encrypt and Hytera Full Encrypt, is that Basic is a static key and Full has an encryption initialization vector which changes each superframe. I have basic and full DMRA encrypt on my Hytera's and listening to basic 256 enc and full AES256 enc sounds the same except DSD shows a PI header, MI, and KeyID for the AES.


Hytera Basic Encrypt Using A 40 Bit Key:


Hytera 40 bit Basic Encrypt As Heard By A Radio With No Key Or DSD+:
https://www.dropbox.com/s/5bjfi7f9yqkzo0d/Hytera-40bit-Basic-Encrypt.wma?dl=0

Hytera 40 bit Basic Encrypt Hack 1:
https://www.dropbox.com/s/bc8s51cafimy2g5/Hytera-40bit-Basic-Enc-Hack1.wma?dl=0

Hytera 40 bit Basic Encrypt Hack 2:
https://www.dropbox.com/s/j9unsgabg71zrxy/Hytera-40bit-Basic-Enc-Hack2.wma?dl=0

Hopefully these Dropbox files came out good. I used a new mic set up and got tired of Zippyshare issues.

Thanks