28 June 2018

COMSEC transmissions using a S4285 variant (poss. Croatian-Mil)

Encrypted transmissions on 6931.0/usb which use a slightly modified 4285 waveform with 4 preamble tones and running 600bps/Short sub-mode. Transmissions are between two stations in simplex, are quite frequent during the daytime and are not preceded by ALE or voice calls: probably it's not a network but rather a PtP link where peers are tuned on the same frequency.
Fig. 1
The COMSEC preamble in some way resembles 188-220D, it has a period of 128 bits and in my guess it consists of 3 parts:

A) 60-bit Frame Sync (110000100000111000101111001011011101101001001011111010101100)
B) 5 x 128-bit encoded Message Indicator
C) 64-bit idling sequence (time to load the key?)

preamble is then followed by the encrypted block (D) which ends with "01" sequences (E).
Fig. 2
Fig. 3
All the TDoA multilaterations I've done indicate the region of Split in Croatia, also this post  suggests the same source. Unfortunately it was not possible to use TDoA more effectively: the signals have mostly short airtime and there are no close GPS'ed SDRs to both the west and east.

Fig. 4
It's worth noting that the same add of the 4 initial tones is also visible in the 110A waveform recorded on October,2 2017; in that recording the same 128-bit protocol was detected:

Fig. 5

22 June 2018

redefining T-207 checksums

T-207 is a multiplexed two channels "system" and can be connected to several modems therefore it can be found in several FSK waveforms. Since the lack of official documentation it's difficult to say much more about the (former Soviet) T-207: guys from radioscanner talk about "equipment" as a in-line ciphering device, ex DDR STASI archives refer to T-207 as an encryption algorithm; probably the name of the algorithm has been used to indicate the system that implements it, altough its characteristic "checksums" are also recognizable in clear text transmissions.

AFAIK, T-207 has two frame formats:  
14 bits: 2 x 6 bits + 2 parity bits
28 bits: 2 x (2 x 6 bits + 2 parity bits)

Using the 14-bit frame format, the two channels A and B may be splitted as:
1A 2A 3A 4A 5A 6A 1B 2B 3B 4B 5B 6B PP (47.5, 50, 84.21, 94 Baud waveforms) 
or interleaved
1A 1B 2A 2B 3A 3B 4A 4B 5A 5B 6A 6B PP (100 Bd waveforms and CIS-14)
The 28-bit frame format is used in 200 Baud waveforms and supports up to 4 channels, splitted as:
1A 1C 2A 2C 3A 3C 4A 4C 5A 5C 6A 6C PP 1B 1D 2B 2D 3B 3D 4B 4D 5B 5D 6B 6D PP

As said in the previous posts, T-207 detection had to be manually spotted by processing the demodulated bitstream and checking if it matches the criteria described in this post in radioscanner forum: you have to count the number of "1" bits in the first 12 columns then check if the 13-14 bits have a value among the expected ones.
The Octave script shown here has been improved and now it detects the presence of T-207 checksums in a given bit stream and for each permutation of the checksum bits. I run the script against several waveforms and the results are very interesting.
So far, I found two checksum modes termed "3" and "20":

and three waveforms (50Bd/1000, 100Bd/500, VFT 6x100Bd/120)  that can be coded with both the two checksums:

It's worth noting a CIS-14 96Bd/500 transmission which transposrts data only in channel B: it's probably a test since data are in clear-text mode

The Octave script T202_detect.m can be downloaded from:

15 June 2018

STANAG-4539: unexpected data rate of 12800 bps

Long transmission (hours) of STANAG-4539 8PSK 2400 Bd bursts spotted on 14 June morning on 7807.2/usb:  each burst lasting 1680 ms and composed of 13 x 287 tribit symbols frames. It's interesting to note the uncoded 12800 bps speed detected by the 5710-A modem: using 8PSK at a modulation rate of 2400Bd, the the maximum data rate obtainable is 4800 bps (7200 bps on-air) therefore there is something wrong somewhere (a data rate of 12800 bps is obtainable using QAM64 modulation at 2400 Bd). STANAG-4539 is an "auto-baud" waveform, so perhaps they use a modified preamble that misleads the modem.
A run of TDoA multilateration says Cornwall (UK) as Tx location, possibly UK MoD DHFCS tests from St.Eval? 

Fig. 1
Fig. 2
Fig. 3


12 June 2018

TDMA waveforms (STANAG-4539 Annex D,...) and NILE/Link-22

Recently, some friends and me happened to run into QPSK and 8PSK burst waveforms that are among those described by STANAG-4539 for TDMA operations (Time Division Multiple Access) and that are used by NILE/Link-22. Even if I do not have a direct confirmation, my prudent guess is that it is probably about Link-22 transmissions.

In TDMA mode each user is allowed to transmit only within specified time intervals (Time Slots) so that different users transmit in differents time slots. When users transmit, they occupy the whole frequency bandwidth (separation among users is performed in the time domain). 
According to S-4539 D, a TDMA slot is the high level structure in which information will be transmitted/received and it is composed of a Preamble, a certain number of Media Code Frames and a Guard Time (Fig. 1).

Fig. 1 - TDMA Slot Time
A Media Code Frame is composed of 270 symbols to be transmitted/ received at the modulation rate of 2400 baud and following a certain waveform structure (Traffic Waveform) with different waveforms and modulation. Each Traffic Waveform is composed of a sequence of different DATA blocks and Mini Probe (MP) blocks: the DATA block contains coded user information symbols and the MP block contains known training symbols to be used by the equaliser. There are two different types of PSK modulations: QPSK and 8PSK. The QPSK modulation is used for preamble transmission, QPSK or 8PSK are used for Media Code Frame transmission.
As far as I know, and from S-4539 D, the 270 symbols of a Media Code Frame are arranged according the used Traffic Waveforms (TWF):
TWF1: 4 sections with 48 data and 19/20 probes 
TWF2: 8 sections with 18 data and 15/16 probes
TWF3: 4 sections with 48 data and 19/20 probes
TWF4 to WF7: 1 section with 240 data and 30 probes 8PSK 
TWF?: 3 sections with 60 data and 30 probes 

That said, the  270 symbols (length of the Media Code Frame) sent at 2400 symbols/sec, regardless the used Traffic Waveform, should produce an ACF value of 112.5ms.
The analysis of the signals was therefore targeted at checking that ACF value, the structure of the Media Code Frames (Traffic Waveforms) and some other possible regularities among the signals. Unfortunately I have only the annex D of S-4539 which specifies only the first three Traffic Waveforms while from some advertising on the internet, Fig. 2, one can see that they can be up to 18 (Annex G).

Fig. 2 - STANAG-4539/Link-22 Traffic Waveforms
The lack of official documentation means that these signals can not be identified exactly as Link-22, but there is a good chance that they will be.

QPSK modulations
Below an interesting  4 Media Code Frame slots transmission (Fig. 4). Each Media Code Frame (270 symbols, 112.5ms) seems composed of 3 packages with 60 data and 30 probes (Fig. 5)

Fig. 4 - 4 Media Code Frame slots
Fig. 5 - Traffic Waveform composed of 3 packages
In Fig.6 is shown a Media Code Frame that uses a Traffic Waveform composed of only 1 package (TWF 1-7) followed by a 3 packages Traffic Waveform (37.5ms).

Fig. 6

8PSK modulations
In this sample the Media Code Frame uses a Traffic Waveform composed of two packages (Fig. 7)

Fig. 7 - 2 packages Traffic Waveform

As verified by KarapuZ, all the analyzed signals have the same preamble: here below, Figs. 8 and 9, an example of two signals (8PSK and QPSK)

Fig. 8
Fig. 9
(to be continued)

10 June 2018

CIS-12 TDoA measurements using GPS time-stamped IQ samples from KiwiSDRs

TDOA (Time Difference Of Arrival), also known as multilateration, is a well-established technique for the geolocation of RF emitters. Using three or more receivers, TDOA algorithms locate a signal source from the different arrival times at the receivers.
In this case, TDoA measurements are related to a CIS-12 signal (modem AT-3004D) spotted this morning on 11414.0 KHz/usb and use GPS time-stamped IQ samples from four KiwiSDRs: F1JEK (JN05hs, southwestern France), SV3EXP (KM07qx, west Greece), UR5VIB (KN68DL, central Ukriane) and KHIMKI (KO85qw, near Moscow city Russia). 
Cross correlations suggest the Crimean peninsula as the area of Tx antenna. Since CIS-12 is widely used by Rus-Ny, it's quite reasonable to assume that the Tx be in Sevastopol, Black Sea fleet HQ. Note the scattering in the correlations involving the French SDR (F1JEK) which are due to multipath propagation.


Plots are obtained using my (old) Ubuntu 12.06 LTS updated to gcc 6.6 and gnuplot 4.4; TDoA algorithms implemented by Christoph mayer:
and GNU Octave, scientific programming language, version 4.4:

5 June 2018

Nokia msg terminal + Tadiran HF equipment

Transmission picked up some days ago by my friend AngazU using the SM2BYC Kiwi sdr. The signal is composed of an initial tone followed by a preamble consisting of F7B modulation (apparently MFSK-4) and two simultaneous FSK modulations (Fig. 1). As suggest by cryptomaster and KarapuZ, this is an interesting example of a Nokia Adaptive MSG Terminal which is used along with a Tadiran HF equipment that presumably provides an active noise cancellation feature.

Fig. 1 - waveforms
The upper FSK 125Bd/290 delivers the same 84-bit pattern and it's interesting to note that the last 84-bit sequence is sent in opposite polarity:  perhaps signalling the last group/block of data (sent in the lower FSK).  The same parameters (FSK and 84-bit pattern length) has been discussed here in radioscanner:
Although, of course, we can be wrong because a specific description of this function was not found TADIRAN HF modems.

The lower FSK 300Bd/780, after the initial 1-0 sync sequence pattern, delivers data and seems to have a 16-bit period. After differential demodulation the stream exhibits 8 solid bits columns in a 16-bit period and once removed the stream does not have a clearly defined period (Fig. 2).

Fig. 2 - bitstreams
Cryptomaster is inclined to the Machester modulation but I get errors in both the phase conventions (G.E.Thomas and IEEE 802), and he pointed me that the signal has a constant preamble whicH is not coded using Manchester (Fig. 3) and causes mistakes in decoding.

Fig. 3

As for as I can see, the same F7B + FSK125Bd structure is sent first but without the lower FSK300Bd (Fig. 4). The patterns are the same in the two FSK125Bd streams, perhaps it is used to initialize the (supposed) Tadiran noise blanker function?


3 June 2018

MIL 188-110C App.D: 9KHz/7200Bd & 12KHz/9600Bd

9KHz/7200Bd & 12KHz/9600Bd WBHF waveforms spotted on 9 MHz band. Both the ACFs show a value of 120ms that corresponds to 864 symbols for the 7200 Bd waveform (768 uk + 96k) and 1152 symbols for the 9600 waveform (1024 uk + 128 k).

The extra spikes in ACF diagrams, more evident in CCF, in my guess are due to the cyclically rotated version of the mini-probe which is utilized to identify the long interleaver block boundary (MIL 188-110D #D.5.2.2). Note that 2 data block make 4608-bit blocks (768x2x3) and 21 data blocks make 64512-bit block (1024x21x3), therefore the CCF spikes are related since 64512/4608=14