This post compares the COMSEC preamble of a STANAG-4285 link on 4147.4 kHz with other HF recordings that show the same structure.
The first transmission, intercepted on 4147.4 kHz/USB, was kindly sent to me by my friend Kosmod. It consists of bursts modulated with STANAG-4285 in 600 bps mode with short interleaver. The duration and sequence of the bursts in Figure 1 point to an ARQ system (Automatic Repeat reQuest): the longer bursts carry messages, each followed by short bursts that act as ACKs (acknowledgements).
As shown in Figure 1, each burst begins with four unmodulated tones lasting ~90 ms, separated by asymmetric frequency spacings of 700 Hz, 500 Hz and 900 Hz. This variant is not specified in the STANAG-4285 standard. The four tones form an all-in-one synchronization preamble: the spacing pattern appears to identify the network, while the tones also work as a channel probe and a CW sync probe.
 |
| Figure 1: Spectrogram of the 4147.4 kHz/USB recording (WebSDR, 25 Sep 2023). The upper panel shows the sequence of long message bursts and short ACK bursts; the lower panel is a zoom on the start of a burst, showing the four initial unmodulated tones. |
The message bursts do not all have the same duration. After demodulation, each one carries one or more encrypted messages. The structure is the one typical of protected HF links: a COMSEC preamble (the block of data that prepares the receiver to decrypt the message) followed by the encrypted message itself. In greater detail:
- Frame Sync: 64 bits (8 bytes), a fixed pattern that marks the start of the COMSEC preamble: 0001100001000001110001011110010110111011010010010111110101011001
- Initialization Vector (IV): 128 bits (16 bytes), repeated 5 times (640 bits in total). An IV is a value sent along with an encrypted message so that the receiver can decrypt it; it is normally expected to change from one transmission to the next.
- Reversals: 64 bits of alternating sequence (0101...).
- Encrypted payload: ciphertext message, probably followed by an encrypted EOM/postamble.
Figures 2, 3 and 4 clearly illustrate the structure of the COMSEC preamble.
 |
| Figure 2: Demodulated bitstream displayed with a 128-bit period. The 64-bit Frame Sync is located with the Find function (zero bit errors), marking the start of the COMSEC preamble. |
 |
| Figure 3: The same bitstream with a 128-bit period: the Initialization Vector (128 bits) is repeated five times (640 bits in total), appearing as identical vertically aligned rows. |
 |
| Figure 4: The Reversals field, 64 bits of alternating 0101... sequence, located with Find, immediately before the encrypted payload. |
The most striking and interesting feature is the structure of the Initialization Vectors visible in Figure 3. As can be seen, the two IVs, taken from two different bursts, have 40 bits (5 bytes) in common, in exactly the same positions. This is quite unusual for IVs, which are normally expected to differ from one transmission to the next.
To verify this unusual structure, I synchronized the entire bitstream of the transmission on the Frame Sync value and limited the output to 192 bits, i.e. 64 sync bits plus the first instance of each IV. The result is shown in Figure 5 and clearly reveals the structure used for the IVs:
bit 0-63: 64 variable bits
bit 64-103: 40 fixed bits 0000000001000000000000010000100000001001 = 0x0040010809
bit 104-127: 24 variable bits
The fixed block is contiguous and begins and ends on byte boundaries, so the layout is 8 bytes + 5 bytes + 3 bytes.
 |
| Figure 5: Bitstream synchronized on the Frame Sync and limited to 192 bits (64 sync bits plus the first instance of each IV), showing the 40 fixed bits within the IV structure. |
An IV with 40 fixed bits and 88 variable bits is not a purely random IV, but could be a structured field. The fixed block starts and ends on byte boundaries, which makes a field-based structure plausible. Moreover, only 5 of its 40 bits are ones (0x00 0x40 0x01 0x08 0x09), which looks more like a set of flags or control fields than random data. If the 40 bits were just padding, one would not necessarily expect them to be transmitted; if they are transmitted, they may carry information. An alternative explanation cannot be ruled out, for example an 88-bit nonce completed by a fixed part.
I remembered that I had already come across a similar COMSEC preamble structure with a 128-bit IV. Browsing my blog, I found a transmission from the Tunisian MFA intercepted on 29 July 2026 and analyzed in a later post on 3 August 2026 [1]. The similarities are remarkable:
- In that case the HF modem was MS-110A, but with a non-standard start: four unmodulated tones with the same asymmetric spacing (700/500/900 Hz) as the initial tones of the STANAG-4285 transmission analyzed here.
- Identical bit-by-bit structure of the COMSEC preamble, i.e. the same 64-bit Frame Sync, 128-bit IVs, and a 64-bit run of 01 reversals.
I repeated the same analysis procedure as before, but this time on the entire bitstream of the Tunisian MFA transmission, i.e. synchronizing on the Frame Sync plus the first instance of each IV (192 bits in total). Comparing the two analyses (see Figure 6), the fields that make up the IVs are perfectly matching.
 |
| Figure 6: Comparison of the IV structure in the STANAG-4285 transmission (top) and the Tunisian MFA MS-110A transmission (bottom), both synchronized on the Frame Sync and limited to 192 bits. |
I applied the same procedure (synchronizing the bitstreams on the Frame Sync sequence) to other recordings that also carry 128-bit IVs repeated five times [2]. The results show five transmissions in total (three of them shown in Figure 7) on different HF modems (MS-110A, STANAG-4539 and STANAG-4285) that share the same COMSEC preamble layout and the same IV structure, with a block of 40 fixed bits inside a 128-bit IV. The only exception is the STANAG-4539 recording, in which 2 of the 40 bits differ (Figure 7). Note that STANAG-4539 is the NATO equivalent of MIL-STD-188-110B Appendix C, which is why the corresponding recording file is named "188-110B_APP-C".
 |
Figure 7: IV structure in recordings made on different HF modems, synchronized on the Frame Sync and limited to 192 bits: MS-110A (6.670 MHz, 2 Oct 2017), STANAG-4539 (equivalent to MIL-STD-188-110B Appendix C; 7.9985 MHz, 9 Mar 2018) and STANAG-4285 (4.015 MHz, 10 Jan 2020). The 40 fixed bits are the same in all three, except for 2 bits in the STANAG-4539 recording. |
Open questions: what the 40 fixed bits encode, whether the variable parts of the IV follow a pattern (for example a counter), and which cipher is used. A 128-bit IV is consistent with a 128-bit block cipher such as AES, but this remains a hypothesis.
[2] ttps://i56578-swl.blogspot.com/p/initialization-vectors.html
No comments:
Post a Comment