8 May 2021

yet another STANAG-4481F 50-75Bd broadcast

5716.0 KHz (cf): STANAG-4481F (apparently) 75Bd fleet broadcast from NAU Isabela (PTR), running with the "odd" and already observerd 3-bit format (Figure 1).

Fig. 1

Removing the third column which contains the replicated bits and then reshaping the resulting bitstream to a 7-bit pattern, it turns out the actual 50Bd speed and the usual KW-46/KIV-7 encrypted stream (Figure 2).

Fig. 2
As mentioned, this behavior has already been noted previously in STANAG-4481F transmissions from NSY Niscemi, AJE Barford and just from NAU: for more informations, the related posts are grouped under a specific tag.


7 May 2021

Canada's East Coast Navy STANAG-4481P broadcasts

STANAG-4481 PSK (4481-P) waveform carrying the KW-46 secured fleet broadcast of the Canada's East Coast Navy.  STANAG-4481P is basically a STANAG-4285 sub-mode which adopts fixed 300 bps data-rate and long interleaving. As well as 4285, 4481-P is mostly used in  NATO Naval broadcast  due to its repeated preamble for which it's easy to maintain sync during long transmissions.  

Fig. 1
Fig. 2 - x^31+x^3+1 m-sequence used to sync the receive KW-46 unit

Transmitter site is most likely the Naval radio Station (NRS) of Newport Corner (NS). Both the NRS Newport Corner transmitter and NRS Mill Cove receivers were automated and are currently operated by HMCS Trinity at CFB Halifax [1]. 

Fig. 3 - TDoA results


[1] https://military.wikia.org/wiki/CFB_Halifax

3 May 2021

unid, and somewhat peculiar, 1200Bd DBPSK

Cleaning up one of my hard disks I came across an old recording (year 2014) that had no comment file associated with it, so I decided to take a look at it and see what exactly it was. The recording consists of different length bursts, each burst is modulated with PSK2 at a symbol rate of 1200Bd: nothing particularly interesting unless its ACF and, consequently, its period. Indeed, the ACF results in 373.74 ms (Figure 1) that make a length of the period of 448.5 bit (PSK2 @1200Bd), but after the differential decoding the bitstream shows a 897 bit length period, ie just the double of the value obtained using the phase detector. 

Fig. 1 - 373.74ms ACF corresponding to a 448.5 bit length period

As you know, a such situation is typical in asynchronous framings that have the stop-bit of 1.5 or 2.5 in length: for example, in case of a 5N1.5 framing the bit editor groups two 7.5 bit frames into a single 15 bit pattern because it can't represents a length of half bit. That's just what may happen here: the bit editor reshapes the bistream to a 897 bit length period and draws two frames (Figure 2) consisting of two 100 bit sync sequence, each followed by a data block.

Fig. 2 - 897 bit period

However, it's to notice in Figure 2 that the lengths of the two data blocks are different (348 and 349 bit) while the sync sequences have a constant length of 100 bit. Looking at Figure 3, the synchronization patterns are left and right inclined for periods of length 488 and 489 bits respectively: that behavior may confirm the 448.5 bit frame as measured above.

Fig. 3 - inclined 100 bit patterns in 448 and 449 bit framings

Talking about it with my friend cryptomaster, we agreed two possible hypothesis:

1) the length of the frame is 897 bit: the framing consists of  two 100 bit sync sequences that are interspersed with two data blocks of  348 and 349 bit; the variable length of the two data blocks and the two sync patterns are a proper feature of this waveform;

2) the length of the frame is 448.5 bit: the framing consists of 100.5 bit for the sync sequence (possible, even if unlikely) followed by 348 bit for the data block.

In order to verify the second assumption,  I set the speed of the PSK demodulator to a double value (2400Bd) so to emerge the missing half bit, if any. The resulting bitstream is shown in Figure 4: the period has the expected length of 1794 bit (2 × 897) and it's possible to see sync sequence patterns of 201 bit in length, ie just the extra bit that was missing.

Fig. 4 - 201 bit sequences in the bitstream @2400Bd

Indeed, the 1794 bit period is arranged as: | 201 bit sync  | 696 bit data | 201 bit sync | 696 bit data |;  since the speed of demodulation is doubled, dividing by 2 we get a 448.5 bit frame consisting of 100.5 bit for the sync sequence followed by 348 bit for data:

However, keep in mind that the above bitstream was achieved after a forcing of the demodulation speed to 2400Bd (instead of the effective 1200Bd) and the subsequent differential demodulation: more observations are needed to confirm the 100.5 bit length of the sync sequence.
By the way, the 100 bit sequence may be de-scrambled by the polynomial x^7+x^4+1. Looking for a scrambler polynomial in the 201-bit sequence does not make sense since the way it was obtained.
Fig. 5 - x^7+x^4+1 polynomial

Back to the signal, it's interesting to note that some burts have a ~230ms preamble consisting of 8 x PSK2 1200Bd "pulse" (Figure 6): I don't know the reasons and what it can depend on, signal strength and fading seem to indicate that it is not an exchange of messages between two nodes or an ARQ mode.

Fig. 6


20 April 2021

Arcotel-MAHRS 2400 serial

The so-colled Arcotel-MAHRS 2400 is a 2400Bd PSK-8 serial waveform with simmetical 2 x 8 pre-tones in respect of the 1800Hz carrier. The signal has strong 106.66ms ACF spikes (256 tribit symbols) due to its frame structure: an initial 80 symbol (240 bit) preamble that is followed by a data block consisting of 176 data symbols (528 bit). The pronouncec BPSK states in the constellation plane are due to the BPSK modulation of the preambles (Figure 2).
Fig. 1

Fig. 2

The waveform belongs to the Telefunken Racoms HF HRA 5100 radio communication, an ARQ-like system used in airborne platforms for air-to-air and air-to-ground comms. As far as is recoverable from the web, "MAHRS" (Multiple Adaptive HF Radio System) is the name of the HF radio-data standard originally developed by Telefunken and "Arcotel" is the radio processor. The HRA 5100 system has been replaced by the more recent HRA 9100, both supplied by Elbit System (Figure 3).

Fig. 3

17 April 2021

unid secondary protocol

Recently I ran across on several transmissions in the 5 MHz band (also available on a secondary basis for amateur use) consisting of STANAG-4538 point-to-point circuit mode service with 188-110A (300, 1200, and 2400 bps) used as traffic waveform. The transmissions are receivable in Northern Europe with a good SNR, especially using the KiwiSDR receiver at OZ1AEF (Skanderborg, Denmark): they are very frequent, of short duration, and occur on at least a half dozen different channels between 5300 and 5400 KHz USB. Given their unpredictability (time/channel) and their duration, a Direction Finding is very difficult, at least with the means at my disposal.  

Fig. 1 - 188-110A running at 2400bps

The excellent SNR allows demodulations without many errors and therefore the possibility of examining and comparing the obtained bitstreams: to be honest, I expected to find a known data-link protocol or at least sequences attributable to some encryption technique (known or not )... but that's not what exactly happened.  

Although the ACF doesn't produce results, comparing various demodulations it turns out that all the bitstreams exhibit the same initial 20 (16) bit sequence 11110000100111010111 (0000100111010111). By syncing the bitstreams on the two sequences, interesting results are obtained: in particular, with the 20-bit sequence we get patterns that have a fairly well-defined structure in the first 196 bit and more clear than the one obtained with the 16-bit sequence (Figure 2).

Fig. 2 - bitstreams synched on 11110000100111010111 sequence (first 196 bit)

One could argue that the 16-bit sequence (LSB)0000100111010111(MSB) is the binary equivalent for 0xEB, ie the sync sequence of STANAG-5066 frames: unfortunately, the following bytes do not match the Data Transfer Sublayer headers, ie the (supposed) fields do not contain data that make sense (EOT, size of address,...).

https://disk.yandex.com/d/qPt2CXC2x76yfg (wav)

https://disk.yandex.com/d/8tn5OrrXlsuL4A (streams)

16 April 2021

CIS Navy FSK 50Bd/250 (T-600)

50Bd/250 FSK is another waveform used by CIS Navy for their fleet broadcast. Unlike the same waveform but with 136-bit framing (T-600 136), this one shows all the characteristics of the (perhaps more) well known 50Bd /200 broadcast, ie:

* 44 bit sequence (usually  "11100001010010111110000101001101011010101101")
* 70-bit Initialization Vector (ten 7-bit words, repeated twice)
* payload arranged in the 4:3 ratio
* 7-bit words "000100" as EOM



15 April 2021

a long (and protected) FLSU async scanning call

STANAG-4538 async call of FLSU protocol consists of the transmission of 1.35N (nearest integer value) Request type 3 PDUs on the requested link frequency, where N is the number of channels in the scan list, and 1.35 is the duration of each dwell period in seconds; the "scanning call" ends with a single FLSU request PDU of type 0 (Fig. 1). Since up to 61 requests are used, 45 are the allocated channels for this network.

000 10 1000100000 1010100110 0 0 011 101100 011111 11011111
001 00 1101010101 0010000011 0 1 110 001100 010111 01011010
000 10 1000100000 1010100110 0 0 011 101100 011111 11011111
001 00 1101010101 0010000011 0 1 110 001100 010111 01011010
000 10 1000100000 1010100110 0 0 011 101100 011111 11011111
001 00 1101010101 0010000011 0 1 110 001100 010111 01011010
000 10 1000100000 1010100110 0 0 011 101100 011111 11011111
001 10 1000100101 0111010110 0 0 011 011111 000101 00110111


Fig. 1 - LFSU async call

One might be wondering why the 61 requests have different formats: the answer is that the calling station uses the Linking Protection (LP) procedure. 3G-ALE LP scrambles the 50-bit PDUs using a scrambling algorithm that depends on a key variable, the time of transmission of the PDU, and the frequency on which it is sent (the latter two dependencies enter via a seed that is distinct from the key variable). The 50-bit PDUs are scrambled using alternating the two "Word Numbers" (provided by the seed) 00000000 and 00000001 while the PDU of type 0 that concludes the asynchronous call is scrambled using the "Word Number" 00000010: thus that the same PDU is scrambled 61 times (in this sample) using two alternating keys, that's the reason of the alternating patterns seen above. The effect of this alternating scrambling is also reproduced in the ACF function of figure 2.

Fig. 2 - Auto Correlation Function of the async call

The scrambling  procedure use the SoDark-6 algorithm (48-bit length) and then only the last rightmost 48 bits of each FLSU PDU are scrambled so the first leftmost two bits are sent without scrambling. 

Note that LP does not address jamming or similar techniques, which are best countered by TRANSEC, nor is it intended to replace the COMSEC function of traffic protection. LP protects the linking function, including related addressing and control information.

https://disk.yandex.com/d/YM8rWZvP4heOoA (wav)
https://disk.yandex.com/d/wNR0-nLOl7i87g (bitstream)

14 April 2021

3 x 250Bd/500 FSK, likely Ukr nets

3 x 250Bd/500 FSK channels, probably Ukrainian-Mil broadcast, already met here in october 2020. This sample shows a 334-bit period with interesting preambles consisting of a repeated pattern followed by a "counter/progressive" binary field.



8 April 2021

Rus 75Bd/200 FSK (T-208)

During the last week I have been monitoring the 75Bd/200 FSK transmissions (T-208 equipment) on 9044.0 Khz (CF): transmissions are on-air during daytime only, are encrypted (likely linear encryption) and appear look like  "fleet broadcast" in the way of T-600 50Bd/200 FSK or NATO S-4285 (ie continuous broadcast). 

Fig. 1

 All TDoA results point to Smolensk area, a Russian military communications center (Figure 2).

Fig. 2

T-208 equipment is announced as QYT9 in CW op-chats, for example:
RCB de RJF94 QYT9 QSX 8573 K.      
RJF94 de RCB OK QYT9 QWH 8573 K.

(RJF94 and RCB negotiate T-208 mode on 8573 Khz)


A similar transmission (75Bd/200 FSK) was heard on 11 Jan 2018 on 4540.0 KHz. In that case, after differential decoding, the stream showed up a clear 365-bit period (Fig. 3) due to the sequence of the scrambler polynomial x^8+x^6+1. The descrambled stream is shown in Figure 4 (thanks to cryptomaster).



31 March 2021

CIS-1200 DBPSK 1200Bd ("Makhovik", T-230-1A)

Good quality CIS-1200 (T-230-1A, DBPSK 1200Bd) transmission spotted on 9073.80 KHz (cf) thanks to the ArcticSDR. The transmission consists of a series of encrypted messages, the 240-bit Initialization Vectors are sent in 8x30-bit groups, each group repeted three times (Figure 2).

Fig. 1

Fig. 2

The transmission ends with a long "idling" part consisting of the 511-bit m-sequence generated by the polynomial x^9+x^5+1 (Figure 3). All is ok with previous CIS-1200 recordings [1].

Fig. 3

[1]  https://i56578-swl.blogspot.com/search/label/Makhovik