18 May 2019

KW-46 secured traffic over 188-110A, prob. US/Australian NCS HEH


These signals were recorded and monitored on 14462.0 KHz/USB thanks the KiwiSDRs at OI33 and OI33SA in Jakarta, Indonesia:

behavior and waveform Transmissions take place mainly during the morning time UTC, probably scheduled from Thursday to Saturday, and consist of very long traffic sessions (
although not continuous, as S4285 broadcasts are) alternated with equally long idling sequences. Several times I went late on the signal and given the lack of preamble re-insertions in the 110A waveform, the acquisition of sync, and the consequent decoding, were impossible. After days of long monitoring I had the chance to record the start of a transmission and then identify the mode, i.e.: 600bps/Long.
Since the absence of any "ALE phase" in the time interval immediately preceding the start of the transmission (Fig. 1), it's difficult say if we're dealing with PtP or broadcast transmissions to staring receivers in standby.

Fig. 1
The analysis of the frame structure (Fig. 2) confirms 110A operations at low datarates: each frame is composed of 40 tribit symbols, or 120 bits, (20 symbols for miniprobe + 20 symbols for data). In low datarate modes, from 150 to 1200 bps, the 480-bit length of the 110A scrambler exactly matches four frames (i.e.: 4 x 120 bits) and so it produces the strong 66.67ms spikes which are visible in the auto-correlation function.

Fig. 2
bitstream analysis The most certainly interesting aspect is the use of KW-46 encryption to secure data transfers (Fig. 3). Usually, the KW-46 crypto device is used in USN/NATO fleet broadcast paired with FSK 50Bd/850 or S4285 modems: it's the first time I see KW-46 secured traffic carried on air by 188-110A.

Fig. 3 - Fibonacci's bits in the demodulated bitstream
source and user As for the signal source, although the TDoA algorithm may be inaccurate due to the few KiwiSDRs in that region, considering the use of KW-46 crypto devices a plausible hypothesis can be the Royal Australian Navy (RAN) Naval Communication Station "Harold E. Holt" at Exmouth (NCS HEH) [1].

Fig. 4 TDoA result and HEH site

No comments:

Post a Comment