KW-46 secured traffic over 188-110A, MHFCS Townsville

21 October 2020

KW-46 secured traffic over 188-110A, MHFCS Townsville

Long 110A Serial transmission heard on 6345.50 KHz/usb and used for KW-46/KIV-7 secured fleet broadcast, task usually performed by S4285/S-4481 in NATO Navy.
The analysis of the frame structure (Figure 1) confirms 110A operations at low datarates: each frame is composed of 40 tribit symbols, or 120 bits, (20 symbols for miniprobe + 20 symbols for data). In low datarate modes, from 150 to 1200 bps, the 480-bit length of the 110A scrambler exactly matches four frames (i.e.: 4 x 120 bits) and so it produces the strong 66.67ms spikes which are visible in the auto-correlation function.

Fig. 1 - MIL 188-110A Serial Tone framing

The most interesting aspect is the use of KW-46/KIV-7 encryption to secure data transfers: its use is revelaed by the presence of the pseudo-random sequence generated by the polynomial x^31+x^3+1 (Figure 2). It's worth noting that, usually, the KW-46 crypto device is used in USN/NATO fleet broadcast with FSK 50Bd/850 or S4285 modems. A similar MHFCS transmission was reported here.

Fig. 2 - x^31+x^3+1 pseudo-random sequence

TDoA runs say Australian MHFCS [1] node at Townsville as the Tx site (Figure 3):

Fig.3 - TDoA results

The Bohle Transmitter Station site [2] is a site of approximately 484 hectares, located 10 kilometres west of Townsville (Figs. 4,5). As said, the station is a communications facility used by Defence and forms part of the Modernised High Frequency Communications System.