3 August 2026

Tunisian MFA HF Link: 128-bit AES Encryption and a Modified MS-110A Waveform

tags:

This post provides a breakdown of an HF diplomatic link between Tunisian MFA nodes using a modified MS-110A waveform. Based on audio subcarriers and bitstream measurements, the post analyzes the complete message-frame structure: from the initial 4-tone preamble and framing overhead to the COMSEC preamble protecting the AES payload.

A transmission session was logged at 16285.0 kHz USB on July 29, starting from 0855 UTC, and recorded thanks to linkz' remote KiwiSDR[1]. The exchange began with a standard 3-way link setup using the 141A (2G ALE) waveform, followed by 15 data bursts using MS-110A at 1200 bps (Short Interleave), and concluded with a formal link termination (Figure 1). The traffic was identified as belonging to the Tunisian Ministry of Foreign Affairs (MFA). Given that all bursts are of equal duration (~3500 ms), the session does not appear to employ an ARQ mechanism, which would typically involve data packets interspersed with short return ACKs.

Fig. 1: Spectrogram of the complete transmission.

Looking at the MS-141A ALE exchanges, the link setup follows the usual 3-way handshake:

TO [STAT155] TIS [STAT16]
TO [STAT16] TIS [STAT155]
TO [STAT155] TIS [STAT16]

where the used ALE addresses stand for:

STAT16: MFA Tunisian Embassy in Riyadh (caller node)
STAT155: MFA HQ in Tunis (called node)

The identification of the above callsigns is derived from verified loggings within the utility monitoring community such as UDXF[2].

In the vast majority of operational cases, the caller node (STAT16 in this sample) is also the station that switches to a traffic waveform first. The only exception occurs if the initial ALE call is an "Orderwire" type (1) or a reverse traffic request, where, for instance, STAT16 calls STAT155 essentially saying: "I am ready to receive your traffic". As in most cases, the link termination is signaled by the caller node (2):

TO [STAT155] TWS [STAT16]

1. Waveforms Analysis

The transmission operates in a simplex "turn-taking" structure. Each pair of bursts (excluding burst #13, which is standalone) functions as a bidirectional message exchange between the two nodes (Figure 2). 

Fig. 2: Simplex turn-taking sequence diagram illustrating the bidirectional burst exchange between STAT16 (Riyadh) and STAT155 (Tunis).
 
This is supported by the differing fading profiles observed within each pair, indicating that the two bursts in a pair travel along different propagation paths and therefore originate from different transmitting sites (nodes). As shown in Figure 3, the longer path for STAT16 introduces multipath propagation, resulting in frequency-selective fading. In contrast, the path for STAT155 is much shorter and exhibits negligible fading (flat channel), with the signal arriving stable and without significative attenuation.

Fig. 3: Spectral signatures and geographic paths of STAT16 and STAT155

Furthermore, the distinction between the two nodes was confirmed by measuring the audio subcarrier frequency in the pairs of MS-110A bursts against the nominal 1800 Hz frequency (Figure 4):

- 1787 Hz (-13 Hz offset) identifies the caller (STAT16, which switches to MS-110A first)
- 1770 Hz (-30 Hz offset) identifies the called station (STAT155)

Fig. 4: Subcarrier frequency comparison

It is worth noting that while the MS-110A standard specifies a clock accuracy of ±1 Hz for the generation of the 1800 Hz subcarrier (§ 5.3.2.3.9), the observed frequency offsets are slightly higher (−13 Hz and −30 Hz). This discrepancy is primarily attributed to overall transceiver local oscillator (LO) drift, frequency calibration tolerances, and ionospheric Doppler shifts. Despite these deviations, demodulation proceeds correctly as modern MS-110A DSP implementations employ carrier-tracking loops capable of acquiring and compensating for subcarrier offsets well within this range.

As shown in Figure 5, each burst begins with four initial unmodulated tones lasting ~80 ms with asymmetric spacings (700 Hz, 500 Hz, and 900 Hz), a variant of the MS-110A modem typically associated with tactical telecommunication systems (3) which is not specified in the standard MIL-STD-188-110A. These four tones form an "all-in-one" synchronization burst that serves to identify the network signature (700/500/900 Hz pattern) and acts as a channel probe and CW sync probe.

Fig. 5: 4-tone preamble preceding the burst, with asymmetric frequency spacings.

To better understand the physical characteristics of an MS-110A transmission at 1200 bps, it is worth looking at the relationship between the symbol rate, channel coding, and actual throughput. Over the air, the modem always transmits at a fixed symbol rate using 8-PSK, resulting in a physical channel capacity of:
2400 baud × 3 bits/symbol = 7200 bit/s
Out of the 7200 bit/s physically radiated, the required user data rate in this capture is 1200 bit/s. Therefore, the total channel overhead (accounting for FEC, framing, and preamble/sync bits) is:
(7200 - 1200) / 7200 = 83.33%

2400 baud × 3 bits/symbol (8-PSK) = 7200 bit/s physical channel capacity

This means that only 16.67% of the theoretical over-the-air capacity is dedicated to useful data coming from upper-layer protocols (4). Alternatively, if efficiency is evaluated simply against the 2400 baud symbol slots (rather than the full 3 bits/symbol capacity of 8-PSK), the useful rate of 1200 bps corresponds to exactly half the symbol rate — highlighting a symbol throughput efficiency of 50%.

2. Data Link Bitstreams Analysis

To allow a thorough analysis of the payloads originating from the Data Link layer, each burst was demodulated individually, yielding 15 distinct bitstreams (Figure 6). The most immediate observation — though expected — is that all bitstreams have an identical length of 436 bytes or 3488 bits.

Fig. 6: Demodulated binary files from the session.

Furthermore, the frame structure is identical across all bitstreams — exhibiting a uniform format (regardless of reception polarity):

[Frame Sync]→[IVs]→[01... Reversals]→[Payload/Data]→[EOM]→[01... Reversals]

Data Link frame layout with COMSEC preamble and encrypted payload (not in scale).

In greater detail:

- Frame Sync: 64 bits (8 bytes), 0001100001000001110001011110010110111011010010010111110101011001
- Initialization Vector (IV): 128 bits (16 bytes), repeated 5 times (640 bits total)
- Reversals: 64 bits of alternating sequence (0101...)
- Encrypted MSG Payload: Ciphertext message
- EOM/Postamble: 64-bit followed by reversals (0101...), totaling 2000 bits*

(*) the 2000-bit value assigned to the final "EOM & Reversals" block in the calculations above is derived directly from the bitstream analysis of the frame's closing sequence (see Figure 7).
 
Fig. 7: Bitstream view of the post-payload section, highlighting the 2000-bit block containing the EOM marker and trailing reversals.
 
As noted above, the total frame length accounts for exactly 3488 bits. Breaking down the bit distribution across the frame:

64 (Sync) + 640 (IVs) + 64 (Preamble REVs) + [MSG] + 2000 (EOM & REVs) = 3488 bits
Solving for the actual encrypted payload [MSG]:
[MSG]=3488−(64+640+64+2000)=720 bits (90 bytes)

Consequently, the Data Link layer frame efficiency for this transmission is:
(720:3488)​×100 ≈ 20,64%
Frame efficiency = 720 / 3488 × 100 ≈ 20.64%
    
This 20.64% frame efficiency means that nearly 80% of the Data Link layer space is consumed by overhead (synchronization, repeated IVs, and postambles) to ensure robust reception. Consequently, only 90 bytes out of each 436-byte burst carry actual encrypted user payload.

The following figures provide the visual bitstream analysis that substantiates the numerical values used above to define the specific frame structure.
Figure 8 shows the first 128 bits of all bitstreams and highlights the initial 64-bit frame sync:

Fig. 8: Bitstream alignment showing the 64-bit frame sync header.
 
Figure 9 relates to a single bitstream after the removal of the initial frame sync. The figure shows the 128-bit Initialization Vector repeated 5 times:

Fig. 9: Fivefold repetition of the 128-bit IV following initial frame sync removal.

Figure 10 shows 128-bit segments of all bitstreams after the removal of frame syncs and Initialization Vectors, highlighting the 64-bit reversal sequences that precede the MSG payloads:
 
Fig. 10: Bitstream alignment showing the 64-bit reversal sequences after frame syncs and IVs stripping.
 
Figure 11 shows 128-bit segments from all bitstreams, highlighting the End of Message (EOM) sequence followed by reversals:

Fig. 11: Bitstream view of the EOM sequence and trailing reversals.

One might speculate that the initial 64-bit sync sequence preceding the Initialization Vectors (Figure 8) serves as a cryptodevice synchronization header — similar to what is observed in KG-84/KIV-7 encrypted transmissions (5). However, this remains a tentative hypothesis with no definitive confirmation at present.
Furthermore, it is plausible that the 64-bit sequence of reversals "0101" immediately following the Initialization Vectors (Figure 10) acts as a buffering or timing window, granting the cryptodevice sufficient time to process and load the IVs into the key generator before the encrypted payload stream begins.

Regarding the payload itself, the 128-bit Initialization Vector strongly points to the use of AES (Advanced Encryption Standard). Since the encrypted payload length (90 bytes / 720 bits) is not a multiple of the 128-bit (16-byte) block size, it is reasonable to hypothesize that AES is implemented in a stream cipher mode (such as AES-CTR or AES-OFB) or utilizes ciphertext stealing, thereby eliminating the need for block padding[3].
As a side note, the Tunisian Navy also utilizes MS-110A waveform, but strictly in its standard-compliant form i.e., without the initial 4-tone preamble discussed earlier. Furthermore, while the Navy relies on the L3Harris Citadel suite to secure its communications[4], the Ministry of Foreign Affairs, as seen above, employs a distinct approach to protect its message traffic.

Figure 12 presents the output of the Octave[5] script check_encryption.m as an additional statistical verification of the payload encryption. Given the earlier identification of the 128-bit Initialization Vectors, the presence of encryption is already taken for granted(!): running this script serves primarily as a proof-of-concept to demonstrate and validate its execution on real-world data. The script was generated with the assistance of Claude AI[6] and is available for download at the bottom of this post for anyone interested in testing it.

Fig. 12: Output of the Octave script check_encryption.m confirming encrypted payload statistics.

I have previously observed these same characteristics — frame structure, 128-bit IVs, and modified MS-110A waveform — in transmissions from the Royal Navy of Oman, Croatian Military, and the Swiss Emergency Network[7]. This suggests that neither the waveform nor the encryption device are custom-built for a single user, but are rather off-the-shelf solutions available on the commercial market.

Despite previous studies on these kinds of transmissions, this post offers a more detailed and comprehensive analysis, made possible by access to a complete 15-burst session.


Downloads
📄⬇️ For a quick technical reference, you can download a concise Fact Sheet: https://disk.yandex.com/i/nXoBWW1cclhixQ
🧮⬇️ Download Octave script check_encryption.m:  https://disk.yandex.com/i/aOq8QUFe6w2mqQ
📡⬇️ Download signal recording: https://disk.yandex.com/d/arsiZ8bRhwvv8Q

Notes
1. An Orderwire call in military and diplomatic HF radio systems (such as MIL-STD-188-141 ALE) is a special signaling message used for channel management, control, or raw text exchanges between operators, rather than for transmitting standard payload data. Instead of negotiating a link to open a traffic channel for user data, an Orderwire transmission carries specific embedded instructions—such as frequency channel tests, status commands, radio control messages, or operator-to-operator short text notes.
2. In MIL-STD-188-141A (2G-ALE) terminology, TIS (This Is) is used in the preamble/header to identify the transmitting station during link establishment, whereas TWS (This Was) is transmitted at the end of a session to signal explicit link termination (teardown).
3. Israeli Navy hybrid MS-110A modems also feature a four-tone preamble, but with symmetrical tone spacing.
4. In the OSI model and HF data transmission stacks, what the physical layer (the modem) considers "useful data" is precisely the payload delivered by upper layers (such as STANAG 5066, PPP, or other application/DTE protocols).
5. Additionally, the KG-84/KIV-7 device also uses 128-bit Initialization Vectors (transmitted as two 64-bit strings) preceded by a 64-bit sync sequence header.

References

No comments:
Subscribe to: Posts (Atom)