40 Fixed Bits in a 128-bit IV: A Shared COMSEC Preamble on Three HF Modems

This post compares the COMSEC preamble of a STANAG-4285 link on 4147.4 kHz with other HF recordings that show the same structure.

The first transmission, intercepted on 4147.4 kHz/USB, was kindly sent to me by my friend Kosmod. It consists of bursts modulated with STANAG-4285 in 600 bps mode with short interleaver. The duration and sequence of the bursts in Figure 1 point to an ARQ system (Automatic Repeat reQuest): the longer bursts carry messages, each followed by short bursts that act as ACKs (acknowledgements).
As shown in Figure 1, each burst begins with four unmodulated tones lasting ~90 ms, separated by asymmetric frequency spacings of 700 Hz, 500 Hz and 900 Hz. This variant is not specified in the STANAG-4285 standard. The four tones form an all-in-one synchronization preamble: the spacing pattern appears to identify the network, while the tones also work as a channel probe and a CW sync probe.

Figure 1: Spectrogram of the 4147.4 kHz/USB recording (WebSDR, 25 Sep 2023). The upper panel shows the sequence of long message bursts and short ACK bursts; the lower panel is a zoom on the start of a burst, showing the four initial unmodulated tones.

The message bursts do not all have the same duration. After demodulation, each one carries one or more encrypted messages. The structure is the one typical of protected HF links: a COMSEC preamble (the block of data that prepares the receiver to decrypt the message) followed by the encrypted message itself. In greater detail:

- Frame Sync: 64 bits (8 bytes), a fixed pattern that marks the start of the COMSEC preamble: 0001100001000001110001011110010110111011010010010111110101011001
- Initialization Vector (IV): 128 bits (16 bytes), repeated 5 times (640 bits in total). An IV is a value sent along with an encrypted message so that the receiver can decrypt it; it is normally expected to change from one transmission to the next.
- Reversals: 64 bits of alternating sequence (0101...).
- Encrypted payload: ciphertext message, probably followed by an encrypted EOM/postamble.

 

The Frame Sync, in hexadecimal, is 0x1841C5E5BB497D59. It contains exactly 32 ones and 32 zeros. This is only an observation: a perfectly balanced sequence is not rare among random 64-bit values, so it does not by itself prove that the sequence was chosen for good correlation properties. 

Figures 2, 3 and 4 clearly illustrate the structure of the COMSEC preamble.

Figure 2: Demodulated bitstream displayed with a 128-bit period. The 64-bit Frame Sync is located with the Find function (zero bit errors), marking the start of the COMSEC preamble.

Figure 3: The same bitstream with a 128-bit period: the Initialization Vector (128 bits) is repeated five times (640 bits in total), appearing as identical vertically aligned rows.

Figure 4: The Reversals field, 64 bits of alternating 0101... sequence, located with Find, immediately before the encrypted payload.

The most striking and interesting feature is the structure of the Initialization Vectors visible in Figure 3. As can be seen, the two IVs, taken from two different bursts, have 40 bits (5 bytes) in common, in exactly the same positions. This is quite unusual for IVs, which are normally expected to differ from one transmission to the next.
To verify this unusual structure, I synchronized the entire bitstream of the transmission on the Frame Sync value and limited the output to 192 bits, i.e. 64 sync bits plus the first instance of each IV. The result is shown in Figure 5 and clearly reveals the structure used for the IVs:

bit 0-63: 64 variable bits
bit 64-103: 40 fixed bits 0000000001000000000000010000100000001001 = 0x0040010809
bit 104-127: 24 variable bits

The fixed block is contiguous and begins and ends on byte boundaries, so the layout is 8 bytes + 5 bytes + 3 bytes.

Figure 5: Bitstream synchronized on the Frame Sync and limited to 192 bits (64 sync bits plus the first instance of each IV), showing the 40 fixed bits within the IV structure.

An IV with 40 fixed bits and 88 variable bits is not a purely random IV, but could be a structured field. The fixed block starts and ends on byte boundaries, which makes a field-based structure plausible. Moreover, only 5 of its 40 bits are ones (0x00 0x40 0x01 0x08 0x09), which looks more like a set of flags or control fields than random data. If the 40 bits were just padding, one would not necessarily expect them to be transmitted; if they are transmitted, they may carry information. An alternative explanation cannot be ruled out, for example an 88-bit nonce completed by a fixed part.

I remembered that I had already come across a similar COMSEC preamble structure with a 128-bit IV. Browsing my blog, I found a transmission from the Tunisian MFA intercepted on 29 July 2026 and analyzed in a later post on 3 August 2026 [1]. The similarities are remarkable:

- In that case the HF modem was MS-110A, but with a non-standard start: four unmodulated tones with the same asymmetric spacing (700/500/900 Hz) as the initial tones of the STANAG-4285 transmission analyzed here.
- Identical bit-by-bit structure of the COMSEC preamble, i.e. the same 64-bit Frame Sync, 128-bit IVs, and a 64-bit run of 01 reversals.

I repeated the same analysis procedure as before, but this time on the entire bitstream of the Tunisian MFA transmission, i.e. synchronizing on the Frame Sync plus the first instance of each IV (192 bits in total). Comparing the two analyses (see Figure 6), the fields that make up the IVs are perfectly matching.

Figure 6: Comparison of the IV structure in the STANAG-4285 transmission (top) and the Tunisian MFA MS-110A transmission (bottom), both synchronized on the Frame Sync and limited to 192 bits.

I applied the same procedure (synchronizing the bitstreams on the Frame Sync sequence) to other recordings that also carry 128-bit IVs repeated five times [2]. The results show five transmissions in total (three of them shown in Figure 7) on different HF modems (MS-110A, STANAG-4539 and STANAG-4285) that share the same COMSEC preamble layout and the same IV structure, with a block of 40 fixed bits inside a 128-bit IV. The only exception is the STANAG-4539 recording, in which 2 of the 40 bits differ (Figure 7). Note that STANAG-4539 is the NATO equivalent of MIL-STD-188-110B Appendix C, which is why the corresponding recording file is named "188-110B_APP-C".

Figure 7: IV structure in recordings made on different HF modems, synchronized on the Frame Sync and limited to 192 bits: MS-110A (6.670 MHz, 2 Oct 2017), STANAG-4539 (equivalent to MIL-STD-188-110B Appendix C; 7.9985 MHz, 9 Mar 2018) and STANAG-4285 (4.015 MHz, 10 Jan 2020). The 40 fixed bits are the same in all three, except for 2 bits in the STANAG-4539 recording.

This points to a common origin, such as the same encryption equipment or the same protocol family. It does not by itself show that the links belong to the same user or network.
Open questions: what the 40 fixed bits encode, whether the variable parts of the IV follow a pattern (for example a counter), and which cipher is used. A 128-bit IV is consistent with a 128-bit block cipher such as AES, but this remains a hypothesis.

Downloads

---

Signal recording: https://disk.yandex.com/d/obtvTfU88z8zJQ

References

---

[1] https://i56578-swl.blogspot.com/2026/08/tunisian-mfa-hf-link-128-bit-aes.html
[2] ttps://i56578-swl.blogspot.com/p/initialization-vectors.html

US Navy MS-110A 600 bps/L: burst transmissions with a fixed 32-bit sync word (0x0A6E14DC)

Recently, reception reports of several US Navy stations (Barford, Niscemi, Lualualei, Diego Garcia, among others) appeared on the UDXF mailing list. These stations seem to use the MS-110A waveform for fleet broadcast, rather than the usual STANAG-4481F or STANAG-4285. Some of the stations and frequencies reported had already been under observation by me and my friend Kosmod because of a few peculiarities, discussed below. 

Non-continuous transmissions
The transmissions we monitored (and are still monitoring) are not a continuous stream, as in STANAG- 4481F and STANAG-4285 broadcasts, but consist of bursts of irregular duration separated by short pauses. Figure 1 shows one of the receptions of the Niscemi station on 5118.5 kHz USB, recorded on 23 September 2026 at 07:53:58 UTC: the five bursts last between about 20 and 43 seconds. Across all our captures, bursts range from a few seconds to a little over a minute.
Curiously, the MS-110A waveform is used in the same 600 bps/L mode (600 bps, long interleaver) that is employed in STANAG-4285 broadcasts.

A possible reason for the bursts lies in how the two waveforms handle synchronization. With STANAG 4285, the continuous probes sent by the modem keep the receiving side always in sync, and this applies not only to the HF modem but also to the upper-layer protocol. With MS-110A, a receiver that joins late cannot demodulate until it receives the preamble, so a continuous MS-110A transmission would be lost to any receiver that misses its beginning. Short bursts avoid the problem: each burst opens with its own preamble, so a receiver that joins late can acquire synchronization at the start of the next burst instead of waiting indefinitely. The upper layer follows the same logic: in the bitstreams we examined, each burst starts with its own alternating run of bits (the "01" run, 1010... in the captured streams) followed by a sync word, so synchronization is restarted at every burst at both levels.
At present it is hard to tell whether these are tests or a lasting change in how the broadcast is run.

Figure 1: Spectrogram of a reception of Niscemi on 5118.5 kHz USB, 23 September 2026, 07:53:58 UTC. The dark vertical lines are pauses between bursts; the black band on the right is the end of the file. The burst durations shown (28, 24, 33, 20 and 43 s) are measured values, but only approximate.

A fixed 32-bit word after the "01" run

The captures come from five US Navy transmitting stations (Barford, Davidsonville, Diego Garcia, Lualualei and Niscemi) and were recorded between 30 August and 30 September 2026. Every capture is a standard MS-110A 600 bps/L transmission. In every demodulated bitstream, the same 32-bit word follows the "01" run:

00001010011011100001010011011100 (0x0A6E14DC)

The word is identical in all captures and appears only after the "01" run. An alternating run followed by a fixed word is a common bit-sync/phasing plus sync-word structure in synchronous data links. As far as we can tell, the word is not part of the MS-110A framing, so it is probably part of the payload and likely belongs to a link-level protocol or device, such as a data encryptor. Figures 2 and 3 show the demodulated bitstreams from the five stations (yellow = 1, blue = 0, 32 bits per row), showing the alternating run, the row with the sync word and the random-looking data that follows. 

Figure 2

Figure 3

Structure of the word 0x0A6E14DC

The 32 bits above are not arbitrary. They consist of a single 15-bit pattern, repeated twice, plus the first 2 bits of a third repetition:

000010100110111
000010100110111
00

Read as two 16-bit halves, the second looks like the first one shifted by one bit. This is a side effect of the period: the real period is 15, not 16.

The polynomial generator
A pattern like this is produced by a tiny shift register with only 4 stages. Each new bit is the XOR of the previous bit and the bit from four steps earlier, which we denote by the polynomial x^4 + x + 1; with the reciprocal convention the same register is written x^4 + x^3 + 1. This polynomial is of the "maximal-length" kind: the register passes through every possible non-zero state before repeating, giving the longest cycle possible for 4 stages, 15 bits.
Starting from the register state 1111 (all ones, a very common choice), the generator produces 111101011001000. The pattern observed on the air is exactly this sequence with every bit flipped. Inversion does not change the underlying generator, only how the sequence looks.

Figure 4: Left, the 15-bit sequence produced by the generator from the initial state 1111 (the inverse of the one observed on the air). Right, schematic of the 4-stage shift register.

As a further check, I ranked candidate generator polynomials of the form x^n + x^k + 1 by how well each reproduces the observed sequence (Figure 5, right). x^4 + x + 1 comes first by a wide margin. The next three (x^9 + x^7 + 1, x^10 + x^5 + 1 and x^12 + x^11 + 1) are not competing hypotheses: each is a multiple of x^4 + x + 1, so each also reproduces the sequence. The remaining candidates score near the noise floor.

Figure 5: Left and center, the 15-bit sequence as observed on the air, repeated line by line; in a 15-column view it appears as vertical stripes. Right, ranking of candidate generator polynomials x^n + x^k + 1 (pairs n,k) by score, with x^4 + x + 1 on top.

Common structure of the streams
- Every stream starts with an alternating run of exactly 256 bits (128 pairs).
- The 32-bit word appears at position 256 in all five streams, bit-for-bit identical.
- The word appears only once per stream: there is no resynchronization in the middle of a transmission.
- There are no inverted or bit-reversed versions, so the demodulation polarity is the same in all captures.

What follows the word
I compared five bursts, one from each station, in pairs (10 pairs), aligned on the end of the word. Over the first 256 bits the percentage of differing bits ranges from 46.9% to 56.2%, and over the whole common part from 49.8% to 52.0%. Independent streams are expected to give 50%, with a spread of about 3 points over 256 bits, so all values are within normal variation. There is no common field right after the word, such as a shared message indicator, and shifting one burst against another by up to 64 bits reveals no shifted copies.
Within each burst, the 0/1 balance is within 1.6 standard deviations of 50%, and neither the runs test nor the autocorrelation shows any periodicity. The lengths of the data after the word are all multiples of 8 bits, and at 600 bit/s the five bursts last from about 5 seconds (Barford) to about 75 seconds (Lualualei). Figure 6 shows a set of checks on one burst; the other four give the same picture.

Figure 6: Statistical checks on the data following the sync word of one burst (1736 bytes): bit balance, byte histogram, autocorrelation, bit raster and running proportion of 1s. The other bursts give the same picture.

A possible interpretation

Statistically, what follows the sync word is indistinguishable from random data, at least by the tests applied. This is what encrypted traffic looks like, and also what a data encryptor sends when it has no message: fill scrambled by the keystream. The tests cannot tell the two apart.

A possible reading is the following. The alternating run and the sync word open every burst and let the receiving equipment align itself on the incoming stream: the alternating run for bit timing, the sync word for the start of the stream. A transmitter does not always have a real message to send, so part of what is transmitted may be random-looking fill rather than traffic. This is seen, for example, in STANAG-4481F and STANAG-4285 transmissions, where a continuous stream of random data is interrupted by the KG-84 sync sequence when there is a real message to send. Here the picture is only partly similar: continuous fill would not explain the pauses between bursts, which are better accounted for by the synchronization argument above. The data cannot show whether a given burst carries a real encrypted message or only fill.

Downloads

---

Signal recordings: https://disk.yandex.com/d/Vafhzbv5fvqSuw