an interesting start of a CIS-75 transmission

Interesting CIS-75 75Bd/250 FSK heard on 6404.0 KHz (cf): the encrypted data are preceeded by a sync sequence of reversals that - according to my measurements - is sent at the speed of 100Bd. My friend cryptomaster suggested that the 100Bd are actually the 50Hz taken from the AC mains. Given the instability, can be assumed that the equipment is operated "in the field" and is associated with the instability of the autonomous power supply.

Fig. 1

 TDoA runs indicate the Kaliningrad Oblast ( Kaliningradskaja oblast) as possible location of the Tx (figure 2).

Fig. 2

 https://disk.yandex.com/d/y3nMgqsSLmpTvw

CIS-75 FSK 75Bd/200 (4)

During the last week I have been monitoring the 75Bd/200 FSK transmissions (T-208 equipment?) on 9044.0 Khz (CF): transmissions are on-air during daytime only, are encrypted (likely linear encryption) and appear look like  "fleet broadcast" in the way of T-600 50Bd/200 FSK or NATO S-4285 (ie continuous broadcast). 

Fig. 1

 All TDoA results point to Smolensk area, a Russian military communications center (Figure 2).

Fig. 2

T-208 equipment is announced as QYT9 in CW op-chats, for example:
RCB de RJF94 QYT9 QSX 8573 K.      
RJF94 de RCB OK QYT9 QWH 8573 K.
(RJF94 and RCB negotiate T-208 mode on 8573 Khz)

https://disk.yandex.com/d/667pA4SMJL6vWQ

A similar transmission (75Bd/200 FSK) was heard on 11 Jan 2018 on 4540.0 KHz. In that case, after differential decoding, the stream showed up a clear 365-bit period (Fig. 3) due to the sequence of the scrambler polynomial x^8+x^6+1. The descrambled stream is shown in Figure 4 (thanks to cryptomaster).

Fig.3

 

Fig.4

  

T-208 365-bit period heard on 4540 KHz

CIS-75 FSK 75Bd/250 (3): 126-bit LFSR sequence

(for background, read all the posts of this topic)

Russ-Mil CIS-75 75Bd/250 FSK system spotted this morning on 15832.0 KHz (cf). After differential decoding, the bitstream shows a clear 385-bit period and a 126-bit pseudo random sequence, generated by the polynomial x^7+x^6+1, which is inserted in the data stream probably to re-sync the receive modem among the messages, note that the sequence has one bit in error (maybe planned?):

111110111110011110101110000110111010011000101011000001011110001
110110110010010100100001001110010110100010001100110101010000000

Fig. 1 - 126-bit pseudorandom sequences

Fig.2 - the synched stream

It's interesting to note that in previous CIS-75 recordings, we saw the use of a 128-bit (!) length pseudo-random sequence transmitted in positive and negative polarity: those sequences are easily identifiable by inspecting the stream with a window, coincidentally, 385-bit wide.

By the way, the same polynomial x^7+x^6+1 is also used by the French-Ny in their 50Bd/850 FSK fleet broadcast as one of the two stream LFSR delimiters [1].  

https://yadi.sk/d/7kC9pQD1THnNEg

[1] https://i56578-swl.blogspot.com/.../french-navy-broadcast-fsk-50bd850.html

CIS-75 FSK 75Bd/250 (2): 128-bit LFSR sequence

This post is a follow-on of the previous one and shows some findings due to the collaboration between myself and my friend Valentin (cryptomaster).
In the analyzed CIS-75 recordings, we saw the use of a 128-bit length pseudo-random sequence which is inserted repeatedly in the data stream probably to re-sync the receive modem. As it turned out, the sequence is transmitted in positive and negative polarity according to an alternation  of patterns which are easily identifiable by inspecting the stream with a window of 385 bits width (Fig. 1)

10101011010100010100110100000100101100010000110010000001101011110100100100011100111000001110100011011000011110111011001100000000

Fig. 1 - sequences patterns

The sequence positions emerge after descrambling the stream using either the x^8+x^6+x+1 polynomial or the x^9+x^8+x^7+x^6+x^2+1 polynomial (Fig. 2): since they are not primitive polynomials the 128-bit sequence can't be considered as an m-sequence [1] but rather a scrambler sequence. Notice that the descrambled streams show opposite polarity.

Fig. 2 - descrambled stream

The sequences (the positive and negative one) have the interesting property of being both parts of the same 256-bit sequence generated by the polynomial 9,8,7,6,2 ...subject to some errors that apparently have been added to the sequence in order to complicate its analysis.

1110010011110000100010011001111111101010110101000101001101000001
0010110001000011001000000110101111010010010001110011100000111010
0011011000011110111011001100000000101010010101110101100101111101
1010011101111001101111110010100001011011011100011000111110001000

Interestingly, if the stream is decoded in differential mode the sequence changes its length to 127 bits and acquires only one polarity (Fig. 3): in this case both the descrambler polynomials 8,6,1 and 9,8,7,6,2 are suitable (Fig. 4).

Fig. 3 - sequences in the diff. decoded stream

Fig. 4

We also saw that syncing the diff. stream, the sequences appear in regular positions so that they could also be used to separate data blocks, but it's just our guess (Fig. 5).

Fig. 5 - sinched stream

During one of his monitorings, Valentin caugth an interesting transmission: after a stop the only "space" frequency was emitted for a long time and then followed by a short-term transmission (~ 3 sec). The signal contains the 128-bit sequence that we discovered and another 114-bit sequence repeating in the stream: the most interesting thing is that also that sequence is a consequence of the mentioned scramblers (Fig. 6 shows the descrambled stream).

Fig. 6

By the way... just another feature: when the modem works in idle mode the speed is set to 100 Bd (Fig. 7). Actually, in idle mode a "meander" is transmitted with a frequency of 50 Hz. The source of this frequency is a 50 Hz AC network. The meander is used to correctly configure the correspondent station, as well as to ensure that no one else occupies the HF frequency.
Notice that 50 Hz frequency originates a 100 bps stream: "1" value during the positive period (the first half cycle) and "0" value during the negative period (the second half of the cycle): if considered as speed, then it is 100 bps. 

Fig. 7

CIS-75_stream.bin
CIS-75_diff_stream.bin
Short_75-250.wav
izh.swl.su_2019-08-15T09_38_31Z_9187.00_usb_idling.wav

[1] http://www2.siit.tu.ac.th/...m-sequence.pdf

Signals for analysis was mostly gathered thanks to the KiwiSDRs:

http://sdr.ok2kyj.cz:8073/   (Pohorany near Olomouc, Czech Republic)

http://r3tio.proxy.kiwisdr.com:8073/  (Nizhny Novgorod, Russia)
http://kiwi-kuo.aprs.fi:8073/  (Kuopio, Finland)

CIS-75 FSK 75Bd/250

CIS-75-75/250  is a Russian/CIS system supposed in use by Military in HF. As its name, this system use F1B modulation with 250 Hz shift and 75 bps speed, most likely a broadcast with linear encryption (ACF=0). The transmission was heard today on 9188 KHz (cf), operating continuously from the first morning. It's worth noting that during the days back, while I was monitoring the Swiss-MIL on 9187 KHz/USB, this FSK signal was not present: maybe 9188 KHz is not a primary channel, but it's a my guess.

According to several TDoA localizations, the site of Tx is in the area of Moscow.

kiwi-kuo.aprs.fi_2019-08-14T13_08_37Z_9188.00_iq.wav