Showing posts with label KW-46. Show all posts
Showing posts with label KW-46. Show all posts

12 June 2026

Simulating ADF ISB Transmissions: 12-Bit Repetition Coding on the USB Channel

The idea for this post stems from an interesting RAN (Royal Australian Navy) fleet broadcast originating from the MHFCS (Modernised High Frequency Communications System) utilized by the ADF (Australian Defence Force). The captured transmission employs STANAG-4285 at 600 bps/L in ISB (Independent SideBand) mode on 14874.0 kHz (Figure 1), and was successfully recorded thanks to the remote KiwiSDR VK6QS2 located in Augusta, Western Australia.

Data redundancy is a mission-critical asset in military HF communications. To ensure reliable delivery over thousands of miles, this transmission architecture departs from standard handling, utilizing the ISB spectrum to securely distribute the payload. 

Fig. 1: ADF MHFCS in ISB mode

As mentioned, the transmission relies on an asymmetric Independent Sideband (ISB) framework: the Upper Sideband (USB) delivers a redundant 600 bps stream wherein each individual bit is replicated 12 times, while the Lower Sideband (LSB) simultaneously transmits a "standard" signal at an identical 600 bps clock rate. This dual-path configuration mitigates severe ionospheric fading, allowing the receiver to cross-correlate the sidebands and reconstruct the payload without data loss. 

Technical analysis confirms that the LSB stream represents a broadcast encrypted by a KW-46 (or compatible) crypto-device, identified by the m-sequence of the generator polynomial x^31+x^3+1. This sequence is natively employed by the KW-46T transmitter for remote receiver synchronization (KW-46R). In contrast, the USB data structure exhibits 12-bit blocks of uniform logical states, most likely originated by a GA-205 12-channel Time-Division Multiplexer. This sideband similarly secures its payload using KW-46 protocols: as illustrated in Figure 2, by isolating a single multiplexed channel, stripping the remaining 11, and reshaping the data into a 7-bit architecture, the presence of the identical x^31+x^3+1 m-sequence was conclusively verified.

Fig. 2 : LSB and USB demodulated bitstreams

In this sample, both STANAG-4285 modems have the exact same clock speed and line rate of 600 bps on the physical serial line (the DTE/DCE interface) (1).  However, the amount of unique, useful information (the actual payload) is highly asymmetric: the USB channel carries a 50 bps information rate (Strategic Command & Control ?) protected by the 12x repetition code, while the LSB channel carries a native 600 bps information rate (Routine Data Traffic & Logistics ?).

The ultimate operational of ISB in this scenario is spectrum optimization.  Instead of requesting two distinct HF frequency allocations from military spectrum management, which would tie up vital radio assets and increase the station's electronic footprint, the user allocates a single suppressed carrier frequency. By utilizing ISB, the transmitter concurrently radiates two separate, parallel operational environments on a single RF assignment. 
A similar ISB paradigm is utilized, for example, by specific Portuguese Navy transmissions operating in STANAG-4285 600 bps/L mode, notably on the 12704.5 kHz Center Frequency (CF), using the HF callsign CTA12 (Figure 3). The bandwidth allocation is split as follows:
LSB Channel: Transmits the plain text Channel Availability and Receipt Broadcast (CARB), also frequently designated as the FAB (Frequency Availability Broadcast)
USB Channel: Carries a secure, encrypted fleet broadcast utilizing a legacy KW-46 cryptographic device.

Fig. 3: Portuguese Navy CT12 working in ISB mode

Concerning the source of the transmission, TDoA geolocation points to the 'Naval Communication Station Harold E. Holt' (NCS HEH), situated 6 km north of Exmouth (Figure 4). COMMSTA HEH is jointly operated by Royal Australian Navy and US Navy personnel. The High Frequency Transmitter (HFT) site houses an array of hardware, much of which is dedicated to point-to-point communication circuits linked to shore facilities and surface vessels operating within the station's operational footprint.


Fig. 4: Direction Finding (TDoA) results


The remainder of this post aims to simulate the generation of the baseband data stream for the USB (Upper Sideband) channel, alongside DTE-DCE timing management, using hardwired digital logic managed by Arduino microcontrollers. Naturally, this is a standalone proof of concept and does not reflect the actual hardware infrastructure utilized by the MHFCS.
To evaluate the generation of the cloned 12-bit redundant stream, the simulation leverages a CD4067 multiplexer (MUX) to closely mirror the hardware-level TDM implementation of the GA-205 12-channel multiplexer used by the Australian Defence Force. I followed the logical block diagram illustrated in Figure 5, implemented using breadboards, TTL and CMOS chips, and two Arduino microcontrollers. Figure 6 shows the components prior to wiring.

Fig. 5: USB channel formation

Fig. 6

A: extender buffer 
Implementing a 1-to-12 output bit extender (also known in electronics as a fan-out replicator or distribution buffer) using TTL logic is a classic and very straightforward project. The crucial factor is the current: a single output pin of a standard chip does not have the electrical strength to drive the 12 inputs of the following multiplexer (MUX) simultaneously while maintaining the correct voltage levels. For this reason, buffers are required. I used the 74LS04 chip, which contains 6 inverters (NOT gates). By routing the signal through two inverters in cascade, the bit is inverted twice, returning to its original state but with all the necessary driving power. Using the common 74LS04 chips we need to employ a 'cascade' logic: one gate acts as a pilot (inverting the signal the first time), and the other gates act as splitters (inverting it a second time, thus restoring the original signal). Given that each chip contains 6 gates, using 3 chips gives us a total of 18 gates: one will serve as the pilot, and 12 will provide the desired outputs.

B: multiplexer
The CD4067B module, a CMOS single-ended 16-channel pre-monted board, is utilized as a synchronous time-division multiplexer (TDM), serving as the critical link that generates the redundant serial stream. Driven by the binary addressing logic of Arduino #1, the CD4067B sequentially samples each input channel. By allocating an identical, deterministic time slot to every channel, the chip enforces the strict synchronous timing required to mimic real-world TDM hardware like the GA-205. The multiplexer acts as the true functional centerpiece of the system that replicates the structural signature observed in the original MHFCS transmission.

C: Arduino #1
The first microcontroller serves as the data source and hardware controller, driven by Arduino 2 clock. It is responsible for generating or forwarding the low-speed baseband bitstream (e.g., 50 bps) and generating the necessary addressing logic to drive the multiplexer. It ensures that the correct channel is actively routed into the system pipeline with precise timing.

D: Arduino #2 
The second microcontroller functions strictly as a downstream monitoring and simulation of the digital front-end of a STANAG-4285 modulator: it processes the incoming bitstream exactly as the STANAG-4285 hardware would see it, capturing the raw, synchronous 12-bit sequences directly from the multiplexer's output. The line tapped by the Arduino RX carries the exact, fully formed digital data that is ready to be applied to the physical input of the modem. This allows for comprehensive loopback testing, signal verification, and diagnostic analysis of the transmission line without needing to connect a physical modem unit.

This architecture functions as a redundant 12-bit serializer achieving high noise immunity and fault tolerance. On top of this hardware-level redundancy, the STANAG-4285 modem will introduce an extra layer of protection against fading and burst noise, thanks to its robust FEC (Forward Error Correction) and configurable interleaver mechanisms.

The fully wired circuit is depicted in Figure 7.


Fig. 7

Figure 8 displays the serial monitors of the two Arduino microcontrollers: the data source (top) and the receiver (bottom). Two "COM4" ports are displayed because the Arduino boards are driven by two separate PCs. Note that a very low clock rate was chosen in the firmware implementation allow easy reading of the serial monitors.

Fig. 8:serial monitors output of the two microcontrollers

A note about Bitrate Expansion vs. Datarate Preservation
The integration of the buffer-extender and the hardware multiplexer within this data pipeline serves a dual purpose: expanding the transmission bitrate while strictly preserving the baseline datarate (the actual information payload). 
Bitrate Expansion (50 bps→600 bps): The system ingests a baseline digital signal at 50 bps and up-rates the transmission frequency by a factor of 12, delivering a 600 bps synchronous stream at the final output. This high-speed clocking is structurally required to match the ingestion constraints of the STANAG-4285 modem. 
Datarate Preservation: While the physical signaling speed increases, the net information throughput remains exactly identical to the 50 bps input. The system does not inject new data or alter the original message content. Instead of increasing information capacity, the remaining bandwidth created by the 12x clock multiplier is entirely dedicated to data redundancy. Each original bit is algorithmically mapped across the 12-bit output frame.

https://disk.yandex.com/d/-9xhLnBZ-7RPKw  Royal Australian Navy, 14874.0 kHz CF
https://disk.yandex.com/d/MyzyM20VOnYTvg Portuguese Navy, 12704.5 kHz CF


(1) In professional HF communications (such as STANAG 4285 or MIL-STD-188-110A), the DCE (Data Circuit-terminating Equipment / Modem) acts as the master of the communications link, while the DTE (Data Terminal Equipment / Data Source) acts as a slave regarding timing and throughput.

28 May 2025

Norwegian Navy STANAG 4481-PSK Serial Tone Mode

STANAG 4481 defines the minimum technical standards for Naval shore-to-ship broadcast HF communication. The standard describes three data modem variants, namely the S4481-PSK Serial Tone Mode (STM) providing a BPSK modulated waveform offering data rate of 300 bps coded, the S4481-FSK Single-Channel Two-Tone FSK Mode providing data rates from 50 bps to 600 bps, and the S4481-FSK Multi-Channel (up to 16) Two-Tone FSK Mode providing date rates of 50 bps and 75 bps in a 3 kHz channel. The STANAG 4481-PSK waveform is a Non-Autobaud capable STM (Serial Tone Mode) waveform providing the BPSK modulated 300 bps coded data modem in a 3 kHz channel. The STANAG 4481-PSK modem waveform is identical to the 300 bps long interleaver (10.240 seconds) waveform of STANAG 4285. An example of the S4481-PSK waveform is the fleet brodcast transmitted on 6243.7 KHz/USB by the Royal Norwegian Navy (Figure 1). 

Fig. 1

While the ACF bitmap of Figure 1 clearly shows the classic S-4285 framing, Figure 2 shows the BPSK modulation: notice that some decoders such as Sorcerer and K500 show the constellation related to the type of data modulation (BPSK, QPSK, PSK8) and NOT the "on-air" constellation (usually PSK8).

Fig. 2 - BPSK modulation at 300 bps Long interleaver

User data, at least in this case, are encrypted using KW-46 (or equivalent device) given the presence of the M-sequence generated by the polinomyal x^31 + x^3 +1  (KW-46T uses that M-sequence to synch the KW-46R receive devices).

Fig. 3 - presence of x^31 + x^3 +1 M-sequence

Direction Finding tries (TDoA algorithm) seem to indicate the area of Stavanger as the probable site of the transmitter.

https://disk.yandex.com/d/lo9hwFmEV774Iw

20 February 2024

KW-46 secured fleet broadcast over S-4285 in ISB mode (Humpty Doo, MHFCS)

Interesting fleet broadcast from the MHFCS (Modernised High Frequency Communications System) site in Humpty Doo, Northern Territory - Australia. The transmissions use STANAG-4285 600bps/L in ISB mode and are audible on 11145.0 KHz (Figure 1).

Fig. 1

Bitstream of the LSB channel (Figure 2) is a "classic" broadcast which is encrypted using KW-46 (or compatible) cipher device given the presence of the m-sequence generated by the polinomyal x^31 + x^3 +1 (KW-46T uses that M-sequences to synch the KW-46R receive devices).

Fig. 2 - bitstream of the LSB channel

The bitstream of the USB channel is more interesting since it consists of 12-bit strings where all the bits have the same logical value, likely originated by the GA-205 12-channel time division multiplexer: I already met such signal some years ago [1] but that time from the "Naval Communication Station Harold E. Holt" (NCS HEH) 6 km north of Exmouth. USB channel too transports a KW-46 secured traffic: as shown in Figure 3, I filtered out 11 channels and reshaped a single "column" into a 7-bit pattern then I successfully checked the presence of the x^31 + x^3 +1 m-sequence.

Fig. 3 - bitstream of the USB channel

As said, in this case the transmission is source by a Tx located in Humpty Doo, Northern Territory Australia.

Fig. 4 - DirectionFinding results (TDoA algorithm)
 

https://disk.yandex.com/d/cd6YKgpc18NPrw

[1] http://i56578-swl.blogspot.com/2019/05/kw-46kiv-7m-secured-fleet-broadcast.html


5 January 2022

Yet another 75Bd (actual 50)/850 FSK

Yet another 75Bd (actual 50)/850 FSK bearing KW-46 encrypted broadcast spotted on 5189.50 KHz CF, this time probably(?!) sourced from some France AF base (figure 2). The reason of that "format" is still unclear, at least to me (1).

Fig. 1

It should be noted that not all the French sites in figure 2 host HF transmitters, as well as the possibility of some uncertainties of the current TDoA algorithm in finding the origin of FSK signals (as suggested by my friend Linkz); figure 3 shows the Direction Finding results got with the "old" TDoA algorithm: results point the coast of south UK.

Fig. 2 - Direction Finding TDoA results

Fig. 3 - Direction Finding TDoA results (old algorithm)


 https://disk.yandex.com/d/nQZYpTLMq5mJwA

(1) https://i56578-swl.blogspot.com/p/75bd-actual-50bd-4481f.html

6 September 2021

75(50)Bd 4481F: yet another channel

Yet another 75Bd/50Bd 4481F channel spotted on 9338.0 KHz (cf), most likely from NPM Lualualei, HI (thanks my friend Mike "mco"). After filtering out the column of the replicated bits from the demodulated stream, it turns out the actual 50Bd speed; then resizing the new stream into a 7-bit pattern, the KW-46 sync sequence emerges.

https://disk.yandex.com/d/eGbxz_R34wLOdw

8 May 2021

yet another STANAG-4481F 50-75Bd broadcast

5716.0 KHz (cf): STANAG-4481F (apparently) 75Bd fleet broadcast from NAU Isabela (PTR), running with the "odd" and already observerd 3-bit format (Figure 1).

Fig. 1

Removing the third column which contains the replicated bits and then reshaping the resulting bitstream to a 7-bit pattern, it turns out the actual 50Bd speed and the usual KW-46/KIV-7 encrypted stream (Figure 2).

Fig. 2
As mentioned, this behavior has already been noted previously in STANAG-4481F transmissions from NSY Niscemi, AJE Barford and just from NAU: for more informations, the related posts are grouped under a specific tag.

https://disk.yandex.com/d/oiw9OS_fQXcK1Q

24 October 2020

two new 50Bd/850 FSK broadcast channels

It seems that the Turkish friends (or "stars and stripes" friends in Turkey) have activated two new 50Bd/850 FSK broadcast channels on 8788.0 and 8792.0 KHz (cf), or likely 8090.0 KHz in ISB mode. Spotted them on 22th October for the first time. 

Fig. 1

Fig. 2

As expected, since the 50Bd/850 waveform, both the channels are KW-46/KIV-7 secured. The "business card" consists of the pseudo-random sequence generated by the polynomial x^31+x^3+1, those bits replace the stop bits and are used by KW-46 cryptographic equipment to provide synchronization (figure 3).

Fig. 3

Tx site (or Tx sites ?) is in Turkey; unfortunately there are no KiwiSDR in the southern Mediterranean, they would have allowed a more accurate DF.

Fig. 4

 

https://yadi.sk/d/TzPYSWikG8d0XQ

21 October 2020

KW-46 secured traffic over 188-110A, MHFCS Townsville

Long 110A Serial transmission heard on 6345.50 KHz/usb and used for KW-46/KIV-7 secured fleet broadcast, task usually performed by S4285/S-4481 in NATO Navy.
The analysis of the frame structure (Figure 1) confirms 110A operations at low datarates: each frame is composed of 40 tribit symbols, or 120 bits, (20 symbols for miniprobe + 20 symbols for data). In low datarate modes, from 150 to 1200 bps, the 480-bit length of the 110A scrambler exactly matches four frames (i.e.: 4 x 120 bits) and so it produces the strong 66.67ms spikes which are visible in the auto-correlation function.

Fig. 1 - MIL 188-110A Serial Tone framing

The most interesting aspect is the use of KW-46/KIV-7 encryption to secure data transfers: its use is revelaed by the presence of the pseudo-random sequence generated by the polynomial x^31+x^3+1 (Figure 2). It's worth noting that, usually, the KW-46 crypto device is used in USN/NATO fleet broadcast with FSK 50Bd/850 or S4285 modems. A similar MHFCS transmission was reported here.

Fig. 2 - x^31+x^3+1 pseudo-random sequence

TDoA runs say Australian MHFCS [1] node at Townsville as the Tx site (Figure 3):

Fig.3 - TDoA results

The Bohle Transmitter Station site [2] is a site of approximately 484 hectares, located 10 kilometres west of Townsville (Figs. 4,5). As said, the station is a communications facility used by Defence and forms part of the Modernised High Frequency Communications System.

Fig. 4 - site of the MHFCS (google earth)
 
Fig. 5 - https://www.flickr.com/photos/csipete/3055234661/in/photostream/

https://yadi.sk/d/8Rh5i4A6oYrHgg

[1] https://i56578-swl.blogspot
[2]:
http://wikimapia.org/38200037/Bohle-Transmitter-Station-Queensland
https://www.defence.gov.au/id/.../BohleTransmitterStationQLD.pdf
https://www.cordellconnect.com.au/.../Details.aspx?uid=413860

22 August 2020

Swedish Navy submarine MSK multi-channel broadcast


(For background it might be helpful to read the relevant entries here)

Swedish Royal Navy (Swedish: Svenska marinen [1]) uses a broadcast function of STANAG-5030 (1) for communication with its subs in the Baltic Sea, the return channel is believed to be low-end HF. These LF broadcasts use the 200Bd/100 MSK waveform and can be heard on 40.4, 42.5, and 44.2 KHz (CF) by using  KiwiSDR receivers located in the island of Gotland which have a good SNR. [2].

All the three signals have the classic set of parameters for (G)MSK: a spectrum equal to 1.5*Br (300Hz), shift equal to Br/2 (100Hz), a characteristic bell-shaped appearance (Figure 1), and others such as 4-point constellation, transitions and real trajectories (Figure 2). Please note that the carrier in the fourth degree is very weakly expressed, sometimes it is practically invisible at all.

Fig. 1
Fig. 2
Using 200Bd MSK (a form of QPSK) it is possible to transmit two 100 Baud channels X and Y, each on a pair of phase, and each channel can consists of 2x50 Baud multiplexed channels. Thus, MSK can provide a TDM multi-channel broadcast of  up to 4x50 Baud X1 X2 Y1 Y2 channels within the 200Hz assigned band (MSK4).  Some aspects about the similarities bewteen QPSK and MSK are covered in radioscanner forum [3].

In conditions where no messages are available for transmission, the four channels are arranegd with two "empty channel filler" (ECF) patterns, probably generated automatically at the transmitter equipment:
- two channels share the same 15-bit pattern;
- a third channel uses a different 5-bit pattern;
- the fourth channel uses the same 5-bit pattern where one column is repalced by the bits of the pseuso-random sequence generated by the polynomial x^31+x^3+1.
An example of this "idle" mode is shown in Figure 4: here the m-sequence is sent in the Y2 channel (notice the same pattern sent in X1 X2 channels ).

Fig. 3
A more generalized scheme highlighting the position of the m-sequence channel in four different recordings is shown in Figure 4.

Fig. 4
 In case of messages, the four channels use a 5-bit format with different framings:  
- two channels share the same 5-bit framing, i.e 1-bit marker (pos/neg according the polarity) + 4-bit data:
- a third channel uses an unid (to me) framing;
- the fourth channel uses the same 5-bit framing of the first two channels but the marker column is replaced by the bits of the pseuso-random sequence generated by the polynomial x^31+x^3+1.
Figures 5a,5b show such arrangement.

Fig. 5a
Fig. 5b
Due to their strategic and tactical importance, subcomms require secure cryptographic protocols and this could explain the presence of the x^31+x^3+1 pseudo-ramdom sequence which is used to sync the receive KW-46/KIV-7 ciphers (other than to permit channel identification), although an encrypted 4-bit stream is rather unusual as well as the use of the 1+4 bits frames. 
In this regard, one might even think that the actual secured messages channel is Y before the TDM split (Figure 6), while the other channels X1 X2 transport not critical 4-bit coded data (WX forecast, sea conditions, ...). This way, messages could use 10-bit START-STOP code which is then encrypted using the KW-46/KIV-7 equipment. Encryption results in bits 2 to 10 being encrypted and bit 1 (START) being replaced with unencrypted bit defined by the polynomial x^31+x^3+1, or in reverse order - bits 1 to 9 encrypted and bit 10 (STOP) replaced (2). A second hypothesis - perhaps the most likely - is that each channel is encrypted with a specific cipher ...but these are just my speculations.

Fig. 6 (m-sequence columns are highlighted)

The results of TD0A geolocation indicate three probable transmitter sites that match fairly exactly with those indicated in a map presented by FMV (the Swedish Defence Materiel Administration) [4] at the March 2020 HFIA HF Industry Association [5] Meeting in San Diego, CA (Figure 7):
- 40.4 KHz: SAS/SRC Varberg
- 42.5 KHz: SAS2 Gudinge
- 44.2 KHz: SHR Ruda

Fig. 7

It must be taken into account that I can't record the (KiwiSDR) LF spectrum 24/7 so the results indicated above may be incomplete: further recordings are needed and possibly an update post will be published later. Hints and comments are welcome.


(1) STANAG-5030 is a restricted document so no information is publicy available. Moreover, the new STANAG-4724 "VLF/LF MSK Multi Channel Broadcast" is currently being ratified by NATO member states as next evolution:

(2) max success for x^31+x^3+1 in Y stream was found for a length frame of 10 bit; that same frame does not have parity bits (x^31+x^3+1 column excluded from the checksum)


4 July 2020

STANAG-4481F from NSY, back to normal op

(for background read all the post of this topic
After a period during which the signals showed a strange behavior consisting of a 3-bit period (which in some way "simulated" a 50Bd speed), it seems that the transmissions from NSY Niscemi have back to normal 75Bd operations. So far, I checked almost all the channels except 8145.0 and 8204.5 KHz (and 13229.0 Khz but from NAU Isabela).

Fig. 1 -  6732 KHz from NSY Niscemi in different dates
There is however a peculiarity that is noteworthy: according to my logs and analysis NSY is the only station that uses KW-46 encryption - instead of KG-84 - with the 4481F 75Bd waveform(!), the other stations that use that encryption all adopt the 50Bd waveform. This fact modifies the content of a previous post according to the following diagrams (although provisional).

Fig. 2 - 6732 KHz streams from NSY Niscemi in different dates
Fig. 3
https://yadi.sk/d/02FOSxK157CsYw

16 May 2020

yet another odd STANAG-4481F channel

(for background read all the post of this topic
 
May 16th update
Interesting tip from my friend cryptomaster (thanks) who pointed me the 13229 KHz (cf) fequency: also in this case it's a STANAG-4481F transmission with the characteristic of the 3-bit pattern (and obviously KW-46 encryption) but the source, however, is NAU Naval Radio Transmitter in Isabela  (PTR).



Therefore, contrary to what I had observed so far, such broadcasts do not come only from Niscemi (NSY) and Barford (AJE). Below the updated list of the successful frequencies and sites (all CF):

05120.5 NSY
06383.0 NSY
06732.0 AJE
07545.5 NSY
08145.0 NSY, AJE
08204.5 NSY
13229.0 NAU


May 9th
6732.0 KHz: another STANAG-4481F KW-46 secured channel that use the odd 3-bit pattern discussed here. This one is most likely from AJE (Barford St, John, UK) and // with 8204.5 KHz from NSY (Niscemi, Italy). 

Fig. 1
Fig. 2
Fig. 3


So far, it seems that only the transmissions from NSY and AJE exhibit the odd 3-bit pattern we are talking about. Below the current list of the successful frequencies which I observed (all CF):

5120.5 NSY
6383.0 NSY
6732.0 AJE (new update)
7545.5 NSY
8145.0 NSY, AJE
8204.5 NSY

In winter, my friend cryptomaster observed two more frequencies: 4723.9 and 5118.6 kHz (the latter probably NSY tuning freq.).

As said, it's to notice that most of the times the NSY frequencies are logged as "NSY Sigonella": well, NAVCOMTELSTA (U.S. NAVAL COMPUTER AND TELECOMMUNICATIONS STATION) Sicily, located in Naval Air Station  Sigonella, manages the Naval Radio Transmitter Facility Niscemi, housing LF/HF transmitters. Same story about AJE Barford St.John that probably is sometimes reported as Croughton, nearby (6 miles distant).