4529.75 KHz (cf), yet another async 5N1 STANAG-4481F (to replace 4539.7 KHz?)

Some days ago my dear friend Karapuz noted the transmission of STANAG-4481F segments centered on 4529.75 KHz, data were transferred using 5N1 framing and apparently not in clear text. In the following days I monitored, albeit occasionally, the channel until the transmissions started to be continuous (Figure 1).

Fig. 1

Analyzing the bitstream after the start/stop bits have been removed, it turns out that the messages are sent in protected mode using KG-84/KIV-7 encryption... as it was expected since the used protocol (S-4481F, 75Bd/850). As already noted in other similar STANAG-4481F transmissions, the 128-bit Initialization Vector is splitted in two 64-bit groups and each group is repeated twice rather than four times (as instead it's used to do in STANAG-4285 transmissions).

Fig. 2 - notice the presence of the KG-84 64-bit sync sequence and the 128-bit Initialization Vector (after the removal of the start/stop bits)

As happened for the 4539.7 KHz channel, in the same way the 4529.7KHz channel started with test transmissions and then switched to the usual secured broadcast [1]. TDoA runs indicate the DHFCS site in Crimond UK.

 https://disk.yandex.com/d/6Q_7zvpMlBb8ow

[1] https://i56578-swl.blogspot.com/2021/09/async-5n1-stanag-4481f-likely-tests-or.html

Yet another 75Bd (actual 50)/850 FSK

Yet another 75Bd (actual 50)/850 FSK bearing KW-46 encrypted broadcast spotted on 5189.50 KHz CF, this time probably(?!) sourced from some France AF base (figure 2). The reason of that "format" is still unclear, at least to me (1).

Fig. 1

It should be noted that not all the French sites in figure 2 host HF transmitters, as well as the possibility of some uncertainties of the current TDoA algorithm in finding the origin of FSK signals (as suggested by my friend Linkz); figure 3 shows the Direction Finding results got with the "old" TDoA algorithm: results point the coast of south UK.

Fig. 2 - Direction Finding TDoA results

Fig. 3 - Direction Finding TDoA results (old algorithm)

 https://disk.yandex.com/d/nQZYpTLMq5mJwA

(1) https://i56578-swl.blogspot.com/p/75bd-actual-50bd-4481f.html

75(50)Bd 4481F: yet another channel

Yet another 75Bd/50Bd 4481F channel spotted on 9338.0 KHz (cf), most likely from NPM Lualualei, HI (thanks my friend Mike "mco"). After filtering out the column of the replicated bits from the demodulated stream, it turns out the actual 50Bd speed; then resizing the new stream into a 7-bit pattern, the KW-46 sync sequence emerges.

https://disk.yandex.com/d/eGbxz_R34wLOdw

a STANAG-4481F temporary channel activation?

Heard 75Bd/850 FSK transmissions (broadcasts?) on 6372.0 KHz CF until sunday 13th June, no transmission in the following days (at least until today). Transmissions were KW-46 secured and sourced most likely from Barford St.John USAF transmitter. Think of a temporary activation on the occasion of the G7 summit just in UK... is that too imaginative?

Fig. 1

Fig. 2

https://disk.yandex.com/d/e1BfYmNeUhHa1A

Three new fleet broadcast channels

Three new fleet broadcast channels spotted in these days, all STANAG-4481F:  

4987.0 KHz (cf) 50Bd from NSS Davidsonville
7455,5 KHz (cf) 75Bd from NSY Niscemi
7457.0 KHz (cf) 50Bd from NAU Isabela

All the the broadcast are KW-46 secured(!), although 75Bd/850 usually run KIV-7/KG-84 devices.

These and other recent catches seem to confirm a change in some transmission frequencies, mostly of 2000 Hz or , even stranger, of 1300 Hz. "There is currently a Navy exercise in progress off the east coast, so the shift may perhaps be supporting that effort or maybe to avoid interference or harmonics on other services at the sites", my friend Mike mco say.

I have updated the page related to the BRASS STANAG-4481F page, it is even more evident that all the transmissions that use the waveform 50Bd / 850 are protected with KW-46.

https://disk.yandex.com/d/XJVGUnkI4D4etg 

 

yet another STANAG-4481F 50-75Bd broadcast

5716.0 KHz (cf): STANAG-4481F (apparently) 75Bd fleet broadcast from NAU Isabela (PTR), running with the "odd" and already observerd 3-bit format (Figure 1).

Fig. 1

Removing the third column which contains the replicated bits and then reshaping the resulting bitstream to a 7-bit pattern, it turns out the actual 50Bd speed and the usual KW-46/KIV-7 encrypted stream (Figure 2).

Fig. 2

As mentioned, this behavior has already been noted previously in STANAG-4481F transmissions from NSY Niscemi, AJE Barford and just from NAU: for more informations, the related posts are grouped under a specific tag.

https://disk.yandex.com/d/oiw9OS_fQXcK1Q

async STANAG-4481F with KG-84/KIV-7 encryption (DHFCS)

updates: spotted on 6245.20, 8127.0, and 10272.0 KHz (all Cf)

We are used to see (and recognize) KG-84/KIV-7 encryption in synchronous STANAG-4481F, but this time I ran across such encryption in async S-4481F (75Bd/850) transmissions heard on 8127.0 KHz (cf). The demodulated bitstream has the classic 5N1 framing (Baudot) from which you don't get much, at least until you have the chance to record the beginning of a new message, as shown in Figure 1 (monitoring gets on files).

Fig. 1 - 5N1 bitstream after demodulation

One way to get an idea of what you heard is obviously to remove the start/stop bits and then examine the Baudot code you get, then the experience comes in help. Infact, if it happens to  see the words:
VMGTCNJ <line feed>
BH
we are facing a message which is secured by KG-84/KIV-7 devices. Notice that due to the add of the framing bits, your decoders (such as K500 or Sorcerer) wont intercept the typical KG-84 sync pattern. The classic approach is the examination of the headers of the message after the removal of the start/stop bits and 64-bit period reshaping (Figure 2).

Fig. 2 - analysis of the message headers

 

The first two lines are a short idle state (RYRYRYRY...)
0101010101010101010101010101010101010101010101010101010101010101
0101010101010101010101010101010101010101010101010101010101010101

 

The third line is the well-known 64-bit sync pattern used by KG-84/KIV-7 devices
1111101111001110101100001011100011011010010001001100101010000001

(just the Baudot chars VMGTCNJ <line feed> BH)

 

The following 128-bit Initialization Vector is splitted in two 64-bit groups: 0x118A4DBCD0FA80BE 0x01AC4C5F065D8517 each repeated twice (lines 4,5 and 6,7). That's another interesting feature of these transmissions: indeed the two 64-bit groups forming the initialzation vector are usually repeated four times (the same behavior was noted in 2815.0 KHz transmissions, 75Bd/850 fom UK MoD).

1000100001010001101100100011110100001011010111110000000101111101
1000100001010001101100100011110100001011010111110000000101111101
1000000000110101001100101111101001100000101110101010000111101000
1000000000110101001100101111101001100000101110101010000111101000

Direction finding tests indicate north UK as probable transmitter' location, more precisely I think it's the DHFCS (UK MoD) Tx station located in Crimond (Aberdeenshire, Scotland): operations are remotely managed by Forest Moor net center. As a further clue, it's to be noticed that the DHFCS ALE callsign "XSS" has been heard many times on 8125.0 KHz/USB, ie on the tuning frequency of the S-4481F transmissions (cf - 2000Hz).

Fig. 3 - TDoA runs point to DHFCS site of Crimond

From what I have been able to see these days, the transmission take place only in the morning (never heard after 1300Z), don't know if they are training transmissions or scheduled broadcasts.

 

Fig. 4 - DHFCS Crimond, former RNAS Rattray (HMS Merganser) (1)

(1) photo on the left by flickr  https://www.flickr.com/photos/53277566@N06/36701528042/

22th March update
same on 10272.0 KHz (cf)

24th March update
same on 6245.20 KHz (cf)

 

https://disk.yandex.com/d/srBx7guPz5HdyQ 
https://disk.yandex.com/d/wHBsgEtJx9eLkg 

dwell on STANAG-4481F is always interesting

Sometimes we overlook the usual STANAG-4481F or similar FSK signals, but they are precisely the ones that turn out to be the most interesting: just in these days I heard two STANAG-4481F transmissions that, one way or another, are both notable.
The first one is the Dutch Navy which operates at 6358.5 KHz (cf). That channel is normally used by PBBs for their well known Frequency Availability Broadcast (FAB, also known as CARB) but I was lucky enough to listen to them in "traffic" mode, more precisely using the waveform 50Bd/850 in secured mode (KW-46 device). Likely it was a Maritime Rear Link to communicate with a specific ship. 

https://disk.yandex.com/d/fRp605mzIwB_aQ
 

Fig. 1

Fig. 2

 

The second one has been heard on 8994.0 KHz (cf) using the waveform 75Bd/850, it also secured with KW-46 encryption: Tx site is AJE Barford St. John (UK). Well, apart from the use of KW-46 with the 75Bd waveform, the transmission is interesting since the tuning frequency (8992.0 KHz/USB) is one of the primary channels of the HFGCS network. One can object that 8992.0 KHz is CRO - Croughton, actually  both sites (Croughton and Barford St. John) belong to the same communications complex, being just a few miles apart. One site is the receiving station, the other one the transmitting station.

Fig. 3

Fig. 4

 

It may happen (Figure 5) that the FSK transmission is momentarily suspended to make way for an EAM message which - as you know - has a higher priority ("Ubi maior minor cessat").

 

Fig. 5 - higher prority EAM breaks a STANAG-4481F broadcast

https://disk.yandex.com/d/iEx8-puTY0KwZQ

weird, but intriguing, 75bps Baudot encoding with 3.8 stop bits (prob. ACP-127 msg)

That's a very interesting Baudot 75Bd/850 FSK signal recorded (and sent me) by my friend cryptomaster on 6721 KHz/USB: although its nominal parameters lead to an async STANAG-4481 transmission, the analysis (Figure 1) reveals an unexpected stop-bit length of 3.8 bits(!), i.e. an unusual 5N3.8 framing (it's to notice that, in case of lost sync, the stop-bit stretching allows faster resync and framing of the incoming data).

Fig. 1

Since the bit editor works using integer numbers (it can't draw half bit), the bitstream is shown with the 5N4 framing  (Figure 2, negative polarity): it means that parsing the 5-bit code will inevitably produce some errors.

Fig. 2 - the bitstream as it appears after demodulation

At first glance, the decoded text looks like a message with errors due to a noisy signal or having a poor SRN (Figure 3), but an in-depth analysis of one of the decoded text reveals interesting details that allow us to identify sender/recipient and the very nature of the message: in my opinion, a radar detection report sent in ACP-127 style message. Obviously, decoding suffers from the non standard framing so, after various decoding runs, I re-built the message using the parts taken here and there and that -in my opinion - make more sense.

Fig. 3 - Baudot decoded text

T-O  081506z Fet 21

that's the DATE-TIME-GROUP (DTG)  of the message; indeed, as you can see in Figure 1, the transmission was recorded on 2021-02-08t15_12_04z so we have 08 (day 8) 0815z (time) february 2021 (Fet 21). This way of coding the date also corresponds to what is indicated in the Code FM-13-x-SHIP (or shortly FM-13) [1].

FM TIRPA 29 TO CEFAE
FM is the originator's sign, the originator of this message is indicated by the designation immediately following. TIRPA  is the callsign adopted by the French Aviation Defense Service (ICAO DEF), TIRPA 29 could be an aircraft  [2]. TO is the "Action Addressee", ie the addressee(s) immediately following (CEFAE) is to take action on the message.

INFO AERO LANN BIHOUE
INFO is the Information addressee sign (as "CC"), in this message is the French Naval Aeronautical Base of Lann-Bihoué located in the Atlantic region, placed under the operational command of the Atlantic zone (AERONAV/AWLANT, see below) [3].

MCA ACT/AERONAV/AWLANT
likely the Aéronautique Navale (AERONAV) operational command of the Atlantic zone (Air Wing Atlantic, AWLANT). Since the "scene", MCA could mean Maritime Cryptologic Architecture (here the term "cryptology" refers to the SIGINT functions of the maritime Services and incorporates Information Security or INFOSEC functions).

NMR/004 NP 0802 TXT LR 3/1
number of the message (NMR 04), date February 8th (NP 0802) and format of the message (TXT)

DDGH/FRA/JEWNDE VIENNE
the term "VIENNE" could be misleading (city of Wien) but actually JEWNDE VIENNE stands for "JEANNE DE VIENNE", a F70 type anti-submarine frigate of the French Navy. DDGH is the acronym of Destroyer, Helo Capable, Guided Missile.

GPOSIHION 4642.7N/0023.9W SUFFIX GOWF PAPA
it's likely a (geo) position  (suffix is probably GP, GOLF PAPA ). Don't know the format the coordinates are expressed, it seems they do not exactly follow the FM-13 [1] specs even if the terms North and West are easily recognizable. Trying a parsing, the result is quite realistic (46°25'12", 2°23'24")

ROUTE/VITESSE 293 VRAA
respectively course and speed (see below)

And here things get more interesting:

RMQ:CFTERCEPTION ESM DRBV 26A X SN 40270 / CONFIANCE 3
DRBV 15 / SN 65+53 / CONFIANCE 3  

I guess this text refers to INTERCEPTION ESM, where ESM stands for Electronic Support Measures: i.e. something related to radars [4], indeed:

- DRBV-26A (Jupiter) is a Thomson-CSF early warning radar performing long-range air surveillance on board medium and heavy-tonnage ships. DRBV-26A operates in D-Band, and is available with a cost-effective fully solid-state transmitter [5][6]
- DRBV 15 (Sea Tiger) is operating in S-Band air and surface surveillance and target designation radar. The system is designed for medium to large ships and can be integrated with weapons systems [7] [8]
- CONFIANCE is the degree of the detection confidence, levels range is from 1 (low) to 3 (high).

 SN 40270 and SN 65+53 are probably some of the out measurements from the radars.

BT /0 NNNN
Break and End-of-Message Indicator (EOM)

Since the French Navy frigate "Jean de Vienne" is equipped with both the radars (DRBV-26A and DRBV 15) [9], I think that the recorded transmission could be an ACP-127 tactical message about a radar detection (or something very similar to it). It's not clear to me who the fields position-course/speed refer to (sender? ship? or maybe the radar target?).
Anyway, it's quite unusual to see such (prob.) ACP-127 messages in clear text as well as the 5N3.8 framing, probably derived from a STANAG-4481F modem: could they be trainings? Comments are welcome.

 

Frigate Jean De Vienne (CC BY-SA 3.0, https://commons.wikimedia.org/)

Update (thanks to Jean-Marc Liotier @liotier)
CEFAE Centre d'entraînement et de formation de l'aéronautique navale, navy school in Lann-Bihoué.
Looks like training is the reason for using this elderly format to report ESM sightings.

[1] http://www.vos.noaa.gov/...

[2] https://en.wikipedia.org/wiki/List_of_airline_codes 

[3] https://www.defense.gouv.fr/marine/operations/... 

[4] https://en.wikipedia.org/wiki/Electronic_warfare_support_measures

[5] https://fr.wikipedia.org/wiki/Jupiter_(radar)#DRBV-26A

[6] https://www.radartutorial.eu/19.kartei/07.naval/karte005.en.html

[7] https://www.helis.com/database/sys/677-air-search... 

[8] https://www.radartutorial.eu/19.kartei/07.naval/karte099.en.html 

[9] https://it.wikipedia.org/wiki/Classe_Georges_Leygues

 

https://yadi.sk/d/XNSJvAOX-VezKw

async 5N1.5 STANAG-4481F in cleartext

Yet another interesting STANAG-4481F signal, this time operated in async 5N1.5 mode and in cleartext(!): first time I see a not encrypted S-4481F transmission (obviously except FABs/CARBs). Signal spotted on 11123.55 KHz (CF) at 2220Z a few days ago (24th Dec) thanks to the AI6VN/KH6 KiwiSDR at Kahakuloa, Maui, HI.

Fig. 1

Curiously, since the poor quality of the signal, the bitstream sometimes appears as 5N1 and sometimes as 5N2 (Figure 2).

Fig. 2 - 5N1 and 5N2 bitstreams

The decoded text concerns the AOMSW exercise in the Arabian Gulf on December 21 [1] and since the title ("Navy News Stories of the day" ) and the text, I think it's probably a kind of "press review" for the fleet at sea. 

Fig. 3 - decoded text

Don't know which USN/NATO station operates on that frequency (11223.55 KHz, CF) and unfortunately I went late on that transmission so I didn't have time to DF the signal.

[1] https://www.centcom.mil/MEDIA/NEWS-ARTICLES/

https://yadi.sk/d/ZWGnhaEtwStUmQ 
https://yadi.sk/d/rkR8ritYr1C_bQ 

An odd STANAG-4481F link

Odd STANAG-4481F transmissions consisting of (apparently) continuous KG-84/KIV-7 64-bit sync sequence, spotted on 11222.0 Khz (CF): this is the first stime I hear S-4481F on that frequency. These transmissions have been going on h24 for days and always keeping the same modality.

Fig. 1 - note the oscillations during the mark-space switch

As pointed out by my friend cryptomaster, although k500 decoder recognizes the KG-84 64-bit sync sequence, actually the stream consists of the 63-bit m-sequence generated by the polynomial x^6+x^5+1, or its counterpart x^6+x+1 (Figure 2); this way, the KG-84 sync sequence is obtained by adding one "1" bit. Otherwise, the KG-84 sync sequence may be obtained assuming (as the decoder does) the last bit "1" of the sequence n as the first bit of the sequence n+1, i.e. as if that bit were "in common" bewteen two consecutive sequences (Figure 3). In a few words, decoders are tricked by that 63-bit sequence.

In my opinion, the choice to send that m-sequence is not a "casual" one - they could have used any other test pattern - but raher it's a deliberate choice since its closeness to the KG-84 sync sequence (just one bit) and the fact that KG-84 is largely used in S-4481F links. Interestingly, the stream resulting after the removal of the scrambler consists of  bits all set to "1"; as above, they could have used any other scrambler polynomial.

 

Fig. 2

Fig. 3

 

Fig. 4 - a STANAG-4481F decoder working the 11222.0 KHz transmission

It's difficult to say what it is exactly: maybe tests in view of the setup of a new link,  a frequency marker or maybe some trials. Every attempt to find the Tx site by using TDoA method is different, almost surely it's somewhere in the North-East of US, most likely NSS/AFA Davidsonville (Figure 5).

I will update the post as soon as something new comes out. 

 

Fig. 5a - according to these DF attempts, TX seems located north of Baltimore (likely Davidsonville)

Fig. 5b - other TDoA attempt obtained by selecting receivers from east to west (...still Davidsonville)

 

https://yadi.sk/d/71c7TAuF_ltkJQ

two new 50Bd/850 FSK broadcast channels

It seems that the Turkish friends (or "stars and stripes" friends in Turkey) have activated two new 50Bd/850 FSK broadcast channels on 8788.0 and 8792.0 KHz (cf), or likely 8090.0 KHz in ISB mode. Spotted them on 22th October for the first time. 

Fig. 1

Fig. 2

As expected, since the 50Bd/850 waveform, both the channels are KW-46/KIV-7 secured. The "business card" consists of the pseudo-random sequence generated by the polynomial x^31+x^3+1, those bits replace the stop bits and are used by KW-46 cryptographic equipment to provide synchronization (figure 3).

Fig. 3

Tx site (or Tx sites ?) is in Turkey; unfortunately there are no KiwiSDR in the southern Mediterranean, they would have allowed a more accurate DF.

Fig. 4

 

https://yadi.sk/d/TzPYSWikG8d0XQ

STANAG-4481F from NSY, back to normal op

(for background read all the post of this topic) 

After a period during which the signals showed a strange behavior consisting of a 3-bit period (which in some way "simulated" a 50Bd speed), it seems that the transmissions from NSY Niscemi have back to normal 75Bd operations. So far, I checked almost all the channels except 8145.0 and 8204.5 KHz (and 13229.0 Khz but from NAU Isabela).

Fig. 1 -  6732 KHz from NSY Niscemi in different dates

There is however a peculiarity that is noteworthy: according to my logs and analysis NSY is the only station that uses KW-46 encryption - instead of KG-84 - with the 4481F 75Bd waveform(!), the other stations that use that encryption all adopt the 50Bd waveform. This fact modifies the content of a previous post according to the following diagrams (although provisional).

Fig. 2 - 6732 KHz streams from NSY Niscemi in different dates

Fig. 3

https://yadi.sk/d/02FOSxK157CsYw

NATO 75Bd & 50Bd FSK: F1F2 phase

I decided to replicate the analysis of the phase of the two FSK tones shown in the  previous post  by taking a look at the NATO 75Bd & 50Bd FSK transmissions just because only in the latter the shift (850 Hz) is an integer multiple of the bit rate (850/50 = 17). The The difference between manipulation with a break and without a phase break during switch-over is also visible in SA program in Wave Form mode (Fig. 1): signal "a" is 75Bd/850 FSK, signal "b" is 50Bd/850 FSK; all NATO transmissions.

Fig. 1 -

As expected, both the tones of the signal a (75Bd/850 FSK) do not preserve their phase after each switch-over (Fig. 2) while the tones of signal b (75Bd/850 FSK) preserve their phase (Fig. 3).

Fig . 2 - 75Bd/850 FSK

Fig. 3 - 50Bd/850 FSK

To be precise, 75Bd FSK is from NAU Isabela on 16121 KHz and 50Bd FSK is from NSY Niscemi on 8203 Khz: therefore it must be considered that generally the data are not generated in the same place where the FSK signal is formed. Don't know if the same modem is used in both the waveforms (...and in both the two TX sites), anyway the two tones of the French-Ny 50Bd FSK too have the same behavior i.e their phase is preserved (Fig. 4).

Fig. 4 - French-Ny 50Bd/850 FSK