Yet another 75Bd (actual 50)/850 FSK

Yet another 75Bd (actual 50)/850 FSK bearing KW-46 encrypted broadcast spotted on 5189.50 KHz CF, this time probably(?!) sourced from some France AF base (figure 2). The reason of that "format" is still unclear, at least to me (1).

Fig. 1

It should be noted that not all the French sites in figure 2 host HF transmitters, as well as the possibility of some uncertainties of the current TDoA algorithm in finding the origin of FSK signals (as suggested by my friend Linkz); figure 3 shows the Direction Finding results got with the "old" TDoA algorithm: results point the coast of south UK.

Fig. 2 - Direction Finding TDoA results

Fig. 3 - Direction Finding TDoA results (old algorithm)

 https://disk.yandex.com/d/nQZYpTLMq5mJwA

(1) https://i56578-swl.blogspot.com/p/75bd-actual-50bd-4481f.html

75(50)Bd 4481F: yet another channel

Yet another 75Bd/50Bd 4481F channel spotted on 9338.0 KHz (cf), most likely from NPM Lualualei, HI (thanks my friend Mike "mco"). After filtering out the column of the replicated bits from the demodulated stream, it turns out the actual 50Bd speed; then resizing the new stream into a 7-bit pattern, the KW-46 sync sequence emerges.

https://disk.yandex.com/d/eGbxz_R34wLOdw

yet another STANAG-4481F 50-75Bd broadcast

5716.0 KHz (cf): STANAG-4481F (apparently) 75Bd fleet broadcast from NAU Isabela (PTR), running with the "odd" and already observerd 3-bit format (Figure 1).

Fig. 1

Removing the third column which contains the replicated bits and then reshaping the resulting bitstream to a 7-bit pattern, it turns out the actual 50Bd speed and the usual KW-46/KIV-7 encrypted stream (Figure 2).

Fig. 2

As mentioned, this behavior has already been noted previously in STANAG-4481F transmissions from NSY Niscemi, AJE Barford and just from NAU: for more informations, the related posts are grouped under a specific tag.

https://disk.yandex.com/d/oiw9OS_fQXcK1Q

STANAG-4481F from NSY, back to normal op

(for background read all the post of this topic) 

After a period during which the signals showed a strange behavior consisting of a 3-bit period (which in some way "simulated" a 50Bd speed), it seems that the transmissions from NSY Niscemi have back to normal 75Bd operations. So far, I checked almost all the channels except 8145.0 and 8204.5 KHz (and 13229.0 Khz but from NAU Isabela).

Fig. 1 -  6732 KHz from NSY Niscemi in different dates

There is however a peculiarity that is noteworthy: according to my logs and analysis NSY is the only station that uses KW-46 encryption - instead of KG-84 - with the 4481F 75Bd waveform(!), the other stations that use that encryption all adopt the 50Bd waveform. This fact modifies the content of a previous post according to the following diagrams (although provisional).

Fig. 2 - 6732 KHz streams from NSY Niscemi in different dates

Fig. 3

https://yadi.sk/d/02FOSxK157CsYw

yet another odd STANAG-4481F channel

(for background read all the post of this topic) 
 
May 16th update
Interesting tip from my friend cryptomaster (thanks) who pointed me the 13229 KHz (cf) fequency: also in this case it's a STANAG-4481F transmission with the characteristic of the 3-bit pattern (and obviously KW-46 encryption) but the source, however, is NAU Naval Radio Transmitter in Isabela  (PTR).

Therefore, contrary to what I had observed so far, such broadcasts do not come only from Niscemi (NSY) and Barford (AJE). Below the updated list of the successful frequencies and sites (all CF):

05120.5 NSY
06383.0 NSY
06732.0 AJE
07545.5 NSY
08145.0 NSY, AJE
08204.5 NSY
13229.0 NAU

May 9th
6732.0 KHz: another STANAG-4481F KW-46 secured channel that use the odd 3-bit pattern discussed here. This one is most likely from AJE (Barford St, John, UK) and // with 8204.5 KHz from NSY (Niscemi, Italy). 

Fig. 1

Fig. 2

Fig. 3

So far, it seems that only the transmissions from NSY and AJE exhibit the odd 3-bit pattern we are talking about. Below the current list of the successful frequencies which I observed (all CF):

5120.5 NSY

6383.0 NSY

6732.0 AJE (new update)

7545.5 NSY

8145.0 NSY, AJE

8204.5 NSY

In winter, my friend cryptomaster observed two more frequencies: 4723.9 and 5118.6 kHz (the latter probably NSY tuning freq.).

As said, it's to notice that most of the times the NSY frequencies are logged as "NSY Sigonella": well, NAVCOMTELSTA (U.S. NAVAL COMPUTER AND TELECOMMUNICATIONS STATION) Sicily, located in Naval Air Station  Sigonella, manages the Naval Radio Transmitter Facility Niscemi, housing LF/HF transmitters. Same story about AJE Barford St.John that probably is sometimes reported as Croughton, nearby (6 miles distant). 

https://yadi.sk/d/3cv65paq10dVvA

Again about the 3-bit format STANAG-4481F transmissions

(cryptomaster, I56578. KarapuZ)

STANAG-4481F on 18370 KHz from NPN US Navy, Guam

This is an update and just some remarks to a previous post post which I reference for background. All frequencies are CF (tuning + 2k).

1) the signal

Discussing the signal together, my friend cryptomaster had the suspect that a 50 bps data flow is transmitted using a device which is designed to transmit only with a speed of 75 bps: it could be correct.  The ratio 75/50 is equal to 1.5 thus each "original" bit is repeated 1.5 times. The bit editors work with an integer number of bits (they can't represent half bit) thus the 1.5 bit view is possible only by aggregating two consecutive frames and then getting an integer number of 3 consecutive bits (i.e. 1.5 x 2): thus the 3-bit structure that we see (it's the same of the async 5N1.5 framing which is represented as a 15-bit pattern, i.e. 7.5 x 2). Therefore the bits of the stream are allocated as follows:

A S-4481F transmission lasting 10 seconds produces 750 bits that can be arranged into a 3 x 250 bits pattern; by removing one column we get 2 x 250 = 500 bits that just match a 50bps transmission of the same duration (10 seconds).
But what about the M-sequence generated by the polynomial x^31+x^3+1 ? Notice that the Wagner(13,12) coding, which is used for example in STANAG-5065, replaces each second Fibonacci bit with the parity bit: well, the new Fibocaccci sequence bits (the half of the original one!) still belongs to the same polynomial x^31+x^3+1 (see this post).
Indeed, filtering out the replicated third bits from a 75bps demodulated stream  and resizing the resulting stream into a 7-bit pattern, it turns out that we get an usual KW-46 encrypted 7-bit stream (Fig. 1).

Fig. 1

In the light of the above, I analyzed again the signals in order to verify what we hypothesized and found above. I compared a signal from NSY Niscemi recorded on 6383 KHz (3-bit pattern S-4481F) and another one from NAU Isabela 12120 KHz (plain S-4481F) by using the modified quadrature amplitude detector of SA software: you can valuate the different results (Fig. 2).

Fig. 2

Even more interesting: all the signals from Niscemi show the extra harmonics EXCEPT the signal on 6942 KHz which is correctly modulated (Fig. 3) and coincidentally does not has the 3-bit pattern (Fig. 8).

Fig. 3

Then I selected the 50 Hz clock from the NSY signal and subsequently I demodulate it by using the synch'ed FSK demodulator: the test was successful and replicated the same results that I found using the theory and manipulating the bitstreams (Fig. 4). So, 50 bps seems to be the right working speed.

Fig.4

If our analysis is correct and we are right, it seems that they use the 75 bps STANAG-4481F waveform to send 50 bps streams (?!). We do not know the reason but probably you can  do this. In synchronous transmissions the DTE usually provides the transmit clock to the modem but perhaps they could use a modem - e.g. like the Harris RF-5710A - which can recover the clock automatically from the incoming transmit data (transmit clock set to "DATA" or in "recovery mode").

As proved, decoding those signals using standards modes, or changing the speeds to 50 bps, unfortunately does not work: the only successful way is to sync the FSK demodulator to the 50 Hz clock of the signals. Since we are talking about shore-to-ship broadcast, I wonder how the receive ships may manage these transmissions.

2) the source

(monitoring was carried out according to a list of frequencies from logs and in any case not 24/7)
a) Using remote KiwiSDRs, and with the help of my friend Mike "mco", I checked several S-4481F transmissions  but - at present day - only those from NSY and AJE exhibit the odd 3-bit pattern we are talking about. Below the current list of the successful frequencies:

5120.5 NSY
6383.0 NSY
7545.5 NSY
8145.0 NSY, AJE
8204.5 NSY

It's to notice that most of the times the NSY frequencies are logged as "NSY Sigonella": well, NAVCOMTELSTA (U.S. NAVAL COMPUTER AND TELECOMMUNICATIONS STATION) Sicily, located in Naval Air Station Sigonella, manages the Naval Radio Transmitter Facility Niscemi, housing LF/HF transmitters [1][2]. Same story about AJE Barford St.John that probably is sometimes reported as Croughton, nearby (6 miles distant) [3][4]. 

b) Interestingly, 8145 KHz is shared by NSY and AJE; often I have been able to see contemporary broadcasts and same contents (Figs 5,6). The modified AM detector shows the same results as the ones of Fig. 3

Fig.5

Fig.6

The modified AM detector shows the same results as the ones of Fig. 3:

Fig. 7

 c) According to the Tx sites (NSY in Italy and AJE in UK) this type of traffic is beamed only by some European stations. 

d) As said above, I also spotted a S-4481F transmission on 6942 KHz that DF points to southern Sicily, thus it's again NSY. However, this signal does not have the expected 3-bit structure although it's contemporaneous to another S-4481F transmission beamed from NSY on 6383 Khz (Figs 8,9). So, it seems that most of the 3-bit structured signals come from NSY,  but not all those coming from NSY have that feature. Still not heard S-4881F transmissions on the other NSY frequencies 10974 and 15018 KHz.

Fig.8

Fig.9

https://yadi.sk/d/ZhGp8Ay7Jk4UEA

[1] https://www.public.navy.mil/.../art00145_NCTS-Sicily.aspx
[2] https://www.public.navy.mil/fltfor/navcomtelsta/...
[3] http://www.fraw.org.uk/frn/cw/barford-site.html
[4] https://picryl.com/media/...

3 x 7-bit KW-46 secured channels over STANAG-4481F, NRTF Niscemi

(cryptomaster, I56578, KarapuZ)

This post may be considered as a continuation of an interesting analysis started by my friends cryptomaster and  KarapuZ, see the radioscanner post for background. The signals analyzed by my friends and me consist of STANAG-4481F waveform (also known as NATO-75, FSK 75Bd/850) and  have been spotted on 8202.5 KHz/usb (tuning frequency, CF = +2000 Hz): in our opinion they seem to be (off line) fleet broadcasts of 3 x 7-bit multiplexed encrypted channels.
I want to thank my friend AngazU and the owner of the KiwiSDR http://158.255.239.102:8073/ in Alicante (Spain) who allowed me to use his device w/out time limits in order to monitor these transmissions.

The interesting aspect is the 3-bit structure which is visible in SA raster (Fig. 1) by using, for example, a time window of 200ms (=15 bits @75bps); notice that it does not occur in time windows that implie a number of bits which is not an integer multiple of 3.

Fig. 1 - 3-bit structure in a 200ms raster window

Following this results, the demodulated stream has been reshaped into a 3-bit framing (Fig. 2): it is easy to see that two columns have the same content.

Fig. 2 - 3-bit framing of the demodulated stream

Then, each column in turn has been reshaped in a 7-bit pattern in order to obtain 3 separate files corresponding to the three channels. Karapuz noted that the Fibonacci's bit sequence (generated by the polynomial x^31 + x^3 + 1) is present in each channel (Fig. 3): this is the main indication that the source data was encrypted using the KW-46/KIV-7 cryptographic device, according to STANAG -5065.

Fig. 3 - the KW-46 M-sequences in the 3 channels conveyed by a single S-4481F trasnmission

The presence of three distinct channels suggests that a time division multiplexer (TDM) be used upstream of the S-4481F modem, but there is a problem with the speeds at stake. The used TDM must have a 75bps "aggregate" speed in order to meet the S-4481F waveform requirements, thus each (encrypted!) input channel should have a speed of 25bps... but crypto devices such as KG-46 or KIV-7 do not work at speeds lower than 50 bps! (Fig. 4).

Fig. 4

So, it seems that a kind of "rate change" occurs between TDM and S-4481F modem but a such kind of store-and-forward device to down the speed  appears unrealistic in case of long broadcasts.

During my monitoring I had the luck to catch the beginning of a transmission. Interestingly, the M-sequences generated by the polynomial x^31 + x^3 + 1 just start from the very first bit of the 3 demodulated streams (100% indication in Fig. 5), there are no signatures or magic numbers attributable to transfer protocols or to file formats, neither preambles or synch sequences.

Fig. 5

According to TDoA direction finding tries, the transmitter site is the Naval Radio Transmitter Facility (NRTF) in Niscemi, Italy (Fig. 6): an infrastructure of the NATO communication system that is linked with other US military bases [1]. It's to notice that similar transmissions (3-bit structure S-4481F) can be heard on 7545.5 and 6383 KHz (CF), also them from NRTF Niscemi!

Fig. 6 - TDoA result

As I said, two channels have the same content, as indeed shown in the raster (Fig. 1): it's to notice that such repetitions of encrypted channels were also noted in some KW-46/KIV-7M secured fleet broadcast of the Australian Ny, see the blog post. In that case we have an aggregate speed of 600bps and 12 multiplexed channels, i.e. 50bps speed per channel.

I checked sveral other S-4481F transmissions but so far these odd 3-bit structure is present only in the ones coming from Niscemi: help and comments from readers are very apreciated and welcome.

High Frequency dual mode antennas at NRTF Niscemi (source Wikipedia)

24 Feb update

As expected, parallel transmissions on 8204.5 KHz and 6383 KHz convey the same content (Fig. 7); the third frequency (7545.5 KHz) is not used at this time. 

Fig. 7 - same contents on parallel transmissions

  (to be continued)

[1] https://www.globalsecurity.org/military/facility/niscemi.htm

158.255.239.102_2020-02-18T21_13_33Z_8203.00_usb.wav 
transmission_start.wav
158.255.239.102_2020-02-18T21_13_33Z_8203.00_usb.txt.bin
start.txt.bin