STANAG-4285 async 1200bps test transmissions from Turkey

For about a week I monitored STANAG-4285 1200bps async transmissions heard on several frequencies in the 6 MHz band according to Table I; after April 23th the transmissions have stopped (at least in the 6 MHz band and until today). About the used frequencies, I have not found any match either in the UDXF group logs database or in other resources on the web.

Table I

The transmissions take place with a cycle of about 2 minutes and 25 seconds and seem to use a kind of "call/reply" mode between two stations a,b (since the different strength of the signals); don't know who's the caller and who's the called, but I noticed different patterns depending on the monitored day, as for example in Fig. 1

Fig. 1

The use of two frequencies was also observed (Fig. 2). Obviously it is automated transmissions or controlled by software. Messages, net of 32 bits each for SOM & EOM, have the same length each day, e.g. 8832/5760 bits (caller/called); user-data are encrypted and then transmitted using the 8N1 framing (Fig. 2). Note that the Turkish S-4285 async transmissions I have met so far used the 5N1.5 framing.

Fig. 2 - (the different durations of the signals on the left depend on the waterfall rate that has been selected)

As from Table I, the STANAG-4285 submode 1200bps/L was used from April 15th to April 19th, then the submode 1200bps/S was used.

The direction finding (TDoA) results indicate an area of southern Turkey as a possible transmitter site (Fig. 3); results may be a bit incorrect since the short durations of the signals, anyway it's quite credible. Such a location, along with the transmission schedule and with the encryption algorithm, allows for some observations and comments.

Fig. 3

As seen, the contents of the messages are encrypted but the encryption algorithm does not correspond to the known ones such as KG-84/BID and KW-46/KIV-7 therefore the use of a "national algorithm" can be assumed. TÜBİTAK (Technological Research Council of Turkey) National Electronic and Cryptology Research Institute (UEKAE) developed secure communication solutions in terms of cryptographic algorithms, protocols, and architecture as well as data encryption devices such as the MİLON family (MİLON-4A was also approved by NATO) [1] [2]. It is reasonable to think that these transmissions, as well as other encrypted transmissions from Turkish Armed Forces which are reported in this blog, use such encryption systems.

Fig. 4 - some encryption devices by TUBITAK
(https://bilgem.tubitak.gov.tr/.../corporate_presentation_v7-2019.04.09.pdf)

The way these transmissions are conducted suggests that they are tests. STANAG-4285 is now a consolidated and widely used waveform and therefore the tests could concern the installation of a new HF system (maybe a MRL system?). There is also another somewhat "suggestive" hypothesis: on-field tests of a SCA-based 4285 waveform on proprietary advanced SDR transceivers. Indeed, TUBITAK UEKAE ported two different waveforms to the Spectrum's flexComm SDR-4000 for demonstration to the Turkish Ministry of Defense: an implementation of STANAG-4285 for high frequency (HF) radio links and APCO Project 25 (P25) for public safety links [3].

https://yadi.sk/d/wpMhMwaNpa9NXg
https://yadi.sk/d/OnFVfIPiiBbwlA

[1] https://www.hurriyet.com.tr/gundem/natonun-kripto-cihazlari-tubitaktan-9191151
[2] https://bilgem.tubitak.gov.tr/.../corporate_presentation_v7-2019.04.09.pdf
[3] https://pdfs.semanticscholar.org/

STANAG-4285, async Turkish "T-15"

05300.0 KHz/USB (intruding the 60mt amateur band), Turkish Mil prob. from Izmir area, TUR. STANAG-4285 600bps/L carryng async 5N1.5 (Turkish "T-15") stream: most likely encrypted pseudo-random naval broadcast since after removal of start/stop bits the resulting 5-bit stream does not autocorrelate (ACF = 0). A similar S4285 transmission but with 15/128 bits length period has already been reported here.

Notice that "T-15" is not an official name nor a well-known name: it's just a nickname I use in this blog to refer to this Turkish 15-bit format.

 

Signals and recordings gathered thanks to KiwiSDRs: kiwisdr.yo3iul.ro, sdr.ok2kyj.cz.

update

I gladly add a comment from my friend Valentin (cryptomaster): "The encrypted information was transmitted in "start-stop" mode with a 5-bit code with the addition of 1 bit - "start" and 1.5 bit stop. Since the transmitting equipment is designed to transmit an integer number of bits, the two halves of the code accumulated during the transmission are added up to one additional bit (0.5 + 0.5 = 1). Thus, a period of 15 bits is obtained.
The 5-bit code statistics are uniform, which confirms the use of encryption." 

sdr.ok2kyj.cz_2019-09-06T21_29_02Z_5300.00_usb.wav 

Asynchronous STANAG-4285 15/128 bit period (possibly Turkish T-15)

6234 Khz/USB STANAG-4285 600bpsL, very long idling periods (hours!) with sporadic asynchronous data transfers consisting of 15 bit and apparently nx32 bit (32,64,...,128) ACF blocks (Fig. 1). The 15-bit Block-A is clearly an async ITA2 5N1.5 stream (Fig. 2). By decoding the whole stream whit the HARRIS RF-5710A modem, also the Block-B seems to use ITA2 and 5N1.5 framing: indeed, the modem does not print bad framing errors. By the way, I do not think a framing change "on the fly" be possible. Looking at Block-B  (Fig. 3), it seems arranged as 4 groups of 4 chars (the fourth as separator), but it's only a my guess.
In both blocks the 5-bit text appears as (off-line?) encrypted.

For a better understanding of the figures keep in mind that bit editors work with an integer number of bits therefore they cannot represent an half bit.

Fig. 1 - data transfer consists of two blocks

Fig. 2 - 15-bit period Block-A

Fig. 3 - 32/128-bit period Block-B

The above images come from a 4285 demodulator output which returns the bits in air, the demodulated stream from 5710A modem (framing 5N1.5) is shown in Figure 4.

Fig. 4

For what concerns the user/source, I had the best SNR using a remote SDR in Greece (http://sdr.telcosol.gr:8073/), probably the transmitter is located in the eastern Mediterranean area: Greece, Cyprus Is. or Turkey. Some friends from radioscanner say it's the Turkish T-15 protocol.

Fig. 5 - monitoring the signal using remote SDRs in Greece and Spain (at same time)

https://yadi.sk/d/KTToEiGP3Twmbx

Turkish Mil, FSK 300Bd/400Hz KG-84C

Weak signal heard on 5115.5 KHz, central frequency, at 0549 UTC. Analysis with SA reveals an FSK signal running at 300Bd and 400 Hz shift.

fig. 1

fig. 2

Once demodulated, the presence of the KG-84C 64-bit sync pattern (fig. 3)  leads to think about a NATO partner Nation: looking at precedent posts,  most likely the signal belongs to the Turkish  FSK waveforms.

 

fig. 3

https://yadi.sk/d/QXv7FXiYxdbjH

Turkish Mil, FSK 600Bd/400Hz & 1200Bd/800Hz KG-84C

weak signal heard on 10551.0 KHz/USB  0805z, variant of the more frequent 600Bd/400 reported here.

The low quality of my recordings does not allow its demodulation and then further investigations to check the presence of KG-84 encryption, anyway generally used in this kind of signals (FSK, both 600 and 1200 Baud speed). KarapuZ provided me a better quality recording so it was pretty easy to verify the KG-84 "flag"

Turkish Mil, FSK 600Bd/400Hz KG-84C

Although the signal is weak, you could easily find its basic parameters as in pictures 1 and 2. The signal has been heard on 07932.5 KHz (cf) around 0744z and also analyzed here by radioscanner.ru friends.

pic.1

pic. 2

This signal use cipher NATO KG-84, it can be identified by the 64-bit sequence in each session (the KG-84 frame sync)

1111101111001110101100001011100011011010010001001100101010000001

highlighted in pic. 3

pic.3

The KG-84A and KG-84C are encryption devices developed by the U.S. National Security Agency (NSA) to ensure secure transmission of digital data. The KG-84C is a Dedicated Loop Encryption Device (DLED), and both devices are General-Purpose Telegraph Encryption Equipment (GPTEE). The KG-84A is primarily used for point-to-point encrypted communications via landline, microwave, and satellite systems. The KG-84C is an outgrowth of the U.S. Navy high frequency (HF) communications program and supports these needs. The KG-84A and KG-84C are devices that operate in simplex, half-duplex, or full-duplex modes. The KG-84C contains all of the KG-84 and KG-84A modes, plus a variable update counter, improved HF performance, synchronous out-of-sync detection, asynchronous cipher text, plain text, bypass, and European TELEX protocol. 

Compared to the KG-84A, the KG-84C had some interesting extras. It has a variable update counter,

improved HF performance, out-of-sync detection (when in synchronous mode), asynchronous ciphertext, plaintext bypass, and the European Telex protocol. When used with a suitable digital telephone unit, the KG-84 could also be used for secure voice transmissions. Data could be handled by the KG-84 in asynchronous mode at rates between 50 and 9600 baud. In synchronous mode, it could even go up to 32,000 baud (or even 64,000 baud when used in combination with an external clock). 

https://en.wikipedia.org/wiki/KG-84

https://www.ia.nato.int/niapc/Product/Elcrodat-4-2_124