unid PSK2/FSK2 combined bursts

This is a very interesting transmission heard on 14736.5 KHz/USB which consists of repetitive bursts lasting about 12.6 s and separated by an interval of 1300 ms. The most interesting aspect is that a "combined" waveform is used, that is, a first segment with PSK2 modulation followed by a second segment with FSK2 modulation: both the segments are modulated at the same rate of 31 bps (Figure 1).

Fig. 1 - PSK2/FSK2 "combined" waveform

An interesting feature that my friend cryptomaster pointed out is the PSK2 mode, where the bitstream is transmitted in single bits: this feature can be seen in Figure 2 using both the "oscilloscope" function and the AM demodulator of SA. The demodulation of this bit-keying mode is complicated, apparently due to the division of the carrier into separate bits.

Fig. 2 - PSK2 segment

The FSK2 segment modulation uses a shift of about 370 Hz (measured 373) and the resulting bitstream after demodulation has an 8N1 framing which appears to be transmitted in reverse polarity (Figure 3).

Fig. 3 - FSK2 segment

The interesting things about this curious transmission don't end here: going back to the previous posts I discovered that the FSK2 segment carries exactly the same content as the 50Bd/612 FSK2 bursts analyzed some months ago [1] and compared in Figure 4.

Fig. 4 

So, it's likely the same (unid) user, maybe experimenting with different waveforms... who knows.

The PSK2 segment too probably carries the same content of the FSK2 segment, unfortunately demodulation with SA was not successful due to the particular mode which is here used.

https://disk.yandex.com/d/HV3j9zdSSRqLww

[1] http://i56578-swl.blogspot.com/2024/11/unid-fsk-50bd612-bursts.html

unid FSK 6Bd/50

No, it's not a typo: this FSK signal (kindly sent me by my friend cryptomaster) is really modulated at the speed of 6 Bd and 50Hz shift (Figs. 1,2).

Fig. 1 - modulation speed

Fig. 2 - 50Hz shift

The demodulated bitstream has a period of 696 bit (Figure 3): we do not know the source and the user.

Fig. 3 - 696 bit period

https://disk.yandex.com/d/d3Arg5sX2rXwhA

 

T-219 "Yachta", analog voice scrambler

Thanks to my friend Mario, who recently sent me some recordings, I had the opportunity to study the Russian T-219 system, codenamed "Yachta" (Russian: ЯХТА). Yachta is a Russian analog voice scrambler featuring a Frequency Shift Keying (FSK) signal transmitted in the center of the spectrum, with the encrypted voice stream split above and below the FSK signal (Figure 1). Although dating back to the Cold War era, the system is still used for tactical communication in the combat field as recordings are only a few days old and heard in the lower VHF range (just above the upper HF limit). The stream consists of unequal time segments, within which the two voice subchannels are swapped and inverted.

Fig. 1 - T-219 "Yachta" signal

The FSK signal is used as a synchronization sequence and is transmitted at a rate of 100 bps with a 150 Hz shift (Figure 2).

Fig. 2 - T-219 FSK parameters

As shown in Figure 3, after FSK demodulation the resulting synchronization bitstream is an M-sequence based on the irreducible polynomial x^52+x^49+1.

Fig. 3 - the M-sequence based on the irreducible polynomial x^52+x^49+1

It turned out that during the formation of the FSK signal the pahses of the two frequencies are preserved after each "shift" (Figure 4 shows two periods): that suggests that it's formed by switching (mechanically or electronically) two independent F1 F2 frequency generators which bear some inter-relationships or by using a VCO system.

Fig. 4 - two periods of the FSK frequencies

By the way, looking at the durations of two periods:
F1 = (2:0.001285470) = 1555,851167277338
F2 = (2:0,001422470) = 1406,005047558121
the shift is just about 150 Hz

https://disk.yandex.com/d/M60fqwh32SbNFQ 

Dutch Navy CARBs, a curious 8 times expanded 5N1.5 framing

On December 13th morning I accidentally tuned a KiwiSDR receiver on the well-known frequency of 8437.0 KHz USB, i.e. the Dutch Navy CARB channel operating in S-4481 FSK (8439.0 CF). Suddenly, about 1050 UTC, the usual FSK "melody" disappears to make room for a transmission in S-4285 600bps/Long mode (Figure 1): intrigued, I recorded that transmission. 

Fig. 1 - STANAG-4285 transmission

As in Figure 2, dhe decoded bitstream shows a repeating "message" characterized by a pattern with a period length of 61 bits.

Fig. 2 - 61-bit period bitstream

I then isolated a single "message" and after the appropriate shifts a 5N1.5 framing emerges where each bit is repeated eight times. The stop bits should be 12 (8x1.5) but for some reason I don't know 13 bits are reproduced (Figure 3).

Fig. 3 - 8 times expanded 5N1.5 framing

After the removal of the start/stop bits, the source 5 bits of data can be obtained after removing the overhead bits: this can be easily done by manually editing the demodulated bitstream, for example with BEE, or by "downsampling" the bitstream by a factor of 8 using a simple script coded - for example - in Octave. The result (5x10 decoded) is the well known CARB string "02A   04B   06A   08B   12A   PBB" which is usually transmitted in S-4481 mode by the Dutch Navy (Figure 4).

Fig. 4 - the resulting CARB string "02A   04B   06A   08B   12A   PBB"

Obviously I don't know the purpose of such a transmission except - obviously - for the CARB (Channel Availability and Receipt Broadcast) string. I had already encountered something similar some time ago, a particular transmission of UK DHFCS: in that case it was a 5N1 framing where each bit was repeated 16 times [1].

It is worth noting that transmission in S-4285 was in 600bps mode and 600:8 gives 75! That is the same speed as CARBs transmissions in S-4481.

https://disk.yandex.com/d/3A2Ouj9TBQERZw

[1] http://i56578-swl.blogspot.com/2022/01/an-odd-16-times-expanded-5n1-framing-uk.html

256-bit IVs & 0xD1E221E1 sequence

Just a quick note to observe that bitstreams using (alleged) 256-bit Initialization Vectors (IV) encryption have the same 32-bit/4-byte sequence repeated three times. For example, in the bitstream in Figure 1 (MS-110A transmission) you can clearly see the 256-bit IV sequences, each repeated eight times. 

Fig. 1

But if you reshape the same bitstream into columns of 32 bits the same 32-bit sequence 0xD1E221E1 emerges (Figure 2).

Fig. 2

I have previously encountered bitstreams with 256-bit IVs [1] but at that time I had not investigated further, focusing only on those sequences. As a counter-proof, I took back and analyzed those signals and - surprise - they also all present the same sequence 0xD1E221E1 after the IVs (Figure 3).

Fig. 3

It should also be said that I have also encountered the sequence 0xD1E221E1 three times previously [2] but, when I re-analyzed those transmissions, the 256-bit IVs were not found (Figure 4).

 

Fig. 4

Both for the position of the 4-byte string 0xD1E221E1 (after or WITHOUT the alleged IVs) and for its presence in different streams it is difficult to say whether it identifies a sync string for a cipher device or whether it identifies a particular datalink protocol. However, in all cases I could analyze, STANAG-4538 (3G-HF) "circuit mode service" is used along with MS-110A as the traffic waveform.

Comments and suggestions on this matter are welcome!

 

https://disk.yandex.com/d/DxsFHMYcLIw4cA 

[1] https://i56578-swl.blogspot.com/2020/09/s-4538110a-transmissions-using-unid-256.html
[2] http://i56578-swl.blogspot.com/search/label/P%3D32