DVP (tm) and DVP-XL (tm) Radio Encryption

DVP _(tm)

Motorola DVP T3010BX Code Inserter (without battery pack).
The newer "-XL" versions look identical except that they also have keys 8,9,A,B,C,D,E and F

Motorola DVP T3010BX Code Inserter and UHF Saber (Securenet)

Below is a ruggedised secure Saber (with speaker mike). These are often used for military applications.

saberR.jpg (86152 bytes)

DVP What is it????

In this context DVP stands for Digital Voice Protection DVP _(tm). DVP_(tm) is a Motorola Inc encryption system widely used in the USA and many other countries around the world. Using DVP_(tm) Two-Way radio users are protected from eavsdropping through encryption of their signals. DVP_(tm) is just one of several scrambling systems sold by Motorola Inc.

The digital scrambling systems sold by Motorola include:
DVP (Numbers on keypad of Code Inserter 0-7 inclusive)
DVP-XL (Has numbers 0-9 and A-F inclusive on keypad of KVL)
DES Reported to use the US Data Encryption Standard in CBC mode (DES)
DES-XL Reported to use DES (Has numbers 0-9 and A-F inclusive on keypad of KVL)
DVI Believed to be a version designed for export from the USA
DVI-XL SPFL As above but with improvements
Fascinator A more secret system apparently used by various US Government users for national security applications.
Indictor A digital scrambling system often used by military and federal law enforcement users in the USA.

Note: In US patent No: 5,363,447 it is stated that DVI-XL is more secure than DVP-XL.

To the recreational radio scanner listener DVP transmissions can often be identified by the unusual "white noise" or "static" sound. This noise is similar to that of having an open squelch. The noise is in fact that of "data" being sent at 12kbps. In Australia DVP and DVP-XL is mainly used by Government bodies. I understand however that prawn trawlers in the North of Western Australia were also using the system, perhaps there are other civilian users in Australia as well?

How Does it Work?
Speach is digitised using the CVSD method and then combined with a "random" stream of data
generated by the secret key and the DVP encryption algorithm. The reverse process is applied
to the receiving radio.

Is this gear available to the public?
In the USA DVP & DES systems are readily obtainable. Just a quick browse through the USENET newsgroup rec.radio.swap will reveal a plethorah of scrambling gear for sale. Most of the gear sold on rec.radio.swap is DES or DES-XL. I have seen on this newsgroup a wide variety of gear that includes:

*DES compatible repeaters
*DES,DES-XL_(tm),DVP_(tm),DVP-XL_(tm) radios,keyloaders & cables
*DES and DVP_(tm)service monitors/test gear

Another place to look for second hand DVP/DES gear is the following site:
http://www.dejavue.com/panik/panik.txt (2ND hand Motorola gear)

A few years back there was a realisation that DES might be getting a little dated. A group in the USA called EFF (Electronic Frontiers Foundation) built a machine which can find a DES key in several days. The details of the machine were published in a book called "Cracking DES". The hardware was custom built and used purpose made ASIC. The VHDL used to describe these ASIC s, schematics, programs in C were all included in this book, the idea being that anyone could (in theory) make there own machine. Perhaps this will result in DES based radio encryption gear being replaced with stronger encryption schemes?

Here is a link to the EFF web site where you can see photographs of Deep Crack, there are also links to online versions of the
book "Cracking DES".
http://www.eff.org/descracker.html

DVP CODE INSERTERS (Also known as KVL's or Key Variable Loaders for DES systems)
The DVP Code inserters shown in the above photographs are used to load a secret key into a DVP compatible radio. The key is entered into the Code Inserter by way of the keypad. The key is transferred from the Code inserter to the radio using an interface cable. (The interface cable is described in the "batwing" link in the links section).

One Code Inserter may be used to program a huge number of radios. Thus Code Inserters are much less common than DVP radios. To spell out how a Code Inserter is used:
(a)A key is typed into the DVP Code Inserter
(b)The key is loaded into compatible radio Number "1"
(c)The key is loaded into compatible radio Number "2"
(d)Radio Number "1" and radio Number "2" can now communicate using DVP

DVP Code Inserter general info
The Code Inserter shown above has a red LED type display. The display can show only 8 alphanumeric characters, for example:
0 ErASEd This indicates that key memory number 0 is empty.
LOAd _ This occurs after the LOAD key is pressed. The Code Inserter is prompting for a memory location.
4.1 121394 This is a typical screen when loading a key. It indicates memory number 4, line 1, and the first six digits of the key are 121394.

The case resembles that of the MX series handhelds. The keypad is a membrane type, similar to that found on the old Sinclair ZX-81 computer or the keypad on some microwave ovens.
*There are only 8 numeric keys 0-7 inclusive (more on the -XL versions)
*There is the standard MX type connector on the side of the unit (only some pins are used)
*There is a PTT style switch to load the key, even when the Code Inserter is turned off it "wakes"
when this switch is depressed.
*Audible "beeps" are made during certain operations

SECURITY SYSTEMS
The keys stored in the Code Inserter will be lost if the battery (power supply) is removed. To prevent unauthorised use of a Code Inserter to load an unauthorised radio with a secret key a PIN type system can be implemented on the Code Inserter using the "LOCK" key. The DVP code inserters are also called "keyloaders" by some people. The name on the back of the T3010 units says "DVP Code Inserter". I have learnt that there are different versions of the DVP Code Inserters. They are:
T3010AX Oldest
T3010BX
T3010CX
T3010DX More recent

There are a variety of other Motorola KVL's, eg the T3011

The DES keyloaders of the same generation as the T3010 are model number T3020
The DES keyloaders state on the ID plate that they are:

DES Key
Variable Loader

COMPATIBLE RADIOS
Radios generally require a special "DVP Module" in order to be able to transmit and receive the encrypted signal. Motorola Inc refer to their range of radios capable of encryption as "SECURENET (tm)" products. Not just any radio can take a DVP module. For example a specific model of Motorola Saber (tm) is required before a "DVP Module" can be fitted. The case on the SECURENET compatible radios is slightly longer than the standard model. If a DVP/DES module is not fitted to a Saber then a "dummy" module must be fitted (sometimes radio technicians solder a few wires to avoid using the dummy module). From browsing the rec.radio.swap newsgroup I have noted that the following radios are available with DVP as an option
Motorola Saber 1,2 &3 (See the picture near the top of this article)
Astro Saber
Astro Spectra
MTS 2000
MX300-R (This is a ruggedised version of the MX300S)
MX350
MX360
Syntor X 9000 .........please let me know if you have a complete list..

XTS3500 Handheld radio capable of being equipped with Fascinator_(tm) or Idictor_(tm).

BASIC TECHNICAL DETAILS OF DVP (tm)
Analogue to Digital Conversion
A/D & D/A conversion using CVSD chip. Sampling Interval/Rate 12,000 bits per second
Cryptographic Algorithm
Reported to be a Motorola proprietry algorithm
Self synchronising cypher (cipher if you are in the US) algorithm
Key Length
A 24 digit number is entered using the keypad for each key.
Number of possible keys 2.36 * 10^²¹ (Note: This is not 2^¹⁹² as might be expected from 24*8)
In fact 2^⁷¹is equal to 2.3612*10^²¹.
The process where a 24 digit number is converted to 71 bits of key is unknown to me. 71 is an unusual length for a key.

There are a number of keys that are prohibited by the DVP Code Inserter.
Any key ending in the numbers 4,5,6 or 7 is prohibited. This markedly reduces the number of
keys available.

This means keys:
000000 000000 000000 000004 through to key
777777 777777 777777 777774
are prohibited.
It also means keys:
000000 000000 000000 000005 through to key
777777 777777 777777 777775
are prohibited.
It also means keys:
000000 000000 000000 000006 through to key
777777 777777 777777 777776
are prohibited.
It also means keys:
000000 000000 000000 000007 through to key
777777 777777 777777 777777
are prohibited.

SOME OF THE PATENTS RELATED TO Motorola Inc ,SECURENET,DVP(tm),DES,DES-XL
Description of secure key management US Pat No: 5,363,447
Overview of DVP(tm) US Pat No: 4,167,700
Over the air re-keying of radios Nos: 5,301,232 also 5,528,691
DES-XL Keyloader design (Note this is a design) No: D390,554
The above patents can all be viewed on the IBM patent server http://www.patents.ibm.com
(Full content of patents scanned in here!)
Consult your legal representative regarding the legality of using information contained in a patent

LINKS (Here are some links for you to follow)Click on them to go to the pages
http://www.batlabs.com/encrypt.html (Batlabs excellent description of Motorola voice scrambling DVP etc
http://www.psychonet.net/~batlabs/kvl.html (Batlabs!! KVL etc cable pinouts)
http://www.qth.net/archive/motorola (Archived contents of Motorola mailing list)
http://www.cam.org/~manitou/SONS/scansounds.html (Foreign scrambling info with some .WAV files)
http://www.uark.edu/~plaws/scan/txt/trnk03.txt (Interesting info re-DVP/DES)
http://www.clipper.net/~scanrite/scramble.html (Samples of DVP .WAV files)

Non DVP Link
http://www.racalcomm.com/products.htm (Some government agencies appear to be moving towards Racal equipment, this site shows some of the very capable gear that Racal sells. The "MBITR" covers 30-512Mhz in a single handheld! Encryption using various algorithms is supported in many of these units.)

Thanks
Thanks for visiting this page, please e-mail me at radioencryption@hotmail.com if you can help with any information or have any comments.

NOTE:
*I am always looking for photos of scrambling gear. Please let me know if you can help

*I cannot help you to listen to DVP etc scrambled transmissions, because:
(a) I don't know how
(b) Even if I did know how (which I don't) I don't want to compromise the security of the networks that use this gear.
*I do not work for Motorola Inc or any competitor
*SECURENET, DVP,DVP-XL,DES-XL,Fascinator,Indictor, etc are trademarks of Motorola Inc
*If you feel that I have revealed information about DVP or any other encryption that I should not have done, please let me know and I will remove it ASAP.

Thanks for your visit. If you have any information/corrections please send me an e-mail to: radioencryption@hotmail.com

dvp,dvp-xl,des,des-xl,dvp,dvp-xl,des,des-xl,dvp-xl,des,des-xl,,dvp-xl,des,des-xl,,dvp-xl,des,des-xl
dvp,dvp-xl,des,des-xl,dvp,dvp-xl,des,des-xl,dvp-xl,des,des-xl,,dvp-xl,des,des-xl,,dvp-xl,des,des-x
dvp,dvp-xl,des,des-xl,dvp,dvp-xl,des,des-xl,dvp-xl,des,des-xl,,dvp-xl,des,des-xl,,dvp-xl,des,des-x