icom dPMR encryption

Licence free two-way radio services that now includes both FM and digital channels. Discuss models, modifications and other similar worldwide standards such as FRS and GMRS.
Post Reply
cisco1
Registered New User
Registered New User
Posts: 2
Joined: 08 Aug 2019, 09:08

icom dPMR encryption

Post by cisco1 »

Does anyone know if basic encryption in icom dPMR can be decrypted?
as far as I know there are only 32k code options? radio icom iF4062T/S

thx
26mb04
Super Member
Super Member
Posts: 257
Joined: 23 Nov 2017, 20:14
Call Sign: 26DG01
Location: Democratic Peoples Republic of Devon

Re: icom dPMR encryption

Post by 26mb04 »

Absolutely. There is demo on youtube showing enhanced DMR encryption key recovery with free software (albeit a custom build), so dPMR encryption will be a very similar approach. It's fine for stopping Most People (myself included) listening to you, but it's not unbreakable to someone who really wants to listen in. The raw data can also be recorded now, and decoded at a later date, so there's that to consider.
Sent from my GP300 using DTMF
User avatar
thelad
Top Poster
Top Poster
Posts: 1656
Joined: 30 Jan 2012, 20:45
Location: West Yorkshire

Re: icom dPMR encryption

Post by thelad »

26mb04 wrote: 21 May 2020, 12:49 Absolutely. There is demo on youtube showing enhanced DMR encryption key recovery with free software (albeit a custom build), so dPMR encryption will be a very similar approach. It's fine for stopping Most People (myself included) listening to you, but it's not unbreakable to someone who really wants to listen in. The raw data can also be recorded now, and decoded at a later date, so there's that to consider.
Do you have a link to said video? I assume you mean from the radio its self rather than in the transmission.
Uniden UBC120XLT
Uniden USC230E
Uniden UBC3500XLT
Binatone PMR MR500 x2
Magiksun TM-490 (BF-888) x3
Baofeng BF-888
TTI TSC 100R
Baofeng UVB5
Zastone D900
Icom IC-R6
cisco1
Registered New User
Registered New User
Posts: 2
Joined: 08 Aug 2019, 09:08

Re: icom dPMR encryption

Post by cisco1 »

26mb04 wrote: 21 May 2020, 12:49 Absolutely. There is demo on youtube showing enhanced DMR encryption key recovery with free software (albeit a custom build), so dPMR encryption will be a very similar approach. It's fine for stopping Most People (myself included) listening to you, but it's not unbreakable to someone who really wants to listen in. The raw data can also be recorded now, and decoded at a later date, so there's that to consider.
coul you please send me a link here or via pmessage?
p.s. the question is not about decoding dPMR signal, its about encrypted voce ;)
26mb04
Super Member
Super Member
Posts: 257
Joined: 23 Nov 2017, 20:14
Call Sign: 26DG01
Location: Democratic Peoples Republic of Devon

Re: icom dPMR encryption

Post by 26mb04 »

The spec for the F4062 doesn't mention encryption in the dPMR mode. Do you mean the standard voice inversion? That's not really encryption as such, there are loads of ways to listen to that. The other options are either the UT109 non-rolling scrambler (as before) or the ut110 rolling scrambler. I don't know much about that, but I'd imagine the technique would be similar to fixed frequency. As for the dPMR mode, the spec I have seen makes no mention of encryption so I doubt it will have that capability.

I can't find the vid of the enhanced break. Here is a thread from the DSD devs who say it is possible to build DSD+ in a way that will decrypt enhanced DMR privacy. This probably involves using other programs that aren't included with DSD+, so it won't be straightforward. I would think the same techniques will apply to dPMR encryption too. Enhanced privacy was never meant to be unbreakable, just quite good.
Sent from my GP300 using DTMF
User avatar
Metradio
Radio Addict
Radio Addict
Posts: 603
Joined: 28 Apr 2016, 19:10
Call Sign: G7HID
Location: Box 500, Slough UK

Re: icom dPMR encryption

Post by Metradio »

Little known fact, the AOR family of digital receivers (DV1, DV10 and AR 5700D) are able to find the key and unscramble speech within 2 seconds on basic privacy in NXDN/IDAS protected systems..

Mike
Connect Systems CS750 and CS800, Hytera PD-365, Motorola DP4600.
Raspberry Pi 2 and DV4Mini HotSpot.
AOR AR-DV1 Digital Voice Receiver / eSPY on ARD V1.

Whistler WS1088 / TRX-1 / Whistler Q / UBCD3600XLT / WTR Browser.
moj
Super Member
Super Member
Posts: 354
Joined: 28 Jun 2011, 12:18
Location: Manchester , Uk

Re: icom dPMR encryption

Post by moj »

no that's not correct sadly Mike , i know it can decrypt the nexedge and idas 4800 code but the idas trunking it didn't work for me which was the reason i bought the DV1 for in the first place and if i remember right there 32'767 combinations and no it's not easily crackable and had to be done manually ;)

Also the enhanced video will be the one made by the dsd maker who vowed to never release it to the public due to all encryption would probably go the AES route then .

The rolling code also can not be cracked with an inversion descrambler program on the UT110r board either , i tested all these theorys on the idas ic-f4162d handheld and the ic-f6062d base !

hope that help's ;)
User avatar
Metradio
Radio Addict
Radio Addict
Posts: 603
Joined: 28 Apr 2016, 19:10
Call Sign: G7HID
Location: Box 500, Slough UK

Re: icom dPMR encryption

Post by Metradio »

The DV1 it seems is only capable of receiving NXDN/Idas 4800 and not 9600, DV10 and the new AR5700D are the same.. Luckily for me the stuff I can hear is all 4800 with just one scrambled user - an f this and f that skip hire firm...

Mike
Connect Systems CS750 and CS800, Hytera PD-365, Motorola DP4600.
Raspberry Pi 2 and DV4Mini HotSpot.
AOR AR-DV1 Digital Voice Receiver / eSPY on ARD V1.

Whistler WS1088 / TRX-1 / Whistler Q / UBCD3600XLT / WTR Browser.
cisco1
Registered New User
Registered New User
Posts: 2
Joined: 08 Aug 2019, 09:08

Re: icom dPMR encryption

Post by cisco1 »

For example, I have a recorded transmission in dPMR format, encrypted, is there any software/device through which I can decrypt it or even manually guess the 32,767 possible keys? i think, i cannot do it via R-8600, R-8600 needs a real transmition?

DV1 has a code option, but it only for NXDN, not for dPMR
Last edited by cisco1 on 28 May 2020, 11:02, edited 2 times in total.
26mb04
Super Member
Super Member
Posts: 257
Joined: 23 Nov 2017, 20:14
Call Sign: 26DG01
Location: Democratic Peoples Republic of Devon

Re: icom dPMR encryption

Post by 26mb04 »

Well, moj, it's good to know someone has tried all these things.

cisco1, it depends on whether you recorded the transmission as audio, or data from the iq output. If the latter, you could hold on to the recording until a future point when there's a chance you'll be able to use another programme to decrypt it. It's only a matter of time (perhaps a LOT of time) before enhanced privacy keys become more easily compute-able, like CTCSS tones are today. I reckon an enhanced privacy decryption programme will be in the wild within 15 years. You'll probably need a decent GPU to run it though.
Sent from my GP300 using DTMF
troffasky
Super Member
Super Member
Posts: 341
Joined: 18 Jul 2010, 14:58

Re: icom dPMR encryption

Post by troffasky »

cisco1 wrote: 28 May 2020, 10:54 For example, I have a recorded transmission in dPMR format, encrypted, is there any software/device through which I can decrypt it or even manually guess the 32,767 possible keys?
32k possibilities are trivially easy to exhaust with modern computing resources. You just need to write the software.
moj
Super Member
Super Member
Posts: 354
Joined: 28 Jun 2011, 12:18
Location: Manchester , Uk

Re: icom dPMR encryption

Post by moj »

Well if you can create this program it will be a useful tool to add to our scanning toolkit Troffasky ;)
Post Reply