die@hydra.UUCP (Dave Emery) (03/14/85)
___ The following item was posted some months ago at a time
--- our network interface system was acting up - it may not have gone out ..
--- bear with me if you've already read it ...
Does anybody know if any of the 1200 baud diphase psk Navy fleet
broadcasts from the geosynchronous UHF fltsatcom spacecraft carry UPI, AP or
weather channels in some format that an ordinary mortal (very
far from NSA level as a cryptanalyst) can recover with a suitable
computer program ?
In the old days (late 60's to mid 70's) the Navy fleet broadcasts
on hf (and lf) 85 hz shift 16 channel fsk fdm ssb used to carry 100 wpm
weather circuits; sometimes special fdm transmissions to particular fleet
units could be found with AP or UPI broadcast wires (from either Baltimore Md.
or Norfolk Va.) on at least one tone. From time to time the UPI low speed
A newspaper wire would be included also. In all cases these channels would
be 7.42 (or 7.50 for AP) unit baudot code start stop at the same baud rate as
they are on the wire services themselves. More recently it has been reported
that certain hf fdm mux tty transmissions carry a 100 wpm AFRTS circuit which
retransmits national news from both the AP and UPI radio wires slightly
delayed.
It is presumably true that the signals were transmitted on hf just
as they came off the wire so as not to compromise crypto security by
broadcasting an encipherment of a known text. Perhaps if the Navy supplies
the same stuff to it's (larger) fleet of ships these days it also sends it
in the clear on the fleetsatcom psk broadcasts that are now the primary
method of transmitting to ships at sea ?
I've always assumed that nothing else on the Navy fleet transmissions
including the most routine UNCLAS stuff was breakable by an amateur (or even
most governments), as I suppose it is enciphered by more or less the same
crypto as used for high security stuff but set up from another key list.
It is true, however that US low speed tty crypto systems use a start-stop to
synchronous transceiver (more properly isochronous as no separate clock is
transmitted) and it is at least remotely possible that certain very routine
unclassified traffic is transmitted in synchronous format without benefit
of a real key from the key generator (perhaps some simple sequence is used
simply to keep transition density high for the clock pll). (If anyone knows,
and can say anything about low security modes for unclassified traffic
I would appreciate hearing from them.)
The uhf satellite transmissions are relatively high power (nearly
whole transponder) signals on various frequencies between 249 and 261 mhz,
they carry a 24 hour a day 15 channel time division multiplexed stream of
mostly crypto circuits. The multiplexing is straight tdm with a 16 bit wide
frame, each frame consists of a framing bit and one sample (bit) of each
channel sent sequentially starting with channel 1. Frame sync is obtained by
detecting and locking onto a continuously repeating pattern in the 16th bit
position of each frame. 1200 baud divided by 16 yeilds a channel bit rate of
75.0 baud which is the standard rate for 100 wpm enciphered baudot tty
traffic. It appears that the 1200 baud rate is exactly that (out to
several places) so no bit stuffing is being done (understandably enough).
The modulation is differential diphase mark (phase shift of 180
degrees for every mark (one bit) and 0 degrees (no shift) for every space
(zero bit)). Recovery of the data requires little more than a simple Costas
loop to recover the bit stream, and a bit clock recovery circuit to regenerate
the 1200 baud clock. TDM frame and bit clock recovery could be easily
implemented using a Zilog 8530 SCC chip which incorperates a transition
tracking digital phase lock loop. The 8530 SCC chip could be fed data
directly (after a schmitt trigger) from an in-phase phase detector
on the Costas loop, as it has a NRZI mode which will allow it to recover
data as it would appear at that point. Obviously the 8 bit data coming
out of the SCC would represent alternate halves of the 16 bit frame,
and would not necessarily be in frame sync.
The signals are powerful enough so a modified scanner (or one
of the new scanners which cover the military uhf band) ought to suffice
as a receiver, although the best reception might be had with a down
converter and a hf receiver with medium (say 4 or 8 khz) if bandwidth.
The Costas loop would connect to the receiver at it's low IF (455 khz for
most receivers and scanners) after the selectivity to reduce the noise
bandwidth. Antenna requirements are pretty minimal, but a small crossed yagi
or helix aimed at the right point in the sky for the particular
satellite of interest would be ideal.
Has anyone explored these signals ? Are there any other military
satcoms (say the X-band DSCS spacecraft) which carry readable traffic ?
--
David I. Emery Charles River Data Systems 617-626-1102
983 Concord St., Framingham, MA 01701.uucp: decvax!frog!die