Re: 6-hour Secure Mobile Voice

["Dave Emery" <die@pig.die.com>]

Christian Odhner writes:
> 
> I'm sure most of you have seen some of the cheap (relatively speaking) 
> 'phone scramblers' and such sold in local "spy shops" and catalogs. I 
> know as well as most of you that these (almost always analog) scrambler 
> systems even with thier "10,000 code frequencies!" and such are totaly 
> insecure against an attacker with modern resources, but I was wondering 
> if any of these techniques would be good enough to use for real-time 
> applications where the transmitted data is only valuable for 6 hours or 
> less.

	The simplest of these devices is the single band frequency
inverter.  It operates by mixing incoming voice with a carrier (usually
around the top of the voice band) in a double balanced mixer and sending
the resulting spectrum down the wire.  It is not secure at all against
anyone with very simple and widely available equipment - at most it
would take such a person a few seconds to find the carrier frequency. 
And as any ham will tell you, it gets pretty easy to understand inverted
or off frequency speech with practice.   Most of the really super
cheap (under $50 or $100) scramblers are of this toy type.

	A more complex varient of this is the multiband or split band
inverter.  This was allegedly used early in World War II for medium security
communications.  It operates by splitting the voice spectrum into
several frequency subbands and swapping those subbands around according to
a pattern determined by a key.   Masking tones or noise may be
added in some of the bands to make understanding harder.  Scramblers
of this fixed shuffle type can generally be broken easily with DSP techniques.
They are not common as current day products.

	A modern varient of the multiband shuffling scrambler has been
used by the US government for low security communications until recently
(as the KY-65 Parkhill system).  This rolling code scrambler shuffles
the voice subband components dynamically several times a second under
control of a psuedo random sequence determined by a key and plays some
of them forward and some backwards from digital memories.  This system
requires much cleverer real time DSP signal analysis software to break
than the fixed shuffle of world war II stuff, but allegedly some
amateurs were able to recover intelligable speech from it without
knowing the key sequences.  There are lots of commercial versions of
this type of scrambler available all over the world - they run from the
low hundreds of dollars to the low thousands.

	Given an attack based on making a best guess as to specific
phonemes and phomeme sequences from a particular speaker rather than
trying to crack the psuedo-random shuffling sequence, speech from such a
device could probably be rendered intelligible in seconds to minutes
using modern high perfomance DSPs and fast workstation processors and
very clever software, but of course the software to do this is not
widely public and the results are probably highly variable and speaker and
signal quality dependant.  In general, the availablity of high
performance processors and better speech recognition algorithms makes
this approach more and more possible in shorter and shorter amounts of
time. 

	Cracking the psuedo random sequence used in rolling code
scramblers is a more classic cryptologic problem and varies greatly
in difficulty depending on the particular design.   This might take seconds,
minutes or many days depending on what generates the sequence and how much
"plaintext" can be recovered by signal analysis.  Obviously once cracked
the speech can be recovered in real time using simple gear.

	
> Such a system would be usefull if you only need security 'right 
> now' and didn't care who knew after a certain (short) timeframe. 
> Comments, advice and product reviews are all welcome from anyone with 
> knowledge or experience in the area.
> 

	My advice would be to use one of the digital scrambling technologies.
Lots of surplus US government DES equiped HT's are available if radio
communications are your purpose...

(signature under construction)