|
|
|
|
|
|
Time-division speech scrambler SV-11
The Cryptophon 1100 was a
time-division speech scrambling device,
developed by Brown Boveri and Company (BBC) in Switzerland around 1974
[3]
.
The time-division process introduces a delay of approx. 0.5 seconds.
The unit is compatible with the Vericrypt 1100 and can also be used
on telephone networks, although it does not have echo cancellation
on 2-wire networks.
|
In the late 1970s and the early 1980s, the Cryptophon 1100 was introduced
at many police and law enforcement agencies world-wide.
Examples are the German border police, the German Secret Service (BND)
and the Dutch police force.
The image on the right shows a Cryptophon 1100 unit. It is basically
a grey metal box, with two connections and a set of thumbwheels at the front
(covered by a sliding door). A separate breakout box was required for the
connection of the various perpherals, such as microphone, speaker and radio.
The unit shown here was used by the Dutch police for many years.
|
|
|
All connections and controls are at the front of the unit.
At the top left is the audio connector. It is a 12-pin DIN connector with
audio-in, audio-out, push-to-talk (PTT), etc. At the bottom left is the
4-pin DIN power connector. It takes 12V from a car battery or external PSU.
At the right is a black sliding door behind which the thumbwheels for setting
the daily key are hidden (below).
|
The cryptographic key is made up of two elements: the basic key, which is
fixed internally, and the daily key, which is set with the six thumbwheels
at the front.
The basic key can only be altered by opening the unit and replacing a small
printed circuit board (PCB) with a set of solder
links in a 5 x 12 matrix. It was different for each agency,
and was not changed very often.
|
The daily key can easily be set by entering a 6-digit number with the
thumbwheels at the front. A small sliding door hides the current setting,
so that the number cannot be read by a potential eavesdropper.
It also protects the switches against accidental changes.
The 6-digit number allows 106 combinations. It is used to 'seed'
the internal pseudo-random number generator (PRNG), which has a period of
approx. 8.5 hours. This means that the number sequence produced by the PRNG
does not repeat itself within 8.5 hours
[2]
.
|
|
|
During a transmission, a Frequency Shift Keying (FSK) signal is broadcast
with the speech, to allow the PRNG of the receiver to run 'in sync' with the
transmitter. This FSK signal takes the form of a 1830 Hz pilot tone (± 100 Hz).
At the start of a conversation, the system needs approx. 1.5 seconds to
'lock in'. During this time, no useful speech can be transmitted.
Most operators would count 'twenty-one, twenty-two',
before starting the message.
Once transmitter and receiver were 'in sync', the system would need only
0.2 seconds on a change-over. Because of the principle behind the type of
scrambling used by the Cryptophon 1100, all audio was delayed by 0.5 seconds.
This was considered a drawback.
|
Between 1978 and 1981, the Cryptophon 1100 and Vericrypt 1100 were tested
by a number of West-German agencies, such as the police, the Ministry of
Internal Affairs and the German Secret Service (BND).
They considered the system safe and between 1981 and 1982, a large number
of Cryptophon 1100 units were installed with the various agencies.
In 1983 the East-German cipher bureau managed to break the cipher by
reconstructing the keys from a series of intercepts.
They also built their own equivalent of the Cryptophon, called the
A-003,
that was used in the breaks. Another device, the so-called A-004, was
used to decipher the Vericrypt 1100.
As a result, they managed to read about 90% of the West-German
Cryptophon 1100-based radio traffic during the 2nd quarter of 1988
[2]
.
|
Considering its age, the Cryptophon 1100 is extremely well built.
Only first class components and PCBs are used.
The units consists of three main PCBs, all mounted on an extendible frame.
The image below shows the uncovered interior of the Cryptophone 1100.
|
The two digital boards are both mounted on one side (left) and can be folded
away from the frame. A small 3rd board is mounted to the inner board as some
kind of modification, that was introduced after the design was completed.
The analogue board is at the other side (right).
It contains 9 high-quality LC audio filters that are used for filtering the
FSK pilot tone and the audio.
The rear of the unit contains the power supply unit (PSU) that converts
the 12V of a car into suitable internal voltages.
The unit shown here was probably built around 1975.
|
|
|
|
|
|
|
|
|
|
The cryptographic principle used in the Cryptophon 1100, is of the type
time-division speech scrambler.
Speech is recorded (sampled) and divided over the time domain (scrambling).
The simplified diagram below, shows how this works.
Speech is cut into small time segments and is scrambled with other time segments
in an ever changing order. The order in which the packets are scrambled is
determined by a pseudo random number generated that is seeded by the setting
of the 6 thumbwheels at the front of the unit.
In this diagram, the top row shows the clear speech (input) in time.
The second row shows the speech after it is scrambled.
Finally, the bottom row shows the speech once it is descrambled again (output).
The whole process of scrambling and descrambling, causes a delay of approx.
0.5 seconds.
As the time segments are scrambled in an ever changing pattern, it is important
that transmitter and receiver are correctly synchronised. To ensure that both
ends are kept 'in sync', a pilot signal (FSK) is transmitted with the
scrambled speech.
|
Below is the blockdiagram of the Cryptophon 1100. The audio input is at the
top left. In transmission mode, audio is filtered, digitised and stored in
a temporary memory buffer. The order in which the samples are read out of
the buffer, is determined by the number generator (PRN). The new (scrambled)
signal is then converted back to the analogue domain again.
In order to allow the receiving end to stay in sync, an FSK signal (pilot)
is inserted in the output path.
In receiving mode, the synchronisation signal (pilot) is extracted from
the incoming audio signal (top left) and decoded. It is then used by the
program register (CPU) to keep the number generator (PRN) in sync.
|
|
|
|
Any links shown in red are currently unavailable.
If you like this website, why not make a donation?
© Copyright 2009-2013, Paul Reuvers & Marc Simons. Last changed: Friday, 25 March 2011 - 13:38 CET
|
|
|
|
