Scanners
Comments ▾
Figures ▾

Decrypting — AES, DES & Motorola ADP on P25 (Scanners) · Volume 4

Decrypting — Vol 4: The Security Research — What Actually Broke, and What Didn't

The Blaze/Clark USENIX work, cheap jamming, weak legacy ciphers, and the AES wall that held

Figure 1 — What actually failed in P25 encryption (clear-by-mistake traffic, open metadata, cheap jamming, weak legacy ciphers, key leakage) versus what held (AES-256, and the fact that the key is …
Figure 1 — What actually failed in P25 encryption (clear-by-mistake traffic, open metadata, cheap jamming, weak legacy ciphers, key leakage) versus what held (AES-256, and the fact that the key is never transmitted). Original diagram for this site.

4.1 About this volume

This is the volume people are really asking about when they ask whether encryption has been “hacked.” The honest answer is the most interesting part, so it comes first, followed by the work: nobody broke AES. Every documented, real-world defeat of an encrypted P25 system went around the cryptography — through misconfiguration, weak old algorithms, key mishandling, open metadata, or the physics of the radio channel. That is not a disappointing answer on reflection. It’s the same lesson that runs through all of security: the math is almost never the weak point; the humans, the settings, and the legacy compatibility are. The best public research on P25 makes exactly that case, rigorously, and it’s worth knowing in detail.

4.2 “Why (Special Agent) Johnny (Still) Can’t Encrypt”

The landmark work is from a University of Pennsylvania group — Sandy Clark, Travis Goodspeed, Perry Metzger, Zachary Wasserman, Kevin Xu, and Matt Blaze — published as a UPenn technical report in 2010 and then as a USENIX Security 2011 paper with the pointed title “Why (Special Agent) Johnny (Still) Can’t Encrypt: A Security Analysis of the APCO Project 25 Two-Way Radio System.” The title is a deliberate echo of a classic 1999 usability paper, and it signals the thesis: this is a story about usability and operations, not cryptanalysis. Over roughly two years of monitoring in several U.S. metropolitan areas, the researchers found three things that matter, none of which involved attacking a cipher.

4.3 Finding one: “encrypted” traffic that wasn’t

The headline finding is the one that should worry an agency far more than any cipher weakness. The paper reports that a significant fraction of the supposedly encrypted traffic sent by federal law-enforcement surveillance operatives was actually going out in the clear — while the users believed it was encrypted — and that it sometimes revealed genuinely sensitive things, including the names of informants. Their companion mitigation guide describes intercepting “literally thousands of unintended clear transmissions each day.”

The root causes are pure usability. As the paper puts it, “all models of P25 radios of which we are aware will receive any traffic sent in the clear even when they are in encrypted mode. There is no configuration option to reject or mute clear traffic.” So a receiver in secure mode happily plays a clear transmission and gives its user no reason to notice anything is wrong. Worse, the encryption state is easy to fumble on the transmit side — a small switch, a mode that doesn’t survive a channel change, a radio that was never keyed — and a single misconfigured radio in a talkgroup drags the whole conversation into the clear, because the others will receive it. Encryption that a user can silently turn off by accident, with no feedback, is encryption that will sometimes be off. That is not a break of the cryptography; it’s the cryptography never getting a chance to run.

4.4 Finding two: the metadata was always open

The second finding follows straight from Vol 1: even when the voice is encrypted, the P25 packet’s addressing is not. The researchers noted that the identifying metadata — the systems, the talkgroups, the sender and receiver IDs — is sent in the clear, and specifically that the sender’s unit ID is “always sent in the clear, even for encrypted traffic,” because the optional link-control protection is essentially never turned on. That gives an observer traffic analysis for free: who is active, on which talkgroup, during which incident.

They took it a step further into an active attack. Because a radio will respond to certain link-layer messages, a suitably crafted transmission can provoke a target radio into automatically replying — turning it, in their words, into a “location tracking beacon.” Again: no cipher was touched. The attack lives entirely in the clear control plane that has to be readable for the system to function at all.

4.5 Finding three: you could jam it with a toy

The third finding is about availability rather than confidentiality, and it’s the one that tends to stick in people’s memory. The researchers showed that P25 can be jammed with a tiny fraction of the transmit power the legitimate users need — more than an order of magnitude less average power, using short bursts timed to the protocol — and, pointedly, that the jamming can be targeted at just the encrypted transmissions, which would push frustrated users back to talking in the clear. Their proof of concept ran custom firmware on a $15 toy “instant messenger” device marketed to pre-teens (the GirlTech IM-me, built around a cheap sub-GHz radio chip). A children’s pink pager, reflashed, could selectively disrupt a public-safety encryption system.

It is included here not as anything anyone should do — jamming is a serious federal crime, wholly separate from listening — but because it’s the sharpest illustration of the paper’s thesis. The weakest point in the system was never the AES. It was a protocol that let a hobby-grade transmitter deny service for pennies.

4.6 Weak legacy ciphers: theory versus a working tool

Alongside the operational findings sit the weak algorithms from Vol 2 — DES-56 and Motorola’s 40-bit ADP. A separate 2011 academic paper (Glass, Muthukkumarasamy, and colleagues, at SecureComm) worked through brute-force key recovery against DES-OFB and ADP on P25, helped along by a nice structural gift: P25 transmits idle/silence patterns at the very start and end of a call, which give an attacker known-plaintext “cribs” to test candidate keys against. So the theory is solid, and the weakness of these two ciphers is real and demonstrated as a method.

Here a distinction matters that the forums tend to erase. “The algorithm is weak, and researchers demonstrated a method” is true for DES and ADP. “There is a maintained, reproducible tool that recovers an unknown DES or ADP key live off the air, for anyone to run” is a different claim, and it could not be verified. The mainstream tooling — OP25 — decrypts only with a supplied key (Vol 5); it does not go hunting for unknown keys. The academic method is documented, and forum lore that “ADP was cracked years ago” is plentiful, but no clean, public, reproducible artifact that does unknown-key recovery could be found. So the accurate statement is: DES and ADP are weak enough that they should be treated as broken by any agency relying on them, and are within reach of a determined, capable adversary — but “weak in theory and academically demonstrated” is not the same as “here’s a program to download and run.”

4.7 Key management: the quiet failure

The last category is the least dramatic and probably the most common: keys that were never where they needed to be. A good share of the clear-traffic leakage the Penn group observed traced back to key-management failure — keys expired, unavailable, or never distributed, so radios fell back to clear operation to keep working. The papers flag over-the-air rekeying as operationally unreliable enough that agencies shouldn’t lean on it. And there’s a long tail of ordinary mishandling: surplus and second-hand radios that turn up with codeplugs and traffic keys still loaded (well-attested in the hobby community, though any specific story is best treated as anecdote). The federal government takes this seriously enough that CISA and the public-safety communications council published Operational Best Practices for Encryption Key Management in 2020 — a document that only needs to exist because misconfigured keying is a recognized, systemic risk. When encryption fails in the field, this quiet, unglamorous category is usually why.

4.8 The honest bottom line

Put the whole record together and it points one direction. Full AES-256 P25 has no known practical cryptographic break. Every real-world compromise has been operational: traffic sent in the clear by mistake (the dominant failure), weak legacy ciphers (an old-algorithm problem, not an AES problem), key leakage and mismanagement, plus jamming and traffic analysis that never needed the plaintext at all. You do not break AES to defeat P25 in practice. You exploit the configuration, the legacy ciphers, the metadata, and the physical layer.

And this is the reason the subject is genuinely worth understanding rather than just worth gawking at: read the other direction, every one of these “attacks” is a piece of defensive knowledge. The way an agency keeps its own sensitive traffic off the open air is by understanding exactly the failures the Penn group cataloged — turn on the clear-traffic warnings, protect the link control, manage the keys, retire DES and ADP, and assume the metadata is public. The research didn’t hand anybody a way into AES. It handed everybody a checklist.

Sources

Comments (0)

  1. Loading…

Comments are held for moderation — nothing appears until approved.