Scanners
Comments ▾
Figures ▾

Decrypting — AES, DES & Motorola ADP on P25 (Scanners) · Volume 5

Decrypting — Vol 5: Capturing the Signal — Discriminator Taps, SDRs, and OP25

The old tap, the modern software-defined radio, and the wall between decoding and decrypting

Figure 1 — The capture chain: an antenna into the old discriminator-tap-and-soundcard path or a modern SDR running OP25/DSD+/SDRTrunk, both ending at the decoded P25 bitstream, then the wall of "do…
Figure 1 — The capture chain: an antenna into the old discriminator-tap-and-soundcard path or a modern SDR running OP25/DSD+/SDRTrunk, both ending at the decoded P25 bitstream, then the wall of "do you hold the key?". Original diagram for this site.

5.1 About this volume

This volume answers the questions most often asked: is it necessary to tap the IF line into a computer? Is an SDR like a HackRF required? The short version is that yes, getting at the raw digital signal is exactly what all of this is about — but it’s worth being precise about what that gets you, because the interesting part is where the process stops. Capturing and decoding a P25 signal is one thing, and any software-defined radio can do it. Turning the result into speech is a completely separate thing that needs the key. This volume walks the capture chain end to end and then runs it straight into that wall, which is where the honest answer to “can a local encrypted system be decoded?” lives.

5.2 The old way: the discriminator tap

Before software-defined radio was cheap, the way you got a digital signal into a computer was to physically tap it out of a scanner. A normal scanner’s audio output is processed for listening — de-emphasized and band-limited — and that processing destroys the four-level baseband that a digital decoder needs. So hobbyists would open the scanner and solder a wire to the discriminator output: the point right after FM demodulation, before any audio filtering, where you get the raw, flat, instantaneous-frequency signal. That wire fed a PC sound card, and software called DSD (Digital Speech Decoder) turned the baseband into decoded digital voice.

It worked, and for years it was how people decoded unencrypted P25 and other digital modes at home. It’s now largely a museum piece, because an SDR does the same job — flat, unprocessed baseband into software — without a soldering iron or a sacrificed scanner. The discriminator tap appears here partly for the history and partly because it makes the concept concrete: the whole game is getting the unprocessed signal to a decoder. That’s true whether the tap is a solder joint or an SDR’s USB stream.

5.3 The modern way: an SDR and a decoder

Today the front end is a software-defined radio — a receiver that hands the raw digitized RF to a PC and lets software do the demodulation and decoding. You point an antenna at the system, the SDR streams the spectrum to your computer, and a decoder program pulls out the P25 frames. No tap, no de-emphasis to fight, and — crucially for trunked systems — the software can follow the control channel and the voice channels itself.

None of this is exotic or legally fraught in itself. Receiving and decoding an unencrypted P25 signal with an SDR is the same activity as listening with a scanner, done in software. The legal and technical wall shows up only at the encrypted payload, and it shows up identically to how it does on a scanner.

5.4 Which SDR — and specifically, not the HackRF

Your instinct about the HackRF is right, and it’s worth stating plainly because the HackRF’s fame leads people to reach for the wrong tool. The HackRF is a poor choice for receiving narrowband P25. It’s a half-duplex, very wideband transceiver with an 8-bit converter, and its strengths — transmit capability, huge instantaneous bandwidth — are exactly the strengths you don’t need for sitting on a narrow public-safety channel and pulling clean digital voice out of it. Its 8-bit dynamic range actually works against you in the dense RF near public-safety sites.

The right tools are cheaper and better at this specific job:

  • An RTL-SDR (around $30) is genuinely sufficient for most VHF/UHF trunked systems. It’s the standard starting point.
  • An Airspy (12-bit) buys you real dynamic range, which matters for weak signals and crowded band segments near a busy transmitter site.

For receive-only P25 work, one of those beats a HackRF handily, at a fraction of the price. The HackRF is a fine transmitter-oriented experimenter’s tool; it’s just the wrong end of the toolbox for this.

5.5 The software: OP25, DSD+, SDRTrunk

Three programs cover the field:

  • OP25 (the Osmocom project, most actively the “boatbod” fork) is the main open-source P25 stack. It handles trunking, P25 Phase 1 and Phase 2 (TDMA), and TDMA control channels. It’s the serious tool, and it’s the one that matters most for the next section, because it’s the one that can apply a key.
  • DSD+ / DSDPlus decodes P25 Phase 1 along with DMR and NXDN; its paid “FastLane” tier adds P25 Phase 2 following, single-SDR trunk tracking, and detection of the encryption algorithm and Key ID.
  • SDRTrunk is a multi-channel trunking follower (Phase 1 and Phase 2) with good logging; it detects and records the encryption type but does not decrypt.

For unencrypted trunked systems, any of these turns an inexpensive SDR into a capable, computer-driven scanner — often a more capable one than a hardware scanner, because it can record and log everything at once.

5.6 The wall: decoding is not decrypting

Now the important part, the thing the diagram above is really built to show. Everything up to “do you hold the key?” is decoding — turning the RF into digital frames — and it is the same work whether the talkgroup is clear or encrypted. The decoder doesn’t need permission from the cipher to produce frames; it produces them either way.

What differs is what those frames contain. On a clear talkgroup, the frames are voice, and you hear it. On an encrypted talkgroup, the frames are ciphertext, wrapped in the clear metadata from Vol 1: the software shows an ENC indicator, displays the ALGID and KID (because they’re unencrypted), and the audio is muted or garbled. You have successfully, legally decoded the signal — and you have exactly nothing to listen to, because you don’t hold the key. This is the same place the scanner ends up. The SDR doesn’t get you past the wall; it just lets you see the wall in more detail — you can read the algorithm and key ID and watch the traffic pattern, which a stock scanner hides from you.

5.7 What OP25 does with a key — and the authorization that comes first

OP25 does have the one capability the scanners lack: it can be given a key and decrypt with it. The boatbod fork’s receiver supports ADP (RC4), DES-OFB, and AES-OFB decryption when you supply the key — you provide it in a small key file, matched to the Key ID, and the software applies it. This is the feature that makes OP25 legitimately useful to the people it’s built for: an agency or system operator testing and validating their own encrypted system, an amateur or commercial licensee working on a system they run, or a security researcher on a test bench they control.

The framing that OP25 itself uses, and the one this dive holds to, is the load-bearing part: the key is already held. OP25 does not recover unknown keys. There is no released, reproducible tool that pulls an unknown DES, ADP, or AES key off the air — as Vol 4 works through, that’s a place where forum lore outruns the public artifacts. So the honest end state of the entire capture chain is this: for a system whose key the operator is authorized to have, an SDR and OP25 will decrypt it, exactly as any radio on that system would. For a system whose key is not held — a locked-out local police system, say — the chain decodes to ciphertext and stops there, and there is no software step that changes that.

And this is the point where the technical line and the legal line become the same line. Decoding the signal is legal. Applying a key to traffic you are not authorized to hear is where legal decoding becomes unlawful interception under 18 U.S.C. §2511 (Vol 1, and the policy fight behind it in Vol 6). The tools don’t decide that; the operator does, by which keys they have a right to hold. For an ordinary listener, that means encrypted local systems stay ENC, on the scanner and on the SDR alike — the difference is only that the SDR makes it possible to understand why.

Sources

Comments (0)

  1. Loading…

Comments are held for moderation — nothing appears until approved.