The blackbag banner says: locks, encryption and the RF spectrum. These two last topics did not get much attention yet. It is not that I do not have a lot to tell about it, it’s just that locks take up all of my time and interest at the moment. That is why I decided to donate a big part of my encryption device collection to the (virtual) crypto museum. Just take a look on their site, it is really a great place that will give you an idea about the radio side of things of the field I am interested in, and that are the foundations of my work for GSMK Cryptophone.
I know the people behind cryptomuseum.com from some time ago. They are the same that asked me to make a working key for an enigma some time ago at a Toool meeting. What is real funny is that twelve years ago I had the same idea, and even registered the cryptomuseum.com domain for a couple of years. But hey, then I got so involved with locks and lockpicking that I decided to put my focus on that. But before that I was quite serious about is, and even made some audio samples of encrypted and decrypted radio scramblers. For now I will only post two samples of these analog scrambling devices. If you listen carefully to these samples, you might be able to get some words, or even part of a sentence. You can post your guesses (or decrypted wav’s) in the comments. I will post the ‘decrypted’ audio in a couple of days from now.
[…] Dit blogartikel was vermeld op Twitter door Huub Roem, Barry Wels. Barry Wels heeft gezegd: blogged: Cryptomuseum.com and my doniation http://blackbag.toool.nl/?p=1844 […]
Hi Barry, I think I have a roughly decoded audio file of the first example (and as thus decoded transcrypt) for you now 😉
I’m e-mailing it your blackbag.toool.nl e-mail, so as not to ruin the game early on 🙂
Scott.
Just got your e-mail Scott. At the first sample you indeed got quite far. Well done in such a short time 🙂
Nice job Scott! I wish I wasn’t at work and could join in the fun today. Second sample sounds like rolling code scrambling, this stuff is totally up my alley, glad to see this stuff on blackbag, and thank you Barry for sharing the museum link, very interesting stuff! =)
I’ll do with a guess: the first one uses frequency inversion. I am quite sure it is over some sort of trunking system, I hear databursts which sound to me like the Entropia network.
When I assume the tones starting at 23.45 seconds are DTMF tones I find a centerfrequency for the inversion around 880 Hz.
But I can’t find an audacity plugin to undo this, so I will have to leave it at this guesswork.
My guess is that the first example is a variable band inversion scrambler, a very slow one at that. It changes inversion point at around every 3 seconds. The Second example is defiantly of the rolling code variety but I’m not sure whether it’s extremely fast variable band inversion or split band variable inversion. I think it’s more likely to be split band variable inversion though as it sounds almost identical to MASC (Marconi Advanced Scrambler) as used to be used by the UK police and home office (interesting side note is that I believe it was custom built for them and wasn’t supposed to ever be public domain, until they decommissioned them and forgot to remove the encryption boards from some radios. I do believe the key loaders are long gone for them though and there was only around 12 different keys ever used).
I attacked the first example by isolating each ‘frame’ of 3 second audio in audacity and removing the sync bursts. I then ran each ‘frame’ one by one through a freeware inversion decoder until I found a good enough inversion point for it and repeated this for each ‘frame’. After I’d converted each one into clear I then pieced them back into Audacity and had a (very rough) clearspeech of it.
If Barry wants to he has my permission to put up my attack WAV file so you can see just how it was done.
It’s exactly up my street to, which is why I started work on it so soon 🙂
Scott.
Err.. what is a “doniation” anyway?
* Edit: Ok, changed doniation to donation. Thanks Koos 🙂
[…] Buckey mailed me the following on my little challenge to see what you could make out of two scrambled audio messages. Not a 100% score, but good enough […]
I have a mohawk 300 midget recorder, ( not so midget by todays standards) that has an old tape in it, the battery is no longer made commercially, but what would you trade with me for it barry? its something that may belong in that crypto museum.
Barry, Squelchtone?
Ray