Digitally encrypted Walkie-Talkies for unlicensed (illegal) short range private group communications 

Taking a concealed firearm into a federal building is “very illegal”, using encryption on an unlicensed amateur radio band is merely just a little bit “naughty”.

@@Heathfx5 our government is so afraid of people taking back power that is why they have these restrictions in place. Is not about national security. Is about their security for the crimes they have committed against us all.

​@@Heathfx5and a sense it's encrypted nobody can hear you anyways

Depends on how you use it. If you have business license frequencies you absolutely can use that.

Anything FREE or that cannot be taxed and easily duplicated is always frowned upon... Where's your capitalism hats? Thanks for the video. Appreciate you duly

Not true. They are legal on 900 MHZ only. Per part 15 compliance here is a link to one. www.buytwowayradios.com/motorola-dtr600.html?fee=5&fep=4705& They are programmed pretty much the same as this one. Just really expensive for most.

@@lokicam1307 I agree, but just wanted to save myself from the bootlickers in the comments.

@@lokicam1307 Wow, so not submitting to your anarchistic dreams is now "licking the boot". Almost as if it was in the interest of society to manage and protect limited public resources.

@@lokicam1307 Not sure if you're kidding or actually deranged. I bet no speed limit for you, too.

Will the anytone encryption work with this TYT unit?

@ Encrypted messages take up no more bandwidth than unencrypted messages.

Tyt radios have a scramble function. As long as you and whoever in your group set the scramble nobody can figure what you are saying

That's awesome news :)

@@toysareforboys1 Would you still recommend this method/technology in 2020? I'm wondering if the DMR encryption, whatever it is, is really secure. Nothing against the Chinese. I just want to be safe :) But these days who knows who you should trust. Maybe the Chinese :P

DMR Encryption is terribly insecure. Due to synchronisation issues inherent in radio use, the same XOR pattern is used for every packet. It may look like a 256bit key in the software, but it's really not. In actual fact, it's trivial to decrypt the standard encryption you'd find on DMR radios. Can you MAKE it secure? Yes... you can build a very secure system on top of DMR infrastructure, but it takes a lot of work. Having your Digipeater broadcast entropy on Slot 1 allows radios to synchronise a true 256bit rolling key in it's broadcasts on Slot 2 ... ... yes, this requires messing with the radio firmware and the repeater software, but it does result in a very high security DMR infrastructure. Unfortunately, it's also very much against the terms of your license unless you have a specific NoV or are operating under a part 90 license or franchise.

It is legal in the US only for 900 MHZ. It is just a PM signal. Spread Spectrum or otherwise kn own as frequency hopping.

@@VickyGeagan so your saying it is the "same" Frequency Hopping that say the Motorola DTR series uses? I was considering the TRT as more cost effective option but didn't want to loose the Frequency Hop provided by the DTR radios.

Then how will gov't eavesdrop to gossip about you and your friends?

People who can make money off licensing, they simply can't make money anymore. That's the harm. It's not a real harm, but harm nonetheless, for them at least. I couldn't care less, pirate all the way

Criminals will use such a feature to commit crimes.

@@johnoriel4241I don't thinks so. Do You see Gang bangers or other criminals using radios now, or ever? Bottom line criminals are not going to have the patience to learn how to use them.

​@@johnoriel4241You could say this about any form of cryptography. However, it more often used to prevent crime, like encrypting your debit card information before broadcasting it across the internet to Amazon.

Maybe it's just speech model lossy codec, so a buch of noise results into speech-like sound

@@uis246 No, the point is that it still contains amplitude of the sound, so you can hear when someone speaks something. That's very sus

Wouldn't there still be a packet modulation?

@@rogo7330 I agree, the encryption doesn't seem fully implemented. If you compare this output to encrypted P25 or DMR it's night and day the difference.

@@zforce69 So do you mean that this video was made by glowies to spread misinformation?

Voice scrambling can be defeated in real time.

​@@oliverallen5324what about the encryption shown on this video?

Turkey Talk, love it, thanks for the info!

toysareforboys does this software only work for the phone mentioned?

@@cwells9864 It was provided by the manufacturer of the radio so I assume it either only works with this radio or possibly other TYT radios. I have not tested it with any other radios.

APRS is now legal in the US for GMRS use starting January 1st 2022. It allows for very short text message packetts.

@@VickyGeagan I saw a few headlines lately but haven't ran it down for details on Radio Reference, MyGMRS, FCC, etc. Thanks for the recent update. :)

What happens with remote monitoring I wonder? It would suck if someone sent remote monitor command and it started to eavesdrop in the clear

One of the advantages to living under a bridge is that if somebody wants to hand you a million dollars they don't even have to knock on a door.

@@waytospergtherebro I was just giving one of the reasons why text messaging is not encrypted. It's simply so the group has a pathway to send a message should someone have the wrong key or something else goes wrong with encryption.

Mind explaining how?

@@rzr2ffe325 I simply followed the steps in the video, since my Retevis 3S pair are the same radios as the TYT MD 380. The things to pay close attention to is creating a unique talk group for encrypted and it must be in the 2000s, Example 2540. Also the radio IDs , receive groups, must be paid attention to.

Can you use this band for encrypted digital communications in Australia?

ya but they took ur guns away

@@HircineDaWolf You guys have guns and you are too chicken sh1t to overthrow your own horrendous government. keep talkin out yer @ss

YES! Biden will destroy the world! We need radios to communicate between our doomsday shelters!!! You are a hero!! THE TIMES ARE HERE!!! THE END IS HERE!!! 🇺🇸🇺🇸✝✝

Just remember, Illegal does not equal immoral. Its a bunch of people deciding what you are and aren't allowed to do

@@Fanta.... YEAH THE GOVERNMENT IS CORRUPT! ALL POLITICIANS ARE CORRUPT! ASSEMBLE AND FIGHT! 🇺🇸🇺🇸 FALSE FLAG EVENTS ARE HAPPENING! BLM WAS THE START!! THE BORDER HAS FAILED!! HUNTER BIDEN LAPTOP!!! 🇺🇸🇺🇸

Any updates?

I am not sure it is legal in the US on 900 MHZ license free only.

Without connecting them to repeaters, from inside a commercial building to inside a house I tested them with the stock antennas (the long one it comes with) at 587 meters/1928ft through a mixed commercial/residential urban environment and the quality was perfect, sounded like we were standing right beside each other. The elevation profile was pretty optimal (i.e. no hills between the radios). I have not tested them in open space. GPS capture of the test: toysareforboys.com/dmr_distance_test.jpg and I purchased the radios from aliexpress: (cheaper one is without GPS, both come with programming cable) www.aliexpress.com/item/33042284582.html

what dos the offset do? and how do u know which # offset it uses, besides going on the repeaters website? can u scan for offset from the radio itself??

@@tylermulkey330 The offset allows the radio to use repeaters. Most VHF amateur repeaters in the US use an input frequency that is ±6.00 KHz from the repeater's transmit frequency. You can find the input frequency by listening above and below the repeater's output frequency by 6KHz for any stations calling in to the repeater. I have an MD-UV380 and can't scan for the offset using the stock software.

Can u elaborate on this please? is it easy to decrypt?

@@basedkorean6237 PT xor KS = CT CT xor KS = PT

@@rfi-cryptolab4251 Well what does work then? :-/

Our group has been experimenting with more secure firmware, for passing sensitive information as an assist to the emergency services. One really cannot blame TYT for their weak crypto! Unfortunately there's an obvious de-synch problem with keystreaming... The error rate, the likelyhood of 'missed transmissions' and the multi-user problem each combine to make a streaming key impossible in practice. Obviously, a 128bit static key wouldn't much more secure than a smaller key, as you can still break it a chunk at a time. But even rotating through the key-space you introduce errors if a user tunes a transmission midway. So, at the end of the day our initial prototype firmware just wasn't practical. We didn't bother working on a version which uses all 128bits per chunk (not a simple XOR) because, again, it's largely security through obscurity. It still offered no real added protection over XORing due to the issues outlined above - which is why we didn't bother. Basically, you really need to solve the de-synch issue to get a more secure system. However... There is one strong solution for high security comms in DMR, and that is to add a nonce in the protocol. Unfortunately, there isn't space in the slot for additional information, so you have to get creative. The firmware we're currently working on addresses this. Basically, we're using TS1 for a random nonce, followed by voice data in TS2... then creating a 64-bit hash using the TS1 nonce with the 128 bit key... this is the only way to ensure non-trivial cracking whilst not worrying about synch. The handset does run a little warmer due to the higher duty cycle in talkaround. We hope to add a second 'infrastructure' mode, where a repeater can be made to broadcast a public nonce over TS1 whilst handsets use only TS2 for transmission. This will bring the transmit duty cycle back down to 50%, but will require a change to the repeater and backhaul network _(when listening, the repeater must broadcast random nonces... but when relaying, it must also replay the relevant nonce received from the remote repeater)_ We have only implemented the ad-hoc version in firmware at present, but infrastructure mode is the next step as we'll need that. Currently, this firmware is causing a slightly increased error rate, but we think the code just needs tidying up... it looks like it's due to timing sometimes being thrown off by the decoder, however it's a very borderline issue and either optimising the code or simplifying the hash should be enough to get it back on track, so we're expecting to have a very nice non-trivial crypto-system up and running in a month or two... followed by secure infrastructure later in the year. Currently the project isn't open as it's not permitted and we don;t want to be seen to be encouraging licensing breaches - but, if there's sufficient interest from relevant groups, we may make it available. I should point out that we have a UK home office NoV on our licenses, which allows for encryption on the amateur bands... as well as some limited operation outside of the amateur band. Anyway, I hope that spreads some light on why the default encryption is so poor, and what improving it entails. 73's

@@kelso7779 Well, it's difficult for a number of reasons. Firstly, there isn't really any robust standard defined in DMR... so, instead, each manufacturer has created their own system leading to a complete lack of interoperability. This is usually by design. In truth, only Motorola and Hytera have made any decent in-roads into strongly encrypted DMR. I'll dig out Motorolas MotoTRBO encryption patents and paste them into this post. If you're reading this and there's no links, I haven't gotten around to it yet ; ) But note that this is NOT how the TYT Encryption works... TYT's method is barely even an encryption, more a simple obfuscation. Other radios need to be modified if you want a reasonable level of encryption - as opposed to mere privacy. Generally speaking... If you make a private call (whether direct or through infrastructure), then both parties "could" use a call setup which provides for a Key Agreement protocol. This is a two way "call and response" system in which two radios can establish a secret to use as a key. This works fine. Unfortunately, though, you cannot use a Key Agreement protocol in a one-to-many broadcast. This presents a problem as the majority of use cases involve broadcasts. So, in practice you have to agree a static key beforehand. Next, there's the matter of how you use the key. AES and 3DES would seem like strong choices for commercial operation... but a single bit of error renders an entire frame indescipherable. Fixed point-to-point links can cope with this by having low error rate - but HT's, by their nature, tend to be mobile and suffer non-zero error rates. You could mitigate the error-rate if you were sending non-realtime data as you could simply request lost frames by number... but immediate voice modes cannot do that... lost frames are lost forever. So, AES and 3DES make for very strong encryption, but make for a very fragile communication system. So, many manufacturers use XOR rather than encryption... as this prevents a bit error from destroying an entire frame. They also tend to use a static pre-programmed key, as this permits one-to-many operation. XOR would be fine with a rolling key - but rolling keys only come in three flavours... 1. Time-based ... requiring each radio to have a real-time clock, or; 2. Based on message data ... requiring perfect trransmission (or, at least, that any transmission error be recoverable) 3. Externally provided at intervals ... but this usually requires either infrastructure, or some out-of-band frame (like moto's superframe) Hytera and Motorola have two systems available. Basic and Advanced. For example, Moto users can use a form of DMRA AES with a LOT of clever patented twists to the DMR protocol, but in practice most users of these radios find that basic mode is required for resilience. Motorola's DMR Encryption, OTAR and their superframe key-cycle patents.. patents.google.com/patent/US8422679 patents.google.com/patent/US9351157 patents.google.com/patent/US8781132 patents.google.com/patent/CN106878277A/en patents.google.com/patent/CN102307075A/en Of course, we're looking at TYT radios... TYT use a pre-shared key of which only a few bits are used... the same bits of the key are re-used for every frame and they never change. They also use XOR as their "encryption" algorithm which IS NOT suitable for use with a fixed key - but which allows bit errors to glitch the audio, but leave it otherwise intelligible. This means that TYT radios can be trivially broken by employing statistical methods across a number of stored frames, discarding values that do not produce smooth gradients in every frame. As keys are rapidly discarded you are left with thousands of contenders which a human operator can quickly cycle through looking for some intelligibility. Fortunately, the audio will become intelligible before the key is properly resolved - and, once a contender is found, any incorrect bits can be identified by regular periodic glitches in the gradient, that occur in the same part of multiple frames... so, the contender key can then automatically "home in" on the correct values for it's bad bits by trying to incrementally normalise ill-fitting samples with their neighbours. Over many frames this results in a usable key. So, TYT is not great for encryption. It's more an obfuscation strategy. It is possible to make a very secure and resilient radio out of TYT hardware though, which I pointed out in the previous post... although, to overcome the problems inherrent to DMR you need to be quite inventive. The most robust solution we've found uses infrastructure mode to keep the radios supplied with a steady stream of synchronised entropy. Fortunately, the two-slot nature of DMR allows the repeater to stream entropy over slot-1 which the radios transform using their fixed key, and then employ in their communications on slot-2. As a single frame of entropy, modulating a fixed pre-programmed key, can provide enough unique XOR-key material for four slots worth of TX/RX... it is possible to make this system more robust by repeating the entropy four times. This allows us to use a hashing scheme which is NOT fault tolerant... as four repeats allow all but the very worst signals to be recovered ... and, let's face it, if the error rate is 50% or higher, the keystream is the least of our problems anyway ; ) This allows a robust XOR-based encryption scheme at the cost of one infrastructure slot. Wishlist... What would have been be nice would be if the radios had a real-time clock. Then the RTC could be used to produce rolling, synchronised and key-derived entropy in a similar manner to TOTP access cards- and any clock drift in the users HT's could be prevented using a simple 1-frame message sent only periodically, perhaps whenever there was a gap in slot-1 or slot-2. If I were redesigning the TYT for our own nefarious purposes, I'd definitely add an RTC to fix the encryption issues! Just that one simple addition would allow for very highly secure ad-hoc and infrastructure operation, in both private and broadcast message modes. There is probably enough space inside the case to add an RTC module... if it could be added into the serial peripheral interface and solve all of the encryption problems inherent in these radios. Although... for our purposes, it's better to solve this in software and leave the hardware undisturbed as our members bring their own equipment : / Firmware changes can be undone... performing open-heart surgery on their HTs may make our members a little antsy ; ) So, we'll be sticking with our single-slot 'infrastructure based' security for now... at least until we have time and funds to explore/provide code-synchronised HT's and reclaim slot-1.

I'd imagine it'd be illegal to transmit. It only works on digital radios (DMR and the like) that support encryption.

@@toysareforboys1 another question. Is DMR relaible radio works on internet.or antena.? Becaus its worsless when it all shuts down internet and cellphone network. Thats why prepping is all about. To use old fasion analog radio comunication.

@@elio9207 I've only used DMR radio to radio, no repeater antennas, no internet. DMR works the same as analog radio as far as repeater towers goes, but can also use internet repeaters.

@@toysareforboys1 oh okej. Im from sweden. So it means if i order couple of radios with encrytion support.. have not to be the model as in you video... Couple radio for the whole family. And programing encrytion as you did. Then it will be a private communication with the DMR radio and using repeater tower.to communicate. And would work if all shuts down.as an analog radio? And all of that its legal.?!

@@toysareforboys1 okej as i understand. .. the DMR radio can work with talk group encrypted if internet shuts down.? It doesnt matter it will work through Analog antea/repeaters localy.?

The BTech6x2 and AnytoneD878 are the same radio, just minor marketing and firmware differences.

Will be compatible with retevis, not sure about anytone

check when u buy it in amazon should say dmr and analog

Yes if they are P 25 their analog compatible and only for license free use on 900 MHZ in the US.

@@VickyGeagan P25 900 MHz is not DMR.. not even the same at all

It’s probably too late but yes, you need a talkgroup, you can’t just transmit in digital without a TG but you can just type in a frequency

@@jakemccain9825 is there a radios that does that you recommend?

Still works ;)

Correct. But i doubt the FCC really cares unless they get complaints about you interfering with legit comms.

@@jeepinbanditrider The FCC doesn't but zealous ham radio dudes will track you down. Encryption isn't permitted on the ham bands and some people have enough time in the world. I'm a legit ham operator but I'm not against encryption.

I'd probably look at operating outside of the ham bands. DMR is not allowed on MURS but encryption is. So you could set up simplex on MURS channels with encryption keys. If you were to do DMRS and encryption on MURS, I doubt anyone would notice. Again, this is not designed to defeat the agencies with the time and money necessary to defeat the encryption this is to defeat Bob down the street with a scanner.

@@akivaliaho5166 laughs in transmitting at low power so that no one can see it unless they are close enough they knew it was happening

@@akivaliaho5166 All you have to do is operate in 902 to 928 MHz ISM band, this is the same as the US Amateur Band but if you run 1 Watt or less you are not operating as Ham but as unintentional radiator and can legally transmit Encryption, in fact Motorolla sells radios that do just that marketed as License free Business radios. I friend and I have a point to point link running two of those kinds of radios at 1/2 Watt with two Yagis pointed at each other's house and can legally use encryption. Anyone can.

So radios are legal if you are licensed for the band you intend to use. Anyone can apply for a GMRS license and pay the fee and use the GMRS frequencies. FRS radios are license free but are low power with fixed antennas and very short range. Getting your ham radio license is the best way to have lots of frequencies to legally talk on however you are not allowed to use encryption on any of these bands. Not ham, not GMRS, not FRS. In fact, its not legal to use digital DMR on GMRS. The idea of all this encryption stuff if that in a SHTF situation and the zombies are running the town. You may need encryption and guns and ammo and food to survive. You can be assure that the fighters in Ukraine are using strong encryption. You can't have you enemy knowing your plans. Don't let your encryption key get out either. Any encryption in an emergency situation is better than none.

No that is illegal unless public safety. For Digital they are only authorized on 900 MHZ.

@@VickyGeaganthey didn’t ask if it was legal…

Lots of FCC-approved FRS walkie talkies come with voice inversion scrambling from the factory. So I assume you're good to go? So long as you use one of the 16 pre-approved scramble keys.

IF someone had the equipment and technical skill the key would still take time to crack and time can be just enough. Make multiple channels with a new key on each one and you can set timing schedules with your group to switch channels for maximum effect. I think people see this use as a mobile setup not long-term and stationary .

Talk around is intended only for channels that have different send and receive frequencies used on repeaters. You should be setting your radios for simplex. Same transmit and receive frequency. Don't use talk around. I think it was a mistake he told everyone to use this setting.

@@brucekempf4648 thank you.

Thanks for the comment! I think the reason why each zone only holds 16 channels is because the channel selection knob only has 16 detents so they wanted it to match up. I'm not sure what the actual limit is but I was able to add over one thousand zones without issue. I've sold these radios and purchased the Retevis RT83 GPS 10 watt radios so I won't be able to do more testing on these ones.

any reason you switched or just ring out different radios?

@@mikemcdonald5147 No reason in particular. Specs look a bit better on the RT83. A rep from Retevis reached out to me on facebook (where I had also posted this exact video) and asked me if I'd like to try a set of their radios so I accepted. A local drug dealer paid me an absurd amount of money for my MD-390's so I let them go to a new home.

@@toysareforboys1 LOL ... Dealers with 390's ... those have got that pesky GPS feature ; ) Handy! PMSL

@What saith the scripture? Tytera TYT-MD390 has GPS function inside.

Rc4

You mean hardware encryption? Many.

32 characters, which equates to 256 bits.

It was provided by the manufacturer of the radios so I assume it only works with at least just this model, or maybe other models that TYT manufacture. I haven't tested it with any other radios.

toysareforboys do you know how could I get software that works with other models baofeng etc?

@@cwells9864 I believe CHIRP software works with baofeng radios irrc: baofengtech.com/download

How is who going to find you? You can click it over to regular analog, unencrypted, if you needed to call for help. The digital encrypted stuff is just for private group communications (which those people will already have the encryption key saved in their radio).

@@toysareforboys1 how would someone find me if im using encryption like the government since your not supposed to be using encryption couldnt they track you down is what im asking just curious

Just a Regular Guy Unless you’re talking and talking away or are on predicable comms windows and in a fixed location, you will probably not be located. Of course that is in a general sense, if “they” bring in electronics and comms experts you can probably be located just by transmitting. They have the capability to detect transmissions and simply remove the entire grid square in which those transmissions occurred by using an MLRS. That’s a bit extreme though 😂

Look up "ham foxhunting" if your group is exercising poor comms discipline anyone with a reciever, a compass, a map, and a yagi antenna could triangulate your position.

ARC4 is what it uses. I don't know what TETRA uses.

yep

@@toysareforboys1 you criminal you....

I updated the title and description to reflect the legal status of using encrypted radios.

I believe encryption on analog MURS is legal.

Brian Cameron You’ll get no argument from me on that front.

I think you are correct. Enhanced encryption is stronger that simple but the 256 AES is what the NSA uses so it better be secure. The Anytone or B-tech DMR radios offer true 256 AES commutable with Motorola

tons of people have the capability to notice you doing it, most of it is no one cares enough to do anything about it lol - though if you make it a big of enough problem for the FCC or whoever to care they'll be more then happy to fine you thousands of dollars lol

why will they catch you, no one uses radios any more

because tons of people use radios

​@randybird9979 hahaha. Yup no one. Stay on yer cell phone kiddo.

@@chublez I will

Yes. If you're still interested and haven't figured it out already, I'd be willing to help.

Yes

Wrong comm port selected or using the wrong cable.

This function is only needed if you are using a repeater. In communication from radio to radio in one set of frequency is no necessary.

@@fevo69 appreciate the info

This is my question as well.

You can only encrypt digital channels. The speech inversion is analog but can easily be inverted back to normal so is not as secure. Not everyone needs the highest level of security because most don't know enough or have the time and computer power to decode the encryption. It can take hours of listening and a super computer to find the keys so unless you are being hunted by the government you don't need to be worried

It's because you are not set to the right Channel or zone. You have your knob spun to a channel that you didn't create any data under.

If the two radios support the same encryption protocol, then theoretically yes. But the name-brands (Harris, Moto, Kenwood) probably have ways of making it more difficult through proprietary means.

@@TheEnderman67 not if it is AES or DES

Not if they are for 900 MHZ in the US. They do not scramble the transmission they are just P 25 Phased Modulation spread spectrum. They use what is called frequency hopping. That is what DMR radios are in a nutshell. They are legal for license free use in the US only on 900 MHZ.

@@VickyGeagan I have some questions basically I bought two md-390s to be able to talk to a buddy. I have no idea what I got myself into can you help please?

@Vicky Geagan Isn't that why LORA falls in that spectrum? What is the ecryption scheme used in this video then? That key looked pretty long that he used, is that not AES?

@@VickyGeagan Frequency hopping. This is a digital implementation of HAVEQUICK.

Millions of miles in a vacuum as long as it's line of sight. This is too complicated of a question. Water, foliage, terrain all impact path loss. Mountain top to mountain top, 40+ miles on the lowest power levels. Your question is about the same as "How far away can you hear a whisper". "It all depends" is the correct answer for any radio at or above VHF.

@@EricOsterberg Thanks, Eric! Oh, yeah, I'm aware some of my questions or statements are prone to be off limits in regards to interpretation. Sorry!

@@TheDailyMemesShow FRS has a limited legal power. Realistically you should only expect less than a mile in most situations (500 yards is a practical estimation). In theory with line of sight it can be as far as 50 miles, but you only get in that kind of situation in mountainous terrain transmitting from peak to peak or in the ocean. If you go into a steel building like a high rise, you won't get any transmission going inside/outside the building. This is why firefighters that need to communicate with guys outside put a repeater with antennas hanging out a window or something like that. Best way to know for sure is get on a bike and actually do a radio check with a friend and log the reception on a scale of 1-5 with google maps as reference.