|
|
|
|
|
|
|
Crypto AG Voice BND CIA CRYPTOVOX →
The device was intended for use on short and medium range VHF radio links,
such as the ones used by military reconnaissance units, and came in two parts:
A large 500-channel VHF radio set
with digital frequency selection, and a half-hight
digital voice encryptor, mounted to its bottom.
A selective call system allows
Up to 81 users to be addressed individually, in nine separate groups.
The complete kit is shown in the image on the right.
The set was mounted in a metal frame, suitable for vehicle use,
or in a canvas webbing kit,
allowing it to be carried around in the field.
|
|
|
The transmitter has an output power of 3W or 20W in the VHF-L band,
and is ideal for use in short and medium range military reconnaissance
networks, and high-security governmental communications, for example
in police investigations, or in foreign embassy communications.
CSE-280 was the first
voice encryption product
made by Crypto AG.
It uses Delta Modulation and true digital encryption – based on
shift-register technology – that was developed at the German
Zentralstelle für das Chiffrierwesen (ZfCh)
in Bad Godesberg (near Bonn, Germany). It contains an exploitable
weakness (backdoor) that makes it readable
for ZfCh
(and later also NSA). The device was used by the armies
of several countries, including Syria (see below).
A secure (unreadable) version was developed in 1976.
The CV-096
was succeeded in 1976 by the smaller
CVX-396.
|
 |
-
At least two versions of the cryptographic algorithm exist: the
initial one, developed by ZfCh,
which is readable, 2
and an improved one, developed in 1976 by R&D chief
Peter Frutiger, which is unreadable.
-
The term readable means that the algorithm
could be broken by ZfCh.
Also known as friendly or insecure or exploitable.
In contrast:
algorithms that are not breakable by ZfCh,
are called unfriendly or unreadable.
|
The diagram below shows a complete CSE-280 system, mounted in a metal
frame with rubber shock-mounts, ready for installation in a vehicle.
The set is powered by the 12V or 24V battery of the vehicle, which
should be connected at the rear. All other connections and controls
are at the front. The set is enabled with the POWER selector on the
transceiver (OFF, Stand by, 3W or 20W), whilst the desired mode of
operation (plain, crypto or repeater) is set with the MODE selector.
Three thumbwheels are used to select any of the 500 available channels.
Furthermore, two thumbwheels are used to select a remote address.
The first digit selects the group, whilst the second digit sets the
sub-address. A '0' selects all users in that group (e.g. '80'),
whilst '00' is used for a general broadcast. The local address is
defined by a code-plug (43 in this case).
The lower unit is the actual voice encryptor. It is powered by the
transceiver, via a short cable at the rear. Data is transferred
via another short cable at the front panel. The encryption key is
set with 8 thumbwheels (108 possibilities). In addition,
a family-key can be set internally, providing a total key space
of 1032 possibilities. A total of four keys can be stored in the
internal memory.
|
Development of the CSE-280 was started in the late 1960s, at a time when
the company was still owned by its founder,
Boris Hagelin. But as there were
strong ties to the American and German intelligence services, it was decided
that the German cipher authority – the
Zentralstelle für das Chiffrierwesen (ZfCh) –
would design the cryptologic
(the part that holds the crypto-algorithm).
It was developed in parallel with the
MCC-314 bulk encryptor,
which uses a similar cryptologic
[3].
The device was made with help from Siemens and was introduced
during the course of 1971.
The algorithm had a built-in weakness that was designed by experts at the
ZfCh
[3].
It made the device readable to them (ZfCh) and later – after
Crypto AG had been purchased by the
BND
and CIA – also to the American
National Security Agency (NSA),
giving them an obvious advantage.
But in late 1976, the NSA suddenly discovered that they were no longer able
to read intercepted traffic from the Syrians. Apparently the Syrians had
become aware of weaknesses in the algorithm and had complained to
Crypto AG, where head of the R&D department – Peter Frutiger –
provided them with a fix that caused it to become unreadable
(unexploitable).
Frutiger got fired for this [3].
➤ More history
|
The vehicle variant of the set – mounted in a green metal frame –
was supplied in a wooden transport case, with metal grips at either
side.
When the set is not used for an extended period of time, or when it
is stored in a depot, it was generally stowed in the wooden
container shown in the image on the right.
|
|
|
The image on the right shows the SE-035 VHF transceiver and the
CV-096 encryptor, mounted with four rubber shock-mounts in a green
metal frame, ready for installation in a vehicle.
At the rear is a canvas pocket in which the accessories and
cables can be stored.
The set can also be removed from the frame and
placed on a desktop,
in which case a metal bracket at the bottom of the lower unit,
allows the set to be tilted.
|
|
|
The largest of the two units is the SE-035 VHF transceiver.
It provides 500 channels with a channel spacing of 25 kHz
in the VHF-L band, between 29.3 and 41.7 MHz, although other
frequency ranges were available on request.
The transceiver has a selective call system that allows up to
81 users, in groups of 9 users each. The address of the local
station is contained in a code plug, whilst the address of the
remote station is selectable with thumbwheels.
|
|
|
The actual encryptor is a separate unit, known as CV-096,
which is usually mounted to the bottom of the transceiver.
It is connected to the radio by means of
two short cables:
one at the rear that provides power,
and one at the front that carries the digital data to and from
the encryptor.
At the start of a transmission (i.e. when the PTT is depressed)
the encryptor generates a new unique sequence, to which the
other end must synchronise before speech is reproduced.
|
|
|
The transceiver is usually operated with the handset shown in the
image on the right. It is connected to the transceiver by means of
an 8-pin LEMO connector that mates with the handset socket on the
front panel of the transceiver.
The handset has a built-in Push-To-Talk switch (PTT) in the grip,
that has to be pressed to enable the transmitter.
|
|
|
The transceiver does not have a built-in speaker, and relies on
an external handset, such as the one shown above, or a headset,
or the external speaker, shown in the image on the right.
The speaker can be used in combination with the (optional) handheld
microphone. It can also be used in combination with the handset,
as an additional monitor.
|
|
|
All interconnections between transceiver and encryptor,
and connections to the peripherals, are by means of high-quality
connectors from the Swiss manufacturer LEMO, as shown in the
image on the right. When unused, they are stowed in a canvas
pocket at the rear.
A thick cable provides power from an external battery to the
transceiver, whilst a short one loops the power to the encryptor.
At the front, another loop cable connects the encryptor to the
data socket of the transceiver.
|
|
|
Frequency 29.3 - 41.7 MHz Channels 500 Spacing 25 kHz Bandwidth 6 kHz ±3dB Modulation FM Impedance 50 Ω Output 3W or > 20W Sensitivity < 0.7µV Power 12V or 24V Current 12V: 1/4.5A, 14V: 0.5/2.2A Dimensions 375 x 240 x 100 mm Weight 8 kg
|
Modulation Modified multi-level delta-modulation Clock 9600 Hz Variations 1032 Keys 108 Power 12V or 24V Current 12V: 1A, 24V: 0.6A Dimensions 375 x 240 x 70 mm Weight 5 kg
|
- Headset
- Handset
- Speaker
- Handheld microphone with PTT
- Remote control unit
- Telephone dial adapter
- SWR meter
- Rod antenna
- Mast antenna
- Car mounting kit
- Power supply unit
- Portable battery
- Repeater adapter
|
-
Retrieved from HAMFU History, December 2018.
|
|
|
|
Any links shown in red are currently unavailable.
If you like the information on this website, why not make a donation?
© Crypto Museum. Created: Wednesday 01 January 2020. Last changed: Saturday, 25 April 2020 - 05:28 CET.
|
|
|
|
|
