|
|
|
|
|
|
|
USA FILL SINCGARS
ECCM Fill Device
MX-18290 is an electronic transport device,
or fill device, developed in the late 1980s by
the US National Security Agency (NSA)
and manufactured by ITT. It was intended for loading Frequency Hopping
tables and Transmission Security Keys (TSK) into compatible devices,
such as SINCGARS radio sets.
Frequency Hopping (FH) is a security feature that belongs to the category of
Electronic Counter Counter-Measures (ECCM).
It is specific to SINCGARS and protects radio traffic
against eavesdropping and jamming.
The MX-18290 fill unit is also known as NSN 5895-01-270-3935.
|
The device is housed in a green die-cast aluminium encosure
that measures 180 × 87 × 40 mm and weights 632 grams (battery not
included). It resembles the KYK-13 fill device, but is
smaller
and cannot be used for loading Traffic Encryption Keys (TEK)
into an encryption device. Instead it is only suitable for
loading Transmission Security Keys (TSK) and Frequency Hopping tables
(FH-sets) into SINCGARS radios.
There are two 6-pin U-229 connectors (one male and one female)
that allows the device to be connected to the FILL socket of
the radio.
|
|
|
|
The device is powered by a standard military 6V battery that is
installed behind a watertight lid at the right side.
It must be renewed every year.
The MX-18290 has storage space for 13 Frequency Hopping sets (FH) and 2
Transmission Security Keys (TSK). Once loaded, the data is retained
in static memory (RAM) by the battery.
It is compatible with the NSA's
DS-102 interface standard.
MX-18290 was introduced in the late 1980's and was in production during
the early 1990s, after which it was superseded by CYZ-10,
which also replaces
MX-10579, KYK-13 and KYX-15.
|
The image below provides a quick overview of the controls and
connections of the MX-18290. The device is shown here with its
left side up. At the front and back are two U-229 conenctors
— one male and one female — that are wired in parallel. Either one
can be used to connect the device to a compatible radio. It is
recommended however, to use a short fill cable at all times.
Once a battery has been installed, the unit is turned on with the
MODE-selector towards the top. Towards the bottom is
a rotory knob to select the desired storage compartment (1-13, T1, T2).
At the center is the recessed INITIATE-button that must be pressed
to start a data transfer. Above the button is a check light that
will be lit when the parity check is successful. At the left side are
15 white fields that should be used to write the date for which a
TSK or FH-set is validated.
|
|
The following versions are known to exist. The differences
are currently unknown.
|
|
The MODE-selector has three positions:
|
OFF The device is off, but the data is held in memory ON The device is on and ca be used ZA Zeroize All. This purges all TSKs and FH-sets.
|
|
The ADDRESS-selector selects the desired storage compartment.
It has 16 positions:
|
1 — 13 13 compartments for Frequency Hopping sets T1 and T2 TSK (controls the order of an FH-set) A (All) Load or fill all TSKs and FH-sets
|
|
To load data into a compatible radio, connect the device to the FILL
port of the radio, select the desired compartment (ADDRESS) and set the
MODE-selector to ON. Next, initiate a transfer from the radio. Set the
ADDRESS-selector to 'A' to load all TSKs and FH-tables at once.
|
When the device is no longer used, or when it must be stowed for a longer
period of time, or when security is compromised, it will be necessary to
destroy all the data that is kept in the device. This is done by setting
the MODE-slector to 'ZA" and pressing the INITIATE button.
|
The MX-18290 featured on this page, is used to load the SINCGARS
radio (see above) with Transmission Security Keys (TSK) and
Frequency Hopping tables (FH-sets or hop-sets).
If the radio is also equipped with a KY-57 secure voice unit
(or equivalent), a separate fill device like the KYK-13 is needed
to load the Traffic Encryption Keys (TEK) into the KY-57.
This means that two different fill devices must be used:
one for FH and one for crypto.
|
|
|
When loading FH-sets and keys into a SINCGARS radio, such as the
RT-1439, the MX-18290
must be connected to the FILL port of the radio by means of a short fill
cable, such as the one shown in the image on the right.
The cable has 6-pin U-229 connectors at both ends and is wired straight
through (i.e. 1:1), although in most cases the center contact (F) will not be
used by the FILL device itself.
|
|
|
The MX-18290 is powered by a single 6V military battery type BA-1372.
This battery is also used to retain the keys and FH-sets in the
device's static memory (CMOS RAM).
The original BA-1372 battery is no longer in production as it contained
Mercury. It has been replaced by the BA-5372, which is a Lithium-Manganese
variant (LiMnO2).
➤ More information
|
|
|
|
The interior of the MX-18290 can be access by removing 6 screws from the
left side panel (the panel with the 15 note pads), after which the side panel
can be removed. This reveals the solder side of the printed circuit board (PCB).
The PCB is held in place by another 5 screws around its edges and two
mounting posts holding the PCB in a 30-pin receptacle inside the
enclosure.
|
After removing the 5 screws and releasing the two mounting posts, the PCB
can be lifted from the enclosure, as shown in the image above.
A 30-pin socket in the corner of the PCB connects it to the controls and
connections, which remain inside the enclosure. Note the use of flex wiring
inside the enclosure, which connects the 30-pin plug to the controls and to
the U-229 plug. This saves on weight, simplifies manufacturing
and also improves the device's reliability. Regular wiring is used for the
connection of the U-229 socket at the other end of the enclosure.
|
|
|
|
The PCB holds 15 integrated circuits (ICs), only one of which carries a
regular identification. The other parts are marked with unique codes issued by
the US Department of Defense (DoD). Luckily, US collector Brooke Clarke
was able to convert the DoD codes into the actual part numbers [1].
|
Most of the ICs appear to be regular CMOS logic circuits, but the heart
of the device is formed by the CDP 1802 microprocessor
shown in the image on the right.
It is accompanied by a 2KB ROM which holds the firmware, and two RAM
chips providing a total of 1KB of static memory.
The static memory is volatile and is used for the program variables as well as
the TSKs and hop-lists. It is retained by a 6V backup battery, held
in a separate compartment of the enclosure.
The memory contents can only be purged by removing the battery or by
ZEROIZING the device.
|
|
|
|
Compared to the more common KYK-13 fill device, the MX-18290 is
much more complicated. It contains a complete micropcessor platform,
wheras the KYK-13 contains just discrate logic. The reason for
this is the fact that the MX-18290 has to store various types of data,
whereas the KYK-13 is only suitable for 128-bit cryptographic keys,
like the ones used with VINSON and SAVILLE.
|
|
Below is a tear-down of the components found on the main PCB, based
on the work of Brooke Clarke [1]. For further details about the components,
check out the information on this website.
From the date codes on the parts it is likely that the device featured here
was made in late 1990.
|
| IC | DoD ID | Part | Manufacturer | Description |
|
|
| 1 | A3012591-1 | 74LS174 | Motorola, RCA | Hex D-flip-flop |
| 2 | A3012588-1 | 4011 | Harris | Quad NAND |
| 3 | A3012592-1 | 74LS367 | Motorola | Hex 3-state buffer |
| 4 | A3012580-1 | 4011 | Harris, Motorola | Quad NAND |
| 5 | A3012589-1 | 40109 | Harris | Quad level shifter |
| 6 | A3012568-1 | CDP 1802 | Harris, RCA | Microprocessor |
| 7 | 14069A/BCAJC | 4069 | Motorola | Hex inverter |
| 8 | A3012591-1 | 74LS174 | Motorola. RCA | Hex D-flip-flop |
| 9 | A3012589-1 | 40109 | Harris | Quad level shifter |
| 10 | A3012646-4 | 2532 | Harris. RCA | ROM |
| 11 | A3012571-2 | 2114 | Harris | 1K × 4 RAM |
| 12 | A3012592-1 | 74LS367 | Motorola | 6 × bipolar buffer |
| 13 | A3012592-1 | 74LS367 | Motorola | 6 × bipolar buffer |
| 14 | A3012592-1 | 74LS367 | Motorola | 6 × bipolar buffer |
| 15 | A3012571-2 | 2114 | Harris | 1K × 4 RAM |
|
|
The MX-18290 has two U-229 connectors: a plug-type one
at the bottom end and a socket-type one at the top. These connectors
are wired in parallel, so that either one can be used to fill the
equipment. Although the device can be fitted directly to the fill
connector on the radio, it is recommended to use a FILL cable
at all times. Below is the pin-out of the U-229 connectors.
|
GND Ground SWG Switched ground (via MODE-selector) REQ Fill request DATA Fill data into KY-99 CLK Fill clock into KY-99 - unused
|
|
|
|
|
Any links shown in red are currently unavailable.
If you like the information on this website, why not make a donation?
© Crypto Museum. Created: Wednesday 21 March 2012. Last changed: Friday, 30 May 2025 - 09:47 CET.
|
 |
|
|
|
|
