'< 2 

3 

'f -~F ID: A6655-2 

NEVER USB FOR APPROVALS, DISAPPROVALS, 

CONCURRENCES, OR SIMILAR ACTIONS. 

INITIALS 

DATE 

CIRCULATE 

COORDIHA· 

TION 

NECESSARY 

ACTION 

NOTE AND RETURN 

SEE ME 

SIGNATURE 

eclassified and approved for release by NSA on 05-08-2014 

ursuantto E.O. 13526 

16-1111281H1 GPO 
Tl oJ lnt141matlu 11'a111 d Jn 

this d~cumen\ will not be losed 

\q fore1cn aatunals or their re , se11tat1v•" 

IFF SECURITY PROFUSAL WITH FACILITIES FOR SECURE DATA TRANSMISSION 

INTRODUCTION 

1. This paper presents a description or the cryptomathematical 

aspects or a device consisting of a shift register, several storage 

registers and two correspondence generators. Under proper usage this 

system should provide a means for secure IFF,. secure personal identification 

(PI), and a secure data transmission sy~tem. 

2. The basic system was initially proposed by the Conununications 

Laboratory of AFCRC and it was there that the first models of this system 

were constructed. 

DESCRIPTION OF ENCIPHERMENT 

l. Operations 

a. In order to simplify the description given in the following 

sections, it will be necessary to define symbols for the various operations 

used in the encipherment: +, (!) , G, S, Q~ The first two will be explained 

initially; the other three will then be defined by ,making use of a seven 

stage device, as shown in Figure 2. 

b. Vector addition, or ordinary non-carry binary addition, will 

be designated by +; e.g. ¢+¢ = 1+1 = ¢, l+~ =;..¢~1=1. The + shall stana for 

the operation of combining two vectors a and b in such a way that if 

a = 110110001 and b = 01011, then a © b = (110110001) e (01011) = 

11011000101011. 

SEC:RET 
c. In Fi~ure 2 there is exhibited a seven stap,e device. This 

system will be used as an example in explaining the different operatjons 

of the device. 

d. The correspondence p,enerator is merely a permutation arranged 

so that for any distinct set of three bits read from stages 4, 5, and 6 in 

the shift register there is one and only one.output. As an example of this 

operation, let the contents of the sever stages be represented by 

x = X1 x2 X3 x4 X5 X6 Xo 

= l l 0 1 1 0 o. 

Since x4 x5 x6 maps or is permuted into an output (1,2,3), an input of 110 

into the correspondence generator becomes an output of 011, see Figure 2. 

This is then added to x1 x2 x3 to yield X' as follows: 

x = 1 ] 0 1 1 0 0 

Output = _,,0_1 ___ 1 ___ _ 

X1 = 1 O l 1 1 0 0 

Let this operation of reading of the value of the contents of stages 

k, 5, 6, permuting this value into any or the eight possible values, and 

then adding the result by non-carry binary add,ition (+) to stage 1, 2, and 

3 of the shift register be defined by the operator G. That is in symbols 

X G ., X'. 

e. Let S be an operator designating a cyclic shift from right to 

left with the contents of stage l being carried end around to stage ¢. For 

example 

SE~RET 
X•llOllOO 

x s = 1 0 1 1 0 0 1. 

t. Let Q !! G s, where the operations are carried out from lett to 

right in sequence as follows: 

X•llOllOO 

X Q • X G S • (XG)S • (l 0 l l l 0 O)S 

• 0 l l l 0 0 l. 

Basically these are the onl)" operations involved in the system. 

2. IFF 

a. To use this system as a secure IFF we must be able to encipher, 

in a manner which can be duplicated on the ground, a randomly selected 

challenge (C ·.co c1 o2 c3 c4 c5 c6)• Several different methods have been 

tried but the one method which appears to ofter.'the most complexity is that 

ot serial loading. 

b. The device in its normal state ot rest will have the additive 

key (X0 ) inserted in the shift register and will be ready to receive the 

interrogation pulses as they arrive. The interrogation will be preceeded 

by a series or synchronization pulses which will indicate what mode of 

operation is to be performed. After receiving the synchronization pulses 

and setting up the proper gates for calculating a no:nnal IFF reply the 

operation will proceed as follows. Let X0 be the initial setting ot the 

shirt register, that is let X0 be the additive key. Then as the first bit 

c0 or the interrogation ie received it is added (+) to the zero stage or 

the shift register, or symbolically X0 + c0 ~ x1 x2 x3 x4 X5 ~ (Jto+Co)• 

3 

SE€RET 
.. 

Next X0 + c0 is operated on by Q. Let the· result of this operatiqn be 

desienated by x1, thus (X0 +c0 ) Q • x1 • When the second bit c1 arrives, 

it is added to position zero or the shift register. Q again is applied, 

giving X2• This process can be represented symbolically as follows: I 

X0 = additive key 

x1 • (X0 +c0 ) G S = (X +~o) Q 

X2 "" ~Xl +cl) Q 

X.3 = (X2+c2) Q 

X4 "" (X3 +c2) Q 

X5 "' (X4 +c4) Q 

x6 = (X5+c5) Q 

X7 = (X6+c6) Q 

or 

~ = (((((((X0 +c0 )Q+c1)q+c2)Q+c3)Q+c5)Q+c6) Q. 

All bits of the interrogation have now been loaded into the shift register. 

Howe~.rer, the degree or complexity involving the last several bits ( 04, 05, c6) . is not sufficient to give the system adequate security. Therefore, Q shall 

be applied seven more times as follows: 

(((((((X7)Q)Q)Q)Q)Q)Q)Q a (X7; Q7. 

This completes the encipherment. 

c. In order to obtain the reply, read the values of any three of 

the stages (in the example stages l, 2, and 3 are used) and transmit their 

value as the reply. 

d. The detajled operations involved in a complete encipherrnent 

are illustrated in Figure 3. 

4 

SE€RE'F 
e. The pro~eding paragraphs described the method of calculation 

of a reply from an interrogatfon for a 7-stage shift register. Now, let 

us extend this operation to the 24-stage system. The operator G will now 

represent the reading from 4 stages instead of 3, permuting this value 

simultaneously through two correspondence generators ani adding (+) the 

resulLs to 2 distinct sets of 4 stages each in the shift register. These 

sets will be distinct from the reading set. See Figure 1. The operator 

Sis the same (cyclic shift from right to left with end around carry). 

The interrogation will now consist of 24 bits, C = c0 c1 c2 ••• c22 c 23' 

nflrl 4 bits instead of 3 will be used in the reply. 

t. The reply is calculated as follows: first, determine Xli.0' 

24 X1,s "'((( ••• (((X0 +c0 )Q+c1)0+c2)Q+ ••• +c22)Q+c23 )Q) Q ; second, from 

X/if~ sc1cc{. Li. bits say x1 x 2 x 3 xl~ as the reply. 

r.- •rhe interrogator, l·tho is on the other end of this transmission, . r···l'l'orm:1 th- rmma operations on the challenge ( inte,rrogation) that he has 

t,ranomi'\..tccl, them holds tho result until he receives the reply. Upon re·-

"'"'1vins th'.l reply he comp-"lres this with the one he has calculatad and upon 

a scrios of sny 10 such comparisions he is able to distinguish friends from 

enemies • 

.'.3. ~ro Personal Identification 

a. The operations or this system when used for secure PI are 

basically the same with t.~io clight exceptions: first the contents of l..ho 

entire ohift register are transmitted in the reply, and second the 

intcrroGator, as we will see later, muot be able to ahift h~s shift 

rogi:::it:.er in either direction. 

5 

SECRET 
b. Arte~ having received the aynchroniaa.tion pulsee, which are 

d!tl~¥ertt from those used in IFF, the device is automatically set up to 

P8ffij¥ifi the following operations {upon receipt of the interrogation 

Q e 60 cl ••• c23,which i~, identical to the preceding challenge); First, 

determine x24 where x24 • ( ••• ((X0 +c0 )Q+c1)Q+ ••• +c23) Q. Second, to x

24 

add ( +) the PI or PI ® A {see lb) where A ntight be an indication or the 

amount or fuel remaining, i.e. x24 + (PI @ A) =.x• 24• Third, determine 

24 x• 4a where X'l.iS = (X1

24) Q • Finally the reply x1

48 {all 24 bits) is 

transmitted to the interrogator. 

c. In the meantime the interrogator has calculated x2li. and transferred it to a storage register awaiting the reply x1

48 • Having received 

x• 48 he proceeds to operate backwards. First he shifts his shift register, 

which contains x• 48, from left to right. Let this shift from left to right 

be designated by S-l. Next he operates with G, which yields x1

47 = X'kSS-lG. 

-1 -1 -1 -1 Since X' 4S· = X' 47 Q, let us define Q as S G, i.e. Q 5 S G, and further 

-4 1 4 (({ -1) -1 -1 -1 -n let Q :: (Q- ) s (X) Q Q )Q )Q or any other power n such that Q 'I; 

-1 -24 

means to apply Q successively n times. Hence x• 24 = {x• 48) Q • By 

adding ( +) x24 to X' 24 we have x24 + X' 24 = PI © A which not only gives 

the interrogatee 1 s PI but also gives the amount of fuel {or other vital 

information) to the interrogator. See Figure 4 for a detailed calculation 

using a seven stage device. 

d. There are other types of operational procedures that can be 

used to obtain a PI reply from a i:articular aircraft rather than having 

all aircraft in a given area responding at once. The details of these 

and other modifications will not be included at this time. 

SE€RET 
4. Data Transmission 

a. Even though the operations involved in using this system for 

data transmission are rather complex, it should be borne in mind that this 

facility is an extra or bonus since most of the equipment would already be . present for the IFF system. The system as proposed is essentially a discrete 

address system wherein a set of data is sent ·to·. one receiver (or under a 

prearranged address system to one group.of receiverB). 

b. Under the assumption that there will always be more than one 

aircraft within receiving range, it will be necessary to set up a closed 

circuit between the transmitter on the ground and the receiver in the 

aircraft. This will be accomplished as follows: First, the ground will 

transmit a normal challenge C which is preceeded by a special set of 

synchronization pulses tl'at trigger the proper &ates for data transmission 

operation. Then for the seven stage device he calculates x

7 as in 

Figure 5(a.) and stores it for future use. For sim~licity let x

7

::H. 

Second, the aircraft receives the challenge and Qaleulates H (X.,) and he 

too stores H for future use. To the value of H which is still in his shift 

register is added his PI and the initial value K0 of his counter (K). Call 

the result of this operation x11

7

, where X'.'? =;. H + PI © K0 • The counter ... 

(K) is a binary counter of 3 stages in the seven stage device which counts 

¢, 1, 2, 3, 4, 5, 6, 7, ¢, 1, ••• and it is not reset to¢. K0 would 

represent some initial value and K1 would represent the next value in the 

sequence. Operate on X"? with Q? to obtain X11

14, the reply. This entire 

operation in symbols is xn14 = ~ • • •((X0 +c0 )Q+c1)Q+ • • • "" c6)Q+(PI $ K0 Il Q

7 

• 

7 

SE€RE1' 
SEe!f~.!?f36ss2 '-A..L'-~ ..... 

~.M...Q.fil..I 

The reply is then sent to the ground. See Figuro ~(b). 

roceives the reply'(xn14) and operates on it as follows: 

Third, the ground . -7 

(X11

14) Q +H .. PI$ K0 • 

The {PI $ K0 } is complemented, tha.t is ¢' s become 1 1 s and vice versa then 

(H+(PI © K0 }') Q-7 "' X*14 .. C. s. C. S. is transmitted to the aircraft 

., as a call sign for the aircraft with this particular PI and K0 • See Figure 

5(c) and (d). Fourth,C. s. is deciphered in the aircraft as follows: 

(0. S •) Q'l +H + {PI ~ K1 ) = 1 l 1 l 1 1 l when the result or this calculation 

is all one's he transmits a pulse indicating correct reception. Jn.general 

{a) Qn = (b) Qn if and only if a = b. Since a and b are of the fol'lll 

H•tPI © K0 }, then the other aircraft within rece:ivlng range that have 

different PI's can not get all ones. Those that do not get ones would 

automatically ignore the in:•ssage transmissions. The calculations for 

th1s o~op are carried out in Figure 5(e). This completes the setting up 

of a closed circuit. 

c. The remaining operations consist of transmitting the messages. 

However, since K

0 has already been used in the setup, the total number 0£ 

measages which can be sent on one sotup is limited to one less tha.n the 

total nurnher of settings of K. The messages (for the seven stage device) 

are enciphered as follows, where Mi is message i and EMi is the enciphered 

MGSSR.gO: 

{ -7 M1 (Ground) ( H+ M1 Ci> K1}) Q = EM1 i 

(Air) (El-11) Q'l +H+K1 = M1 G> $6; 

Acknowledge correct receipt of M1; 

8 

SECRE'f 
s~~ss2 ..a.....l'-..A.A..'-..a.....I ..... 

M2 (Ground) (H+{M2 (!) K2}) Q-? "' EM2 ; 

(Air) (EM2) Q

7 +H+K2 "" M2 <D ¢ 

Acknowledge correct receipt of M2 ; and so forth. 

See Figures 5(£) and 5(g). 

d. The fact that the aircraft nrust obtain a ~ in the positions 

normally occupied by K gives an excellent check for transmission and other 

errors. 

e. After a predetermined time the transponders in the aircraft go 

back into their norm'll state, that is in a stand-by status awaiting an 

interrogation. 

1. The daily key will consist of the additive key, correspondence I 

gonorntor one and correspondence generator two.' The read, write and reply 

rend-out positions are fixed and given in Figure 1. 

2. Thore are 2

24-1 or approximately 1.7 x io7 usable additive keys. 

The koy consisting of all zeros will not be used9 

3. Sinco the correspondenco generators are pernrutors of 16 elements, 

there arc 16t or approxim1tely 2.1 x io13 different set-ups for each 

corror.1poncionce eonera.tor. However, no pernmtation which can be reprebentwl h,y n 11.n,wr t.rnnsforrnation can be used, therefore the 28,0SO per-

,.,,> t .. l t,: nn:J wh1 r.h can be roprcsent ed by linear transforna tion must be subt. r-•" 1.-·rl r1·•m1 l:..l1•i t.oto.1 nmnbcr (2.1 x io13) or set-ups to give the usable 

n·1•1l ·:r r-,f p1:rmute.tlons for on.ch correspondence generator. 

9 

SECRET 
s~oJll.fFEi6ss2 '-A.A..'- .......... 

2/.i. 4. The total· number or usable keys is (2 -l)(161-2a,oao)(161-2s,oao) 

or approximately (1.7 x 107)(2.1x1013)(2.l x 1013) = 7 x 1033. 

5. In order to avoid the selection of a linear permutation for use 

in the key list the proposed key could be simply tested for linearity by 

a properly designed digital computor program. 

6. In order to insure that the key is properly set up in the device 

a test setting (X0 )Q96 will be inserted into a separate register. The 

Officer who inserts the key will push a button and have the device with its 

new key run thru the 96 settings am check the 96th setting against the 

check setting furnished by the key list. If the two settings are 

identical, then the Officer knows tte.t the key has been properly inserted and 

that the crypto-unit ia functioning properly. After the initial test the 

device will antoma.tically- check itself at regular intervals, say every two 

minutes. Any time a failure occurs the device rechecks itself several 

times; if the system continues to fail then the system is automatically 

switched into emergency mode or operation and the pilot is informed. 

10 

Carey C. Tison 

NSA-314 

30 March 1955 

SE€RET 
~ 

l:~~l: i.':1:1" : II )11):: t:~\(f,; (~,:.hi).I".}):~ -----

-,. - - - ... - ~ 

H - ~(\" T 0 R A G E • 

. p I lcouNT£R , II . 

- c H E c /( I< £ y Ca. 

-=-

A J) ./) I r I v E K E y c, 

........... 

~ I I Z I 31'fISII,17 I B'l '1 llo lltftz l1.3l1¥11slt'l11l11l/fltol21122l2.3I ~ ~ 

~ ~ Co 

........... 

. ' ' I ' if , I i \ ' . 4 ' ~ ~ ' ' . ' . '

'; , , H JI 

- ' 

\ -

I HEP/..,,. I 

4 ~ • -

" ' ' ' ~ I • r h ' ~ ' \ '~ , I • , . 1- - - - - - I If - • 

- - - r 

- - ~ 

-

CORRESPONDEN~E CORR£f PON~6,,~£ 

&ENFH/ITO/t (iElllEltllTOIC 

AFCRC COMM. LAB /FF 11'//rH DATA THAllSMISSIOll 

FlfiVRE 1 
STORA Gt: 

P. I. 

a 

COUNTER 

ADDITIVE KEY 

SHIFT REGISTER 

REPLY 

INPUT 

S1'AGES 4 5 6 

·O 0 0 

0 0 

0 I 0 

0 I I 

I 0 0 

I 0 I 

I 0 

I I 

SEVEN 

CORRESPONDENCE 

GENERATOR 

CORRESPONDENCE 

GENERATOR 

OUTPUT 

I 2 3 

G 0 I 0 

I 0 0 

I 0 I 

I I 

0 0 

o-.o· o 

0 I I 

G I I 0 

STAGE DEVICE 

FIGURE 2 

SE€RET 

I c.; I 

cs 

N 

0 T 

E 

0 c4 R 

R 

0 c3 0 

G 

I c2 A 

T 

c, I 

I 0 ... N 

I "'o 

STAGES 
.. 552 

SHIF'T REGISTER 

1 2 3 4 5 6 j6 

Additive, Key 1101100 XO 

Output 0 1 l 011 1 co Input 1 l 0 

' l 0 11 l 0 l· X0 .. (X0 +c 0 ) G 

' 0111011 x1 =x0 s 

Output 0 0 0 000 l cl Input l 0 l 

0111010 x' 

1 = (x1 +c1) G 

1110100 ' x2 = x1 S 

Output 1 0 l l 0 l 1 C2 Input 0 1 0 

1001010 x3 = (X2 +02) Q 

Output 0 0 0 0 0 0 0 c.3 Input 1 0 1 

0010101 X4 = (X3+c3) Q 

101 0 C4 

0001011 X5 000 0 C5 0010110 x6 

111 l 06 

1001111 x., 110 

1011110 Xg 

110 

1111100 X9 

0 11 

0011001 X10 

001 

0010010 •X11 

1 0 0 

0100101 X12 

101 

1101011 Xl.3 0 0 0 

1010111 1

14 

101 Reply 

REPLY FOR SECURE IFF 

Figure .3 

SEC:RE'F 
" 

INTERROGATEE INTERROGATOR 

SHIFT REGISTER SHIFT REGISTER 

l 2 3 k 5 6 ~ 123456¢ 

• 1101100 Xo 1101100 XO 

011 0 CO ' 011 0 co 

1011100 Xo 1011100 x· ' 0 

0111001 X1 0111001 I1 

0 0 1 0 cl 001 0 cl 

1010010 X2 1010010 X2 

100 0 02 l 0 0 0 c2 

0100100 X3 0100100 X3 

1 0 l J. 03 101 1 C3 

1101011 Xz.. 1101011 X4 000 0 cz.. 000 0 c4 1010111 x, 1010111 X5 111 0 05 1·1 l 0 C5 

l 0 0 l l ·l 0 x6 1001110 x6 110 0 06 ~· 110 0 c6 1011100 X7 1011100 x., 

1111 PI 1011100 Store 

110 A 

I 0000000 Reply 

0100010 ~ I 

1 0 0 0000000 X14 I -1 1000101 Xs 0000000 X1z+5 101 ' 010 x' s-1 0101010 X9 0010000 13 

000 I 010 I -1 1010100 X10 0011000 X12 S 

101 I 0 0 l' I -1 

0001000 Xu 0000100 X11 S 

001 I 101 f -1 0110000 x12 0101010 XlO S 

010 I 0 0 0 , I -1 0100000 X13 00101.01 x9 S 

0 1 0 I 101 

I 5-l 0000000 114 1100010 Xg 100 I 

·0000000 Reply' 0100010 x,, 

t 

0 :t 0 0 0 1 0 ~orage (x,1 1011100 ) 

1111110 

1111 PI 

110 A 

SECURE PERSONAL IDENTIFICATION 

Figure 4 

SE€RET 
• 

X1 

1 0 0 l 0 1 1 

0 0 0 

0 0 l 0 1 1 1 

XII 

'I 1 l 0 l 1 0 0 

0 11 1 

0 1 l l 0 1 1 

0 0 0 0 

l 1 l 0 l l 0 

l 1 1 0 

0001100 

0 l l l 

l l 1 l u 1 0 

000 0 

1 1 1 0 l 0 1 

l 0 l 1 

. l 11 

X"g 

1001000 

0 0 1 0 

0110001 

X2 

X3 

xt. 

x, 

x6 

x.

1s H 

1111 PI 

0 1 0 Counter (Ko) 

l 0 0 1 0 1 1 

(a~ 

anoufm 

0 1 0 0 1 0 l 

1010010 

l 0 0 

0001001 

0 0 1 

1001100 

0 11 

0 1 l l 1 1 0 

l 1 0 

0101111 

1 l 0 

1 l ·o o 1 1 l 

l l 1 

lOOlOll 

0 0 0 

1001011 

1001011 

0110001 

l 1 1 1 0 1 0 

l 1 1 1 

0 1 0 

0000101 

(c) 

X" 7 

X" 1 lli. X11 S- 11.,• 

X"135-l 

-1 X"12S 

-1 

X"11S 

-1 X" S 10 

x•r

9

s -1 

-1 xu8s XII 

'/ 

PI 

Ko 

tPI © Kc,}' 

Data Transmission 

Figure 5 

SE€RErr 

l 0 0 1 1 1 l 

l l 0 

l 0 l 1 1 l 0 

l l 0 

l l l l l 0 0 

0 l l 

0 0 l l 0 0 l 

0 0 l 

0010010 

1 0 0 

0 1 0 0 1 0 1 

X"9 

X"10 

X\1 

X"12 

X"13 

X"11" 

0 l 0 0 1 0 l Reply 

(b) 

GROUND I 

0110001 

0 O·O 0 101 

0110100 

0011010 

0 0 0 

0001101 

0 11 

1 o, l 1 l 1 0 

11 0 

0 0 1 1 1 1 1 

11 0 

l 1 1 1 1 l 1 

11 0' 

1001111 

1 1 0 

1010111 

111 

0100111 

0 1 0 0 l 1 l 

(d) 

H 

{PI 0 I\0 } 1 

x-1~., -1 x-i~ s 

x:-1:-65-1 

-1 X{E-53 

x-i:-Li s-1 X,._ s-1 

"3 

-1 Xi~ s 

-1 X%1S 

Xito 

c. s. 
• • .. . ~ 

AIR 

0100111 

111 

0101111 

11 0 

0011111 

110 

lllllll 

110 

0111110 

11 0 

0111101 

0 11 

0011010 

0 0 0 

0110100 

0110100 

1111010 

0110001 

1111111 

One Pulse Reply 

(e) 

GROUND 

c. s. 0110001 

1001 x~•1 010 

1 

X*2 0 11 

1111010 

X*3 0111101 

011 

X*4 1000110 

11 l x* 0011011 5 000 

X*6 1001101 

0 11 

X*7 1111110 

110 

X* 0 0 0 1 1 :.. l 

{ne Ko} 110 

H 1110111 

111 

0000111 

0000111 

(t) 

AIR 

0000111 EM1 111 

1101111 X*1 

110 

0011110 X*2 11 0 

1111101 X*3 

0 11 

0011011 X*4 000 

0110110 X*5 

111 

0001101 X*6 011 

1111010 X*7 

1111010 X*7 0110001 H 

010 Ko 

1 

011 K1 

1001000 

1001 000 Ml Check 

(g) 

Tn·.J 1nh11 mJtl in 

this ~~cument will not he osed 

tq forelln nelltnals or their rep 

ff natatJvu. 

~ 

K 

x1=7 

X* S-l 

6 -1 

X"" S 

5 -1 

X*4 S 

X* s-1 

.3 -1 

X*2 S 

-1 

X*l S 

X* 0 

NO 

lh-a. lnt9rn12trnn 

tl11s ~ocument v.111 not be 

tq lore1r:n nationals or their rep • 

seotatlvt ..