Avionics teardown: reverse-engineering a (de-mil) voice crypto unit - Page 1
Forum section: electronics / projects

author: D Straney
author_rank: Frequent Contributor
timestamp: September 15, 2024, 03:29:32 pm
content: Here's an "Digital-Analogue Converter" that came from a British Sea King helicopter, made by GEC Avionics.Based on the ambiguous-sounding name I didn't know what to expect inside at first, but quickly realized that there's some encryption involved, from the "key erase" switch.The the top of the front panel contains a door that opens up to reveal a large slot extending half the length of the unit - this must be where the encryption module used to live. Too bad I won't get to look at the internals of that, but that's to be expected from de-militarized equipment.Let's open it up and take a look inside:The connector for the missing crypto module breaks out each connection to discrete wires:Rather than a uniform arrangement of vertical boards in a backplane,like in this navigation computer, the construction here is all heterogeneous modules, with a lot of "3D Tetris" going on. Each module plugs into a complicated wiring harness via a D-sub connector on the back, and then locks in with 4 screws on the edges.One reason for this might be the extra shielding added by the enclosures around each module; electromagnetic separationbetween the encrypted and unencrypted sidesseems to be a common requirement for equipment like this - you can see a lot of examples atThe Crypto Museum(with excellent internal photos).The internal wiring is complicated to follow, but there's multiple sets of feed-through capacitors which likely separate the encrypted and unencrypted sides as well; besides conducted emissions, this probably filters the power too to prevent plaintext-dependent current draw leaking out from fast digital transitions (TEMPEST techniques, etc.).There's lots of feed-through capacitors on the front panel too, for every external signal to/from the connectors, and some mystery relays which might handle audio routing:TheP.E.C. Control Boardsseem to contain some basic glue logic for interfacing an external computer to this encryption unit:I started tracing out the logic of one card, but it was fairly boring, didn't give any insight into the actual workings. The "P.E.C." in the name probably stands for "Programmer Electronic Control", the GEC/Marconi term for their avionics computers,as well-documented by Erik Baigar.ThePower Supplyis also pretty straightforward.It's just a 400 Hz transformer, with a bunch of free-wired rectifier diodes to produce various DC voltages.There's also a stack of aluminum capacitors in some unusual packages......and some metal-can voltage regulators:The more interesting parts are in the final two modules, though, the Audio and Cyphertext modules. My best guess is that the..."Audio Module" processes the unencrypted audio, both incoming (from a microphone) and outgoing (to a speaker)"Cyphertext Module" processes the encrypted digital waveforms, turning them to and from audio signals that go over the radioAudio ModuleThere's mostly just a bunch of op-amps in here, plus a couple big audio transformers (the red cylinders; potted toroids) and an MD7021 dual transistor array. The MD7021 is probably used as a power driver for outgoing audio through one of the transformers - we'll see a similar circuit used in the Cyphertext Module later. Isolating the audio on its way in and out to external equipment reduces the potential grounding problems a lot, which otherwise would be a serious issue with small signals in an electrically-noisy aircraft environment.Unless some of the LM741s are being used as comparators, the audio module is likely just a bunch of linear gain and filters; nothing particularly interesting, so I didn't bother tracing the circuitry yet. The digital-to-analog conversion of decrypted audio, and the analog-to-digital conversion of encrypted audio, probably happen within the encryption module and not here. It's possible that the encryption module feeds asigma-delta-encoded bitstreamto the audio module, which gets low-pass-filtered into the outgoing audio signal, but the more complicated stuff doesn't seem to happen here.On the bottom are a couple free-form-wired regulators (a positive LM317 and negative LM117), probably to give it filtered local analog supply voltages.Anyways, the Audio Module is in storage right now but I'm still going to see if I can do a quick trace of the circuitry next time I have access to it, just to make sure it's not doing a janky "op-amps-as-comparators" delta-sig encoding/decoding onboard...The best circuitry though, of course, is in theCyphertext Module.This module is packed with parts, and actually has 3 boards: 2 stacked on the top side (#1 and #2)......and one on the bottom side (#3):Before diving into the functionality, let's take a quick up-close tour of the circuitry...The top board has a lot of 4000-series digital logic:The middle board has a gold-capped ceramic chip that turns out to be an analog switch:The red box mounted to the chassis is yet another audio transformer, used for input isolation:The bottom board has some more potted inductors (red cylinders), plus the black boxes which are (film?) capacitors, forming a multi-stage LC filter:Now, most importantly,what does it all do??It was a pain to go through this entire module but curiosity wouldn't let me stop, so here's a full schematic: also attached at the end of the post as a PDF.There's a couple important external signals to discuss: (both using names I gave to them)"Init" seems to be an initialization or reset pulse, coming from either the P.E.C. Control cards or maybe the crypto module."Mode" selects between two major modes of operation in the cyphertext module, for data flowing in both directions. I found a photo of a control panel for this encryption unit:(Photo by woods-group-devon on eBay)The switch 2nd from the right, next to "Erase", selects between "FBB" and "Diphase" - I believe this selects the digital encoding method used to send the encrypted digital bitstream over the radio.I don't know what "FBB" stands for, but "Diphase" seems to be an old name forManchester Encoding(there may be some subtle differences, but if so I can't spot them?) which encodes 0 and 1 as rising edges or falling edges, together with the clock signal, so that the clock and data can be transmitted together over a single channel.Mode = 0 for Diphase mode, and Mode = 1 for FBB mode.There's a lot happening here, so let's walk through it block by block. Simplest one is...Encrypted Digital Output PathThis section takes the encrypted digital data from the crypto module, and converts it to an analog waveform suitable to send over the radio.First, the incoming clock from the crypto module is divided by 4; the clock seems to run at 4x the bit rate, for timing purposes. The incoming data is reclocked at this Clk/4 bit rate by IC16A.In Diphase mode, the 4070 XOR gate generates the Manchester/Diphase encoding by simply XOR'ing the data with the clock. The encoded digital data is then passed through a series of active filters, which seem to form a many-pole bandpass overall. This now close-enough-to-audio signal, centered around 0V and with the sharp square-wave edges chopped off, passes through the 4053.In FBB mode, the raw digital data is directly re-clocked (again for some reason?), AC-coupled and given some gain, and passed through the all-passive multi-pole LC filter on the bottom board (#3). The filter seems to be mostly low-pass, with a couple notches formed by the parallel LCs (L4 & 8.1 nF, L5 & 4.7 nF). I have no idea why active filters were fine for the Diphase-encoded signal, but the FBB one needs passive filters. I also don't know what any of the actual filter corner frequencies are, because the capacitors (in the active filters) and the inductors (in the passive filters) weren't marked with values.Finally, the filtered digital signal, now suitable for radio transmission, is amplified and sent out to the radio through an audio isolation transformer (L1). For amplification, the LM741 at the right uses two discrete transistors (in the MD7021 dual-complementary metal can) to boost its output current capabilities. The discrete output stage architecture used here is interesting; instead of having the op-amp output directly drive the transistor bases (with required biasing, etc.) it uses the op-amp's current draw from the power supply to drive the transistors. I've seen similar schemes in Jim Williams app notes and elsewhere, but never exactly in this form - the weird overlap in voltages, and the operating point implied by the resistor values, both don't make sense to me but I double-checked the continuity & resistances, so apparently I'm just missing something...When the 741 is driving the output positive, for example, its V+ current draw increases and its V- current draw decreases. This increases the voltage drop across the VCC-side resistor, lowering the NPN's base voltage (and sinking less current from the output through the NPN). This also decreases the voltage drop across the VEE-side resistor, lowering the PNP's base voltage (and sourcingmorecurrent to the output through the PNP).I thought it was interesting, too, that rather than encoding audio tones over the radio channel either with FSK or PSK, the digital signals just get filtered and then sent on their way. I guess this works as long as the frequencies are in the audio range, and at fixed rates (which makes it easier to filter out noise on the incoming side).Encrypted Audio Input PathEncrypted audio enters from the radio via the chassis-mounted transformer, and goes through an amplifier with trimmer-adjustable attenuation and gain adjustable by a cuttable wire link.It then passes through a 2-pole low-pass filter, which has its corner frequency switched by that ceramic & gold IC on the middle board: 15 kHz in Diphase mode, and 30 kHz in FBB mode. The two diodes that follow clamp the signal's negative excursions to ~0V (the diode connected to gnd compensates for the forward voltage of the clamping diode), and shifts the voltage upwards by ~63 mV. This positive-only signal then goes into a comparator with a fixed 1.1V threshold and some hysteresis, and surprisingly, that's it - it's now a digital bitstream to send to the crypto module.In FBB mode, the story ends there: the 4053 switch passes the signal along as-is (from the "Audio_Dig" net). In Diphase mode, though, there's a whole lot of extra circuitry involved in Manchester/Diphase decoding. I'm not 100% sure on what everything is doing, but it's all centered around a 4046 PLL, which makes sense - syncing a PLL to the appropriate transitions is one of the ways to recovering the clock from a Manchester-encoded bitstream.The US patent # 3982195 contains a description of a significantly different, but still informative, Manchester/Diphase decoder using a PLL(the comparator, LPF, and VCO form a PLL's feedback loop). The PLL's oscillator output gets divided by 2 and delayed various amounts, and a set of XOR gates & NOR gate seems to filter out the "appropriate" bitstream transitions (ignoring the extra ones required with sequential 0s or 1s) to create pulses to sync the PLL. In the end, the properly-phased PLL clock is used to latch the input bitstream at specific times, which also makes sense: for example, if a "1" is encoded as a rising edge, you'd want to sample the bitstream (and latch it on the output) after the rising edge, to make the output "1".There's also a circuit to the left, which I think is to prevent garbage data from being passed on to the crypto module during startup/shutdown/invalid input. There's a slightly confusing circuit involving the phase-detection pulses from the PLL, a little bit of logic, and an LM567 tone decoder () - this ensures the digital output is all 0s until it receives phase-detect pulses from the PLL, within a specific frequency range (which probably indicates that the PLL is locked and the decoder is working properly).Initialization and Self-TestThere's another slightly confusing circuit with multiple analog switches (and a discrete-transistor inverter; not sure why they didn't just use the 4013's ~Q output), which seems to control what happens at reset, and some sort of self-test mode. There's an unusual chip on the bottom board; the 4557 variable-length shift register - it has an internal shift register delay selectable from 1 to 64 bits, with external pins. This is used here as a 34-clock-cycle delay, in what seems to be a "self-test loopback mode", where the crypto module's digital output data is sent back to its digital input.What seems to happen here is that the "Init" pulse, while high, puts the Ciphertext module into the loopback self-test mode. Then when the "Init" pulse goes low again, the digital data output to the crypto module is latched off (all 0s). Whatenablesthe output, and allows the decoded digital data to be passed onwards to the crypto module, is a specific tone on the audio input from the radio (which probably indicates "start of transmission" or "encrypted transmission to follow"). The LM567 tone decoder detects this tone, and latches the output into its "active" state.Anyways, hope this was interesting, let me know if you have any extra info about this equipment.

author: D Straney
author_rank: Frequent Contributor
timestamp: May 09, 2025, 04:25:48 am
content: As a follow-up, I finally pulled the audio module out of storage, so let's take a look inside that:Audio ModuleHere's the photos again, so you can see all the 741 op-amps and 2x (potted) audio transformers, on one side......and the hand-wired voltage regulators on the other side:Tracing the schematic was pretty easy, luckily.Audio output sectionThis takes the decrypted audio from the (missing) encryption module, and uses it to drive an external 3-wire balanced audio output, with some current-sourcing ability behind it: might even be able to drive some headphones directly. The transformer is for isolation, and there's a dual-transistor metal can (the MD7021) used as the discrete power-output stage with a 741 op-amp for control. The biasing scheme is interesting, using the current draw from the op-amp's power rails to drive the MD7021 output transistors - I think I discussed this in the previous circuit analysis (the "ciphertext module" has something similar).Audio input sectionThis receives an audio input, tweaks it a bit, and feeds it to the encryption module to be encrypted.The external audio signal enters at the left as a balanced 3-wire input, gets isolated by the transformer, and goes through a trimmable gain stage with IC1. After this, it gets a bit weirder. There's a very large gain from IC2, and the output of this is used to feed a peak detector (D1 & C17). This peak detector, once it passes a certain threshold, can turn on a transistor that pulls down on the audio signal at IC2's input and attenuates or suppresses it. There's one final gain stage from IC3 before the signal is sent off to the encryption module. TR4 provides an external mute function as well.The confusing part is the signal levels and component values. For one thing, IC3's input AC coupling has a high-pass corner frequency of 3.4 kHz, which seems high for audio. Additionally, the levels at which TR1 turns on don't make sense to me:1. Let's say that TR1 conducts enough collector current to do something at roughly Vbe = 0.5V.2. So, C17's voltage has to be 0.72V.3. So, D1's anode voltage / the 741 output has to be ~1.3V.4. So, ignoring the R15-created offset for now, IC2's output has to be ~100 mV.5. Following this forwards, the output of IC3 has to be ~20V.If the power supply rails are a standard old-style-analog +/- 15V, then this means the output of IC3 would have already saturated before this auto-mute function kicks in, and so I don't really see the point. It would be kind of strange to have extra-high bipolar power supply voltages too, for no reason. R15 makes the situation even worse, as it offsets the op-amp outputmore negative; this means it takes aneven larger input(more negative) to trigger the TR1 mute circuit.(I had originally thought the TR1 etc. section might be serving as continuous AGC rather than a more "digital" mute function, but the time constant for C17/R11+R6 is 2.5 whole seconds, which makes this unlikely)Power supply sectionThis is the most interesting part. At first, I had assumed that these provided local voltage regulation - but when I started tracing the connections, I realized it was doing something very different: especially with the negative regulator on the positive power supply, and the negative regulator on the positive power supply!It turns out, these regulators are connected to keep a constant current draw on both power supplies. The 22Ω resistors serve as current sense, and the LM137 and LM117 have internal 1.25V references that they compare against the OUT-to-ADJ pin voltages. This means that each one will sink as much current to the common ground as needed to keep a constant 1.25V across its 22Ω resistor, which translates to ~57 mA.Essentially, these regulators enforce a constant 57 mA current draw from the external power, by sinking extra current themselves to ground as necessary and burning off the extra power as heat. I think the purpose of this is to prevent any "secrets" (un-encrypted audio signals) from leaking out through the power wiring: remember that while the Ciphertext Module deals with the already-encrypted signals, this Audio Module deals only with the raw audio. I can't find links right now, but this a common anti-information-leak technique, whichI'm pretty sure includes some of the equipment described in detail here.

author: CaptDon
author_rank: Super Contributor
timestamp: May 09, 2025, 02:37:28 pm
content: Amazing that these units don't have self destruct detonator devices like the old I.F.F. units that used the weird looking 717A tube.

author: amyk
author_rank: Super Contributor
timestamp: May 10, 2025, 04:22:38 am
content: Those unusual capacitors are actually wet tantalums, and would've been extremely expensive when new.http://www.o2xygen.com/photo/402150148004/402150148004_001.pdf

author: D Straney
author_rank: Frequent Contributor
timestamp: May 10, 2025, 10:32:07 pm
content: Quote from: CaptDon on May 09, 2025, 02:37:28 pmYeah I think with "newer" (post-tube) stuff, blowing up the device rapidly becomes not worth it, when the "secret sauce" can be erased just by clearing a key in RAM, rather than being encoded in the physical circuit arrangement. (Plus, the place for a small explosive charge would be in the encryption/decryption module itself, which wasn't present here, so y'never know) If you're curious I can't recommend cryptomuseum.com highly enough: I'm not affiliated with them at all (they're in the Netherlands) but they have internal photos and theory of operation for a ridiculous variety of encryption and spy-radio equipment.