Info on the Advanced System Key and what it enables.

[Elroy Jetson]

I was searching for info on the Advanced System Key and I got what I was looking for. I figured I'd share it.

I found it by googling for this term:

Motorola "advanced system key"

==========================================================================================================================================================

4.7 Shuffled Band Plan
Radios that have been upgraded to be Rebanding capable are also capable of supporting the Shuffled Band Plan. The Shuffled band plan is intended to help prevent unauthorized system monitoring and access on Shuffled Band Plan enabled systems. Shuffled Band Plan shuffles all trunking numbered-channels allowed in the band plan.
Note that Shuffled Band Plan can only be enabled by the Rebanding Capable CPS program with an appropriate Advanced System Key per Trunking System. This feature is designed and implemented for Motorola 3600 Type II Trunking systems.
.
.
.
It is important to remember that the Shuffled Band Plan field only indicates that the radio is capable of operating in the Shuffled Band Plan. The subscriber will only operate in the Shuffled Band Plan mode if the system directs the subscriber to operate in that mode. The Shuffled Band Plan capability does not limit or change the current Motorola Type II trunking operation for non-Shuffled Band Plan systems.


=======================================================================================================================================================

So there it is: The ASK allows compatible radios to operate on a shuffled band plan. Which gives essentially the same security functionality as the M/A-Com ESK system,
but by a different approach.


I think this information is sufficiently noteworthy to be deserving of a place in the Batlabs information archives.




Elroy

[xmo]

An Advanced System Key [ASK] is very much more than that.

An ASK is a hardware device that replaces the old system key file as an authorization source for trunked system data programming.

ASK is based on iButton technology, that is, it is a hardware based system. The iButton attaches to your computer through an iButton reader. These are available for either parallel or USB ports.You obtain an ASK button from the System Administrator

The ASK button must be programmed by a System Administrator from a Master.

Programming authorization is set for a specific time, after which the button is useless.

Programming authorization can be restricted to certain CPS fields, certain radio ID's etc., as desired by the System Administrator.

Once a radio has been programmed by an ASK - FOREVER after you must use an ASK to program that radio - the old style key file [and SYSKEYGEN] is useless.

Every time the radio is programmed with an ASK, the codeplug contains a record of the serial number of the iButton that did the programming, thus allowing total accountability.

[PhillyPhoto]

Once a radio is programmed with an ASK, if you try to program it without one, what type of error message do you get? Will you be able to read it at all with an ASK, just not be able to program it?

[cbus]

Once a radio is programmed with an ASK, if you try to program it without one, what type of error message do you get? Will you be able to read it at all with an ASK, just not be able to program it?

Yes, the radio can be read if it has a ASK requirement, however, changing any of the codeplug data will require the ASK. A pop-up message will come up and say that an advanced system key is required to program the radio.

[Jim202]

Shuffled Band Plan?

This sort of smells like a way for Motorola to stay in the proprietary trunking system. Can anyone fill
us all in as to this being or not being part of the P25 open standard. My bet is probably that this is
only a Motorola thing. Can't recall anyone talking about this before. However I could be wrong.

Jim

[PhillyPhoto]

Shuffled Band Plan?

This sort of smells like a way for Motorola to stay in the proprietary trunking system. Can anyone fill
us all in as to this being or not being part of the P25 open standard. My bet is probably that this is
only a Motorola thing. Can't recall anyone talking about this before. However I could be wrong.

Jim

I'm not too familiar with P25, but I would say no due to the fact this is for the legacy 3600 baud systems which probably aren't covered under P25.

[mr.syntrx]

With support for encrypted control channels, you don't really need it on a P25 (9600bps) system anyway.

[Bruce1807]

a shuffled band plan is simply
The control channel says on go to channel RF channel 6.
My radios says ok
and goes to RF channel 9 where the conversation takes place.
basiclly the control channel is performing some very basic coding that is easy to crack and im sure the next lot of scanners will have a feature to manually program the channels whatever the control channel says.

So now when you buy of fleabay you need to know if the radio has been ASKed.
If so it can't be programmed (yet)
More and more agencies will use ASK and whilst it will affect the second hand market it is good for the system owners.
it also stops copies of rhe key file floating around when contractors loose the contract and release it etc.

[Elroy Jetson]

Well, you could always do it the hard way...get an image of the contents of the EEPROMs in the radio, archive them,
and later, after the radio has been ASK'ed, and you want to be free of the ASK requirement, burn the original image
back into the EEPROMs and you're back where you started.

The way I see it, 3600 baud systems will all be upgrading to P25 before too terribly long anyway. Motorola will undoubtedly
force the issue by dropping support for 3600 baud systems as soon as they can justify it.

I believe someone will hack around ASK before too terribly long, anyway. In essence, all that all those additional
security measures do is to enable the ASK command, and to place stricter controls on who can do that. But, someone
will figure out how to spoof the CPS or use an external editor, flip those bits, and blow it into the radio.

As long as the radio's internal codeplug isn't encrypted, with encryption built right into the radio's CPU core and
support electronics, it'll always be theoretically possible to hack your way through anything, working in pure hex
if you have to. But it would be a significant task.


Elroy

[xmo]

ASK has nothing to do with 3600 vs P25. Any radio can be programmed with an ASK regardless of system type. It is a feature supported by the CPS for the Astro and Astro25 radio product families. It is a feature that has been requested by Motorola trunked system users. It protects and enhances the System Administrator's ability to manage the system.

The ASK has been discussed here before in several threads, but it is still new enough that many are not aware of it. The used market issue is a huge factor for stolen and "misplaced" radios. One of these days somebody is going to show up here telling a sad tale of how they got this great deal on an XTS5000 on ebay - except that they can't program it without an ASK. That will raise awareness.

You cannot put an old archive back into the radio either.

Whether or not someone can get around ASK in a lab by removing surface mounted memory chips from the inside of the radio and then reprogramming them externally is irrelevant. The number of people that could do that is insignificant and they aren't the target anyway. The intent is to keep control of what goes into the radios on your system.

With every radio on your system initialized by ASK, the System Administrator knows that the trust relationship with authorized programmers will be intact. That will put an end to unauthorized features or talkgroups put into radios by your user's buddy with a bogus copy of the programming software.

[Elroy Jetson]

All very true. In time, the only way for a "civilian" to be able to monitor a given system using the "genuine article" radio will be for him to become closely associated with an organization that is trusted by the system managers, and achieve
a position of trust and usefulness that gives the system manager adequate cause to allow the person to have a radio on
the system. Depending on the character of the system manager(s) in question, that might be relatively easy or
relatively difficult.

When that happens, the aftermarket for used radios will take a huge hit. What good will an XTS8000 be when there's
no way to reprogram it that YOU can get your hands on? They'll be worthless to anyone but the owners and users of associated systems who DO have programming authorization and tools.

Our hobby apparently has a limited lifespan.


Elroy

[alex]

From what I understand - the ASK only controls Trunking, but you should be able to control conventional channels without the ASK.

Granted, I haven't played with on myself, but it should in theory - only effect the channels programmed by trunking much like the system key.

Anyone want to chime in and verify/correct what I've said?

-Alex

[Elroy Jetson]

I'm sure you're right, Alex, but if the general feeling is correct, then once a radio is ASKed, then it'll ALWAYS be dependent
on an ASK from that point forward as long as there is ANY trunking data in the radio. I think you won't be able to change so much as a conventional channel name and put the codeplug back into the radio without the appropriate ASK...if there
is any ASK-enabled trunking data in the radio.

And there's a question...say you have two trunking systems in the radio and one is ASK enabled but the other isn't?

What if you need to change the data in the NON-ASK system?


Elroy

[alex]

I'm correct, and the ASK only effects trunked parts of the radio. So if you buy a radio that has trunking, you could not change those settings, without an ASK or an ASK daughter key (e.g. one created from the master ASK). It looks like your safe with conventional.

From what I also understand, you can use old system keys still all you want - as not everyone has probably gone to the ASK (although, anyone with a current support contract probably is now using them). The only time you can't change trunking data with the old key is when that particular system has been programmed with an ASK. So I do not believe it's an "all or nothing" I think it's system/system.

Then again, I live in an area with almost no trunking worth listening to since everything is largely conventional still (thankfully the machine known as NYC still really likes their conventional setups!)

-Alex

[xmo]

If you have more than one trunked system in a radio, the authorization source [System Key] for one system can be an ASK and the other system can use a key file, however, if a radio has been programmed by ASK, you must have an ASK present to put the codeplug back into the radio regardless of whether or not the ASK was required to make the actual changes.

In other words, even if you have a key file for the other trunked system, or all you want to change is conventional channels, etc.; you MUST have the ASK attached to the programming computer or the CPS won't let you program the radio.

[Jason]

Shuffled Band Plan?

This sort of smells like a way for Motorola to stay in the proprietary trunking system. Can anyone fill
us all in as to this being or not being part of the P25 open standard. My bet is probably that this is
only a Motorola thing. Can't recall anyone talking about this before. However I could be wrong.

Jim

Shuffled band plan is only compatible with 3.0 and 4.1 systems, it is not compatible with 7.X true P25 systems. You are right on the $$, it would create a proprietary environment that flies in the face of the standard. This is a motorola feature and is not part of the P25 standard, similar to ADP crypto, etc.

[PhillyPhoto]

The original ASK is required for any programming correct? So a person couldn't get away with somehow getting a hold of another ASK and programming it that way? Also, I'm wondering if someone could use a test radio and the only thing that gets changed from an original codeplug and an ASK one could be figured out in HEX.

I think it's stupid that Moto would limit programming altogether, and not allow conventional channel programming without an ASK. I can understand wanting to cut back on stolen/lost radios, but I also see this as Moto's way of controlling buy back prices. As systems get updated, users won't be able to get anything for their ASK programmed surplus radios. So now you spend money on securing the programming, and won't be able to make that money back and will have to sell back to Moto for pennies on the dollar.

Get some surplus radios now, and stock up!

[alex]

I think it's stupid that Moto would limit programming altogether, and not allow conventional channel programming without an ASK!

This would be true - because you can't reprogram the radio even if you change the conventional stuff and not touch the trunked information...

Good point. If the radio only has conventional, you should never need the ASK to program it. Probably a good reason to only buy a radio with a conventional only flashcode.

-Alex

[mr.syntrx]

A way to copy or emulate ASKs and get around this may well come along sooner or later. I understand Motorola use DS1994L iButtons, which are just memory and clock devices, and as such don't have any particularly noteworthy security features.

[Elroy Jetson]

From Dallas's site on the DS1994l:

The DS1994 Memory iButton® is a rugged read/write data carrier that acts as a localized database, easily accessible with minimal hardware. The nonvolatile memory and optional timekeeping capability offer a simple solution to storing and retrieving vital information pertaining to the object to which the iButton is attached. Data is transferred serially through the 1-Wire protocol that requires only a single data lead and a ground return.

The scratchpad is an additional page that acts as a buffer when writing to memory. Data is first written to the scratchpad where it can be read back. After the data has been verified, a copy scratchpad command transfers the data to memory. This process ensures data integrity when modifying the memory. A 48-bit serial number is factory lasered into each DS1994 to provide a guaranteed unique identity that allows for absolute traceability. The durable MicroCan package is highly resistant to environmental hazards such as dirt, moisture, and shock. Its compact, coin-shaped profile is self-aligning with mating receptacles, allowing the DS1994 to be easily used by human operators. Accessories permit the DS1994 to be mounted on almost any surface including plastic key fobs, photo-ID badges, and PC boards.

The DS1994 also includes time-keeping functions, a real-time clock/calendar, interval timer, cycle counter, and programmable interrupts, in addition to the nonvolatile memory. The internal clock can be programmed to deny memory access based on absolute time/date, total elapsed time, or the number of accesses. These features allow the DS1994 to be used to create a stopwatch, alarm clock, time and date stamp, logbook, hour meter, calendar, system power cycle timer, interval timer, and event scheduler.

Dallas offers an affordable developer's kit for one wire devices. I have one on order for another job not related to any Motorola radios.

It is possible to copy the NVRAM contents of one of these devices and use it in conjunction with the developer's kit to make a very simple
software emulation package. IF the softare that is dependent on the ibutton isn't keyed to a unique serial number, then the system is
hackable to a reasonable extent. But you'd have to be knowledgeable about what the contents of the ibutton are and how the software
that uses it actually operates with it.


Elroy

[mr.syntrx]

Even the serial number is not a serious problem.

Program any old microcontroller to emulate an iButton, and tell it to report whichever serial number you like, along with the original iButton's NVRAM contents.

[cbus]

I'm correct, and the ASK only effects trunked parts of the radio. So if you buy a radio that has trunking, you could not change those settings, without an ASK or an ASK daughter key (e.g. one created from the master ASK). It looks like your safe with conventional.

-Alex

Sorry, but I disagree.

If its been programmed with an Ibutton/ASK, you need that ASK even on conventional freq's!. I read a xts5k and attempted to modify the freq and channel name(on different writes) and both times it comes back as requiring a ASK. I am happy to take a screen shot for you. (radio ONLY has conventional data on it!.)

I have no idea if there are different "level" access. i.e. certain ibuttons block particular sections of the radio

[alex]

I'm correct, and the ASK only effects trunked parts of the radio. So if you buy a radio that has trunking, you could not change those settings, without an ASK or an ASK daughter key (e.g. one created from the master ASK). It looks like your safe with conventional.

-Alex

Sorry, but I disagree.

If its been programmed with an Ibutton/ASK, you need that ASK even on conventional freq's!. I read a xts5k and attempted to modify the freq and channel name(on different writes) and both times it comes back as requiring a ASK. I am happy to take a screen shot for you. (radio ONLY has conventional data on it!.)

I have no idea if there are different "level" access. i.e. certain ibuttons block particular sections of the radio

Does the radio have trunked data in the radio? If so, it would make sense that the key is then required, as you "could" be updating or otherwise programming trunked information.

The ASK Manager program does not allow restriction of conventional programming, but if a trunked system is programmed in the radio and your trying to just reprogram the conventional side, you would have an issue.

If you stay with conventional only, you shouldn't have to mess with the ASK.

-Alex

[Elroy Jetson]

It's inevitable that radios programmed on trunked systems, with ASK, will eventually start appearing on the surplus market...legitimately.

At that point, there's a really big question mark concerning access to the contents of the radio.

[HumHead]

Unfortunately, that is highly unlikely.

Motorola has no love at all for the secondary radio market, since they make no money from it. If used radios have to be scrapped rather than re-sold due to ASK issues I doubt there will be many tears shed at Motorola.

I just doesn't make sense for them to invest time and money in something that goes directly against their financial interests.

[mr.syntrx]

It's inevitable that radios programmed on trunked systems, with ASK, will eventually start appearing on the surplus market...legitimately.

At that point, there's a really big question mark concerning access to the contents of the radio.

Agencies selling off surplus radios really should be clearing them out before getting rid of them, as they would when they get rid of something like a computer; it's a serious security risk to drop still-programmed radios out onto the market. Unfortunately, some organisations aren't all that conscientious.

[Elroy Jetson]

But we all know that most agencies that surplus out radios for sale to the open market (or even to specific resellers or scrappers) rarely if ever actually do
get the radios deprogrammed.

I've seen cases of entire trunked systems, from the repeaters to the controllers to the mobile and portable radios, all sell as one lot and
if you cared to invest the time and effort to reassemble the system, it would have been completely functional when you were done,
without having to reprogram any radios.

Motorola can't stop agencies from selling off their old radios. Those old radios OFTEN end up being bought up by some of their OTHER
customers that don't have the huge budget required to buy all new radios all the time. Those buying customers are happy to get decent
radios for a fraction of the original cost.

Elroy

[MTS2000des]

Motorola usually offers agencies trade-ins if they want to prevent those units from showing up on the secondhand market. I know when our county bought their first Smartnet II system in 1993, they had STX821E's and Motorola then offered them an incredible deal to switch to the MTS2000 which had just been released. They took them up on it, only about a dozen STX radios "survived" as backup portables at the 911 center.

Motorola has no interest in servicing the secondhand market. Case in point is their choice to EOL RSS sales and support- we all know that a Genesis radio or Saber analog can probably survive another 20 years of use, but if the tools to service and program it are long NLA (as is the computer that can run the software), the radio is useless.

ASK was designed to keep out rogue radios. As far as one agency to another hand me downs, agency A would have no problem deprogramming the radios and removing their system key from the radios before passing them onto agency B. Our county did just that with many of their MTS2000's that didn't get traded in, they were passed on to another metro Atlanta agency needing radios.

[txshooter]

ASK was designed to keep out rogue radios. As far as one agency to another hand me downs, agency A would have no problem deprogramming the radios and removing their system key from the radios before passing them onto agency B. Our county did just that with many of their MTS2000's that didn't get traded in, they were passed on to another metro Atlanta agency needing radios.

The issue is not the deprogramming of the radio and removal of that agencies system key. The primary issue is that once a radio has been programmed with a ASK, it can not be reverted to being programmed with a regular system key ever again. Not every system manager is going to go with the ASK system right now. There are costs involved with this and also changes in how you would manage your system.

This really is a way for Motorola to control the secondary market. While many of use as used to 800Mhz trunked systems and how this will apply, there are also enough Trunking systems in UHF and VHF. This would make a UHF, VHF XTS5000 that had been programmed with a ASK virtually worthless on the secondary market.

[Elroy Jetson]

So someone who can reprogram the radio's memory "the hard way" with an unmolested, ESK-less codeplug will have a ready market for his services.

I would strongly advise that people retain an archival copy of their radio's codeplug, dating from the earliest time possible.

In fact, it might not be such a bad idea to start up a reference archive of codeplugs for all models and all flashcodes that people can
get their hands on. With minimal data, and no sensitive data, of course. This would undoubtedly come in handy if, say, someone
ends up with an ESK-ed XTS5000. Find a matching codeplug (model and flash code) and whoever it is who will hard-program the
EEPROM will use that codeplug as the basis for de-ESKing the radio.

I seriously doubt that anyone here will use the ESK feature on any radios they personally own unless they're a system admin
or closely connected to one, but eventually someone's going to buy a used radio that turns out to be ESK-enabled.
And that will likely need a cure.

I suspect, though, that Motorola will offer a cure via means of a trip to the depot. For $$$, of course.

Elroy

[PhillyPhoto]

I suspect, though, that Motorola will offer a cure via means of a trip to the depot. For $$$, of course.

I think your right in a way. Motorola may seem like they don't care about the secondary market, but they get plenty of money through servicing these radios. I would suspect that if they did offer a way to "clear" radios that had been programmed with ASKs, there would be a system setup to contact the originating agency to clear it first, and then charge the end user some big money to clean it up. They might tie into into the $350 flat rate or however much it would be. So spending 300+ dollars on a radio you just spent possibly over 1000 for, could be very likely.

Motorola makes long lasting products, and unfortunately for some second-hand users, this means they come at a high price, and are very tightly controlled. You can't get astro CPS very easily, even if all you wanted to do was use it as a conventional radio (which raises the question of a conventional only CPS, but I think we all know the odds of that).

I think I'll leave my rant there, as I can go off topic rather quickly .

[Elroy Jetson]

Is Astro CPS so hard to get, really?

I'm seriously considering buying the newest version. As I'm already an existing customer who has bought Astro CPS before,
this shouldn't be hard to do.

I guess they still use that master RSS/CPS licensing agreement system.

So are all Astro portables still bundled in one package, or if I want the CPS for my new XTS5000 and also need CPS for my Astro Sabers,
am I going to need two separate titles?




Elroy

[alex]

Is Astro CPS so hard to get, really?

I'm seriously considering buying the newest version. As I'm already an existing customer who has bought Astro CPS before,
this shouldn't be hard to do.

I guess they still use that master RSS/CPS licensing agreement system.

So are all Astro portables still bundled in one package, or if I want the CPS for my new XTS5000 and also need CPS for my Astro Sabers,
am I going to need two separate titles?

Elroy

Astro25 Portable -- covers XTS1500/2500/5000, MT1500, PR1500 portables... not to mention SSE5000's
Astro Portable - Covers Astro Saber and XTS3000.

Two different pieces of software, so of course, you must pay for them both.

-Alex

[motorola_otaku]

Is Astro CPS so hard to get, really?

I'm seriously considering buying the newest version. As I'm already an existing customer who has bought Astro CPS before,
this shouldn't be hard to do.

Not really. Software licensing is all handled through MOL now. Instead of faxing paperwork with signatures back and forth, you read through the agreement on MOL (reading optional.. it's under Resource Center --> Software Support) and click "I AGREE." Then, after a couple of weeks of them not doing anything, you call up Software Support and rattle some cages, and then after a few more days you can buy software. Actually getting a MOL account created seems to be where they do the controlling now. My company already had one when I came to work here, so I don't know how many hoops an individual would have to jump through to get one.

If you're already licensed, then it's even easier.. just call up 1-800-422-4210 and say "hey I need Astro25 CPS" and they'll quote you a price, ask for your credit card info, and then you're golden. First time I bought software the operator asked me if we already had a license agreement. The last two times, they didn't.

[Wicho]

..., so I don't know how many hoops an individual would have to jump through to get one.

Took me about three weeks of pestering M with calls and emails before my MOL account was set up. Once I was all set up and given the secret handshake, however, it went pretty smooth as far as signing the licensing agreement (online) and purchasing software.