E.F. Johnson Viking VM600 Series, Operating Manual

Page: 142 / 188

8-10 Viking VM600 Mobile Radio Operating Manual
Secure Communication (Encryption)
8.5 Over-The-Air Rekeying (OTAR)
OTAR stands for “Over-The Air-Rekeying”. This is the process of sending encryption
keys and related key management messages over-the-air to specific radios. The advantage
of OTAR is that it allows these keys to be quickly and conveniently updated when
necessary. It is no longer necessary to periodically travel to the radio location or bring the
radio into a maintenance facility to load new keys.
The actual OTAR rekeying functions are performed by a Key Management Facility
(KMF) that sends Key Management Messages (KMM) to the RSI (Radio Set Identifier)
assigned to a specific radio or radios. These messages are themselves encrypted using a
unique key called the UKUK (Unique Key Encryption Key). Radios must be OTAR-
compatible, programmed for OTAR, and the UKEK loaded for OTAR for this type of
rekeying to occur.
Note
The RSI is enabled in the KMF and must be assigned to the radio under OTAR in Armada.
OTAR is available only on P25 conventional and trunked channels, and only to program
DES-OFB and AES keys. It is not used on SMARTNET/SmartZone channels or to load
DES keys.
8.5.1 Encryption Key Types
There are two types of keys used with OTAR:
Traffic Encryption Key (TEK) - The key used to encrypt voice and data traffic. All
radios using encryption must have at least one of these keys.
Key Encryption Key (KEK) - The key used to encrypt keys contained in OTAR Key
Management Messages (KMMs). All radios which use OTAR must contain at least one
of these keys. The KEK used to decrypt/encrypt keys in an OTAR message is defined
by the algorithm and key IDs transmitted in the decryption instructions field. A KEK
may be unique to a particular radio (UKEK) or common to a group of radios (CKEK).
The SMA or KVL-3000 create only UKEKs, therefore you create and load UKEKs
before using OTAR.
8.5.2 Keysets
To simplify key management, OTAR divides the TEK keyspace into multiple sets. Exactly
one of these sets is said to be active at any given time, and only keys in the currently active
set will be selected for use when encrypting voice traffic. The Viking VM600 radio
supports two such keysets, Keyset 1 and Keyset 2. The valid SLN range for Keyset 1 and
Keyset 2 is 1 through 4095. Viking VM600 radios can be assigned up to 64 SLNs in this
range. See Figure 8.1.
Draft 4/29/2014