Polyglots and Chimeras in Digital Radio Modes

Video in TIB AV-Portal: Polyglots and Chimeras in Digital Radio Modes

Formal Metadata

Polyglots and Chimeras in Digital Radio Modes
Featuring Practical Matryoshka Protocols for a 21st Century Numbers Station
Alternative Title
A Protocol for Leibowitz
Title of Series
Part Number
Number of Parts
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Release Date

Content Metadata

Subject Area
Ah Matryoshkas, who doesn't like these Russian nesting dolls? But why should the fun of chimeric nesting be limited to just application formats? It is possible to design PHY-layer digital modulation protocols that (1) are backward compatible with existing standards and (2) discretely contain additional information for reception by those who know the right tricks. When properly designed, these polyglot protocols look and sound much like the older protocols, causing an eavesdropping Eve to believe she has sniffed the contents of a transmission when in fact a second, hidden message is hitching a ride on the transmission. Mallory, on the other hand, may use these protocols-in-protocols to smuggle long Russian stories to all who will listen! This fine technical lecture by two neighborly gentlemen describes techniques for designing polyglot modulation protocols, as well as concrete examples of such protocols that are fit for use in international shortwave radio communication.
Atomic number Order (biology) Shared memory Event horizon Communications protocol Annihilator (ring theory)
Turing test Android (robot) State of matter Virtual machine Numbering scheme Web browser Client (computing) Mereology Bookmark (World Wide Web) Power (physics) Sign (mathematics) Semiconductor memory Different (Kate Ryan album) String (computer science) Computer hardware Information security Physical system Noise (electronics) Key (cryptography) Forcing (mathematics) Prisoner's dilemma Moment (mathematics) Cryptography Parsing Electronic signature Message passing Radius Computer animation Interpreter (computing) output Reading (process) Spacetime Asynchronous Transfer Mode
Noise (electronics) Data transmission Differential (mechanical device) Multiplication sign Virtual machine Similarity (geometry) Primitive (album) Frame problem Steganography Portable communications device Message passing Radius Computer animation Bit rate Personal digital assistant Different (Kate Ryan album) String (computer science) Pattern language Transmissionskoeffizient Quicksort
Message passing Physicalism Monster group
Axiom of choice Sine Group action Digital electronics Clique-width Plotter Multiplication sign Source code Virtual machine Student's t-test Distance Mereology Trigonometric functions Power (physics) Frequency Sign (mathematics) Mathematics CAN bus Bit rate Different (Kate Ryan album) Operator (mathematics) Negative number Electronic visual display OSI model Alpha (investment) God Theory of relativity Fourier series Forcing (mathematics) Volume (thermodynamics) Fehlererkennung Communications protocol Entire function Band matrix Wave Database normalization Computer animation Phase transition Order (biology) Charge carrier Video game Right angle Musical ensemble Quicksort Mathematician Active contour model Resultant
Laptop Sine Vorwärtsfehlerkorrektur Digital electronics Workstation <Musikinstrument> Numbering scheme Graph coloring Frequency Differenz <Mathematik> Centralizer and normalizer Bit rate Different (Kate Ryan album) Operator (mathematics) Negative number Diagram Position operator Exception handling Form (programming) Information Physical law Interactive television Bit Symbol table Band matrix Category of being Particle system Wave Database normalization Computer animation Order (biology) Charge carrier Transmissionskoeffizient Musical ensemble Mathematician Pressure
Serial port Length Parity (mathematics) 40 (number) Multiplication sign Execution unit Virtual machine Numbering scheme Graph coloring Frequency Punched tape Bit rate Hacker (term) Operator (mathematics) Codierung <Programmierung> Position operator Bit Line (geometry) Library catalog Communications protocol Transmitter Type theory Message passing Radius Computer animation Software Order (biology) Right angle Reading (process)
Point (geometry) Functional (mathematics) Serial port Multiplication sign Function (mathematics) Food energy Power (physics) Number Neuroinformatik Frequency Sign (mathematics) Synchronization Diagram Data conversion Data transmission Moment (mathematics) Bit Sound card Cartesian coordinate system Storage area network Communications protocol Transmitter Logikanalysator Type theory Film editing Radius Computer animation Personal digital assistant Graphics software output Right angle Transmissionskoeffizient Quicksort Collision Window
Shift operator Range (statistics) Bit Water vapor Context-sensitive language Sound card Communications protocol Symbol table Number Medical imaging Frequency Punched tape Radius Personal digital assistant Alphabet (computer science) Order (biology) Figurate number
Shift operator Latin square Multiplication sign Workstation <Musikinstrument> Keyboard shortcut Combinational logic Cartesian coordinate system Disk read-and-write head Sequence Symbol table Formal language Type theory Message passing Computer animation Synchronization Personal digital assistant Order (biology) Finite-state machine Codierung <Programmierung> Figurate number Asynchronous Transfer Mode
Data transmission Message passing Computer animation Key (cryptography) Multiplication sign Floating point Software testing Data conversion Quicksort Communications protocol Symbol table Computer worm
Sine Multiplication sign Modal logic Numbering scheme Translation (relic) Trigonometric functions Computer programming Power (physics) Neuroinformatik Frequency Goodness of fit Bit rate Single-precision floating-point format Data conversion Position operator Fitness function Bit Fourier transform Line (geometry) Interprozesskommunikation Communications protocol Symbol table Band matrix Type theory Message passing Wave Process (computing) Order (biology) Phase transition Whiteboard Musical ensemble Spacetime
Shift operator Multiplication sign Moment (mathematics) Bit Line (geometry) Drop (liquid) Band matrix Membrane keyboard Sign (mathematics) Mathematics Wave Elementary arithmetic Computer animation Scalar field Phase transition Order (biology) Transmissionskoeffizient Quicksort Metropolitan area network Inverter (logic gate)
Point (geometry) Vorwärtsfehlerkorrektur Digital electronics Range (statistics) Execution unit Virtual machine 1 (number) Numbering scheme Water vapor Inverse element Mereology Thresholding (image processing) Product (business) Frequency Sign (mathematics) Internetworking Alphabet (computer science) Authorization Exception handling Data transmission Cellular automaton Binary code Bit Line (geometry) Sound card System call Symbol table Category of being Type theory Radical (chemistry) Wave Computer animation Personal digital assistant Phase transition Order (biology) Table (information)
Group action Divisor Length Real number Multiplication sign View (database) Workstation <Musikinstrument> Event horizon Trigonometric functions Number Neuroinformatik Power (physics) Revision control Frequency Sign (mathematics) Bit rate Videoconferencing Integer Sampling (music) Error message Position operator Area Noise (electronics) Multiplication Sampling (statistics) Bit Audio file format Volume (thermodynamics) Sound card Variable (mathematics) Symbol table Particle system Subject indexing Message passing Inversion (music) Computer animation Personal digital assistant Order (biology) Phase transition Buffer solution Window
Greatest element Sine Computer file Length Multiplication sign Control flow Drop (liquid) Shape (magazine) Power (physics) Revision control Fraction (mathematics) Frequency Sign (mathematics) Harmonic analysis Boundary value problem Touchscreen Fourier series Sampling (statistics) Volume (thermodynamics) Line (geometry) Variable (mathematics) Symbol table 10 (number) Subject indexing Wave Inversion (music) Computer animation Phase transition Musical ensemble Spectrum (functional analysis)
Trail Greatest element Fourier series 1 (number) Shape (magazine) Drop (liquid) Power (physics) Frequency Sign (mathematics) Wave Message passing Computer animation Envelope (mathematics) Phase transition Interpreter (computing) Waveform Lie group Computer-assisted translation
Vorwärtsfehlerkorrektur Implementation Digital electronics Multiplication sign 1 (number) Numbering scheme Open set Food energy Revision control Mathematics Goodness of fit Operator (mathematics) String (computer science) Error message Noise (electronics) Dot product Data transmission Touchscreen Key (cryptography) Bit error rate Bit Communications protocol Frame problem Symbol table Particle system Message passing Wave Computer animation Personal digital assistant Phase transition Charge carrier Escape character Quicksort Spacetime
Point (geometry) Pulse (signal processing) Vorwärtsfehlerkorrektur Service (economics) Computer file Multiplication sign 1 (number) Virtual machine Heat transfer Neuroinformatik Frequency Computer configuration Proxy server Scripting language Area Noise (electronics) Touchscreen Data storage device Bit Communications protocol Transmitter Band matrix Data mining Particle system Wave Computer animation Software Charge carrier Video game Right angle Local ring
Complex (psychology) Wage labour Block (periodic table) Differential (mechanical device) Multiplication sign Digitizing Fehlererkennung Communications protocol Power (physics) Message passing Mechanism design Maize Computer animation Forest Quicksort Wireless LAN Form (programming) Probability density function
the there be the who do that if you look at the this if over a highly off and so have any of you red and I don't know I can't see you from here and they have the lights set up to them to help sympathize severe hangovers and I was really polite of them for you for your perspective so apparent since I I can't see you could you please share if you read the Henry Miller Jr novel as a chemical for that's thank you know about OK so again over the events is about a Jewish electrical engineer who founded a Catholic monastery after an atomic war in order to protect books from the the dark ages and the novel takes place 500 years 15 hundred years and 2 thousand 500 years after the war takes place Leibovitz is never actually in and and it it describes this morality of smuggling books and reproducing books and sharing books as a fundamental piece of the religious faith of the characters in the novel so of for this talk I would have radio protocols which
could conceivably be used in some of unlikely nuclear nuclear future us so there you have it matryoshka as nesting dolls and book linking there's if you will the so when you say a radio Isaiah pausa I'm not a hardware guy however my favorite of past is seen how courses get broken and radios are courses to a radio is this kind of a parser that starts with a physical signal them somehow gets that packet which some people call frame out of just as any parser is driven by input that we can generate we can generate with inexpensive radios and sometimes with tube radius and if you've been following our considered you should have seen are that you can actually generate quite a lot with very cheap radios and again those are very simple machines they don't have all that much extra space a like a real pasta which can correct memory and then have a state explosion in which you can drive pretty much anything any Turing
machine but they did have some extra state and they do have some unusual behavior the it so what is that unusual behavior mostly it's meet many 1st of self as positive so in the noiseless forces and this is important are we're going to see that noise makes a lot more interesting so in wireless forces beside the normal behavior when you exploit the thing with crafted input drive it into a corrupted state and then you drive it all the way to road show but to for a Turing complete power maybe or maybe not I so this is the moment scenario but there is enough in which you think to posses the same signal the same string and they produced 2 different readings of 2 different interpretations of the now it me security schemes that depend on passes passing the same string the same way In this is actually a strict security requirements 6 5 0 9 for example depends on you the year signing the same common name the same the fact that that the client a browser would then see enjoyed Nestor key again depends on you passing this packet but this package in which your obligation isn't checking the signature mn install it interpreting the sign part give that the the same way as the cripple cited otherwise you have the Android master key way in our you have 2 different courses 2 different kinds of prison may simply different so In crypt or this is a known of failure mode with yes you've checked the signature but what is the signature all right in a way that makes cryptic the system's problem coating again your passes
must agree now that is without noise the you noise things become a lot more interesting invite you can have 2 passes that is to say to radios interpreting the world completely differently in 1 hour radius you I am healing really loud with a really high signal while the other here is nothing at all and registers no rates a why because I'm simply using a shorter preamble or I'm putting some garbage between the preamble in the start of frame delimiter in 1 radio here's frames the other doesn't then of course the start of frame delimiter itself may be corrupted by noise in which case you get the packet and packet about which we presented a while ago that it gets weirder but Travis is 1 8th of a new both of which you will find the previous edition of our pocket cheerful a few issues that is we're actually able to be injected a raw 1 packet controlling only layer 7 data and none of the bytes of the layer 1 packet that we injected were visible in the layer 7 data that we transmitted the and the way that we did it was we looked at the physical layer and we realized that the letters were sort of the same pattern shifted off from each other so if we transmitted 1 letter higher and waited for the time for the the time between transmission reception to realign everything we created a message that did not contain any of the blacklisted strings and this letter is bypass a pattern packet defense so you can read about this but the article is that noise
makes things really 0 look more interesting is the 3rd player that really makes it fun and so for this talk we're going to look at something similar but where we're going to manipulate it what is the transmitter to produce signals that the standard receiver would more here or here differently than another standard receiver that you white confusable steganography where no what exactly pursuing steganography our goal is to understand how those digital receivers work what sort of primitive machines they are in what the differences are so this is more about coarser differentials in digital radio portables but bootlegging is also an auction you know you think
it's on nesting dolls but in fact but there is a message inside maybe a next what may be 1 of those wasn't controlled things so you or certain are built to extract a particular kind of mess then it may well be and we're going to show that other isn't it possible that you can construct a signal that 2 different standard receivers will see are completely differently if you run it through 1 receiver you get there if you are run through another here you get the books that but it's 1 and the
same signal so how to make this you know how to build those monsters swelled for that will have to look at the of basic physics of radio
waves and all we are asking your forgiveness of for this review so when we talk about these at the physical layer we do that because the tricks that you can perform at the physical layer and if you only play with it at the higher layers these protocols have uh pretty much no higher layers so the as they lacked packets they lack them the the modern conveniences that have come from the fiction of the OSI seven-layer model and but also make them good protocols to study for a couple of different reasons the 1st is that these transmit over incredible distances and I can transmit from my apartment in America a signal by a radio antenna on the roof using a 20th of the power of a light bulb and that signal the audible in Argentina or in Europe I'm not needed to Asia yet but I hope to sometime soon maybe better antenna would fix that so it will be a very short book so these are rather small but there are you know this is our world we can play with modulation I that will work particularly well of war the phi circuits because their built to detect only 1 kind of modulation decoded and how we can build public what's this way we can play with error correction which is just this additional part of the weird machine that rewrites the signal helpfully for your as a did the 1 8th of animal physically then can with encoding and it should be noticed for those him protocols encoding is a very loose and very forgiving because they are actually meant to be about tedium by people so here's our world 1st there is the echo amplitude but you have your signal in you are on it are you multiply that signaled by your terior way now of course the world is made of science is just such a thing that if you have a contour it's easier for you to send a signed wave and just about anything are or you can vary so the frequency again you work signal now is not the uh amplitude of your sine wave but instead it's um a it's of frequency as looking at this animation you can see in the the raw signal at the top that's the 1 that you actually wanna get to the other radio amplitude modulation is that you have a really really fast signal and you just change its strength in time with the the audience in only 1 of 4 on top of it for F and you have found 0 0 wave that you're increasing the frequency of a decrease in the frequency of it in order to contain the same information and you're doing it so fast that and the receivers and it spreads out and these are roughly is wide but they have drastically different behaviors for example in FM the same amount of power is being put into the channel despite what the did the strength of the original signal is so you don't have that you're volume is sort of encoded by how far you drift away from the center instead of by how high up the signal peaks so it's much easier for you to correctly get the the volume right on a strong signal and a weak signal FM than it is in an and is also take different amounts of bandwidth so am takes less than with the name and an FM does and will be dealing with a protocol called single-sideband that takes even less yeah so that these are the 3 things that you control 1 of them is of fates with the phase you can think of having 2 forces 1 hour is say a sign in the order is a negative sign or for sources sine cosine our negative sign negative cosine then then you decide by using a switch which 1 you feed to the antenna so the phase transitions of this picture is a y because you want to of weed out those are rapid a transitions and phase a you want to bring your amplitude down of 2 0 that aren't that transition but not if not the amplitude that matters it's the face it's which 1 are you're getting so as the mathematicians are you look at this and use world of signs all you need is a lot of them are all you need is finds an old you have inside then you have the choice or what to do with that sign you can multiply by your signal or you can add the signal to the carrier frequency or you can add the signal to the phase which are if you had too much will actually I make your sign into a cosine uh so these are 2 different from uh uh modulations before his small changes what in are in phase the result is a bunch of signs in any way and you see that in your waterfall a display so now when you were a amplitude changes with a particular our rate itself then in the Fourier transform that just gives you away somewhere between year period and you exterior plots that rate and you a cure minds that rate so you see in Europe or waterfall displays this kind of a population of signs of that uh you you get out of the free accounts this is the ban on the you can think of the m the width of this band as twice the rate with which you're signal changes that be added to are the amplitude and to the frequency or to the face of course the 1 does a freer transform 1 receive this is just a mathematicians and are instead are you have circuits that actually extract of the signal in reconstruct the 80 in the air for the alpha for you and by the way this is an alpha because the 2 was not available in about them Kino and so on the so will be cursing
a lot more in this lecture especially when I find myself desperate enough to open up a can of those indicates so if anyone has any real life here in the audience that appreciate about all of them set an amateur radio operator things about this differently and we use what's called upper sideband modulation a room which is sort of like half of a and you take a and cut out all the redundancies so the end result of upper sideband is it is taking something that's at a radio frequency and you're shifting it down until it had an audio frequency and that all the distances between things remain the same so it is found that say the radio frequency where 1 megahertz and there's a radio sine wave at 1 megahertz plus 1 kilohertz and 300 hertz above that there's another sine wave well when I a downshift that by an upper sideband radio tuned to 1 megahertz I wind up with a 1 kilohertz tone and a 1 . 3 kilohertz to the same distance from each other 0 god bless you search can be because so you could ask and you shall receive no no a glass the it I mean entering the entire bottle among students so if if they are that you're a radio spectrum is just downshifted audio frequencies and related style comes a a lower sideband redo the same thing but you flip it upside down in the and and that's usually only used for voice and never for data this so when 2nd the radio operator also see
is there difference between frequency-shift keying and phase-shift keying but the operator sees it visually not but I'm not conceptually so much so and frequency-shift keying visually it looks like 2 separate sine waves there are separate from each other's 2 peaks in the waterfall diagram phase-shift keying that looks different it looks like a single sine wave so he could be Morse code except it's just a little bit too wide and the faster you make the symbol rate the wider it becomes so PSK 31 it is nice narrow and in uh PSK 63 is twice as wide as that the the the data rates in these particles are very low because they're designed to fit within the audio channel you have to be able to run an audio cable from your shortwave receiver to your laptop to decode it and a another cable from your laptop's microphone a speaker Jack out to the radio in order to so when I 1st saw the upper side then trick I did not quite understand why and what it what's and then after through or some interaction between the form mathematician and negative and get to get my him license please do not blame me do not try to put more pressure on me to get 1 I finally it turned out that it's a very simple thing basically when you Jews Fourier-transform you get for every sine wave that is your carrier plus something you get another sine wave that's your carrier minus something which carries the exactly the same information so long as the modulation scheme was comfort it is uh concern it just takes twice the bandwidth so it's likely are subway some non spreading the color you have 1 of those things are apparently can get arrested for that the New York and so what we do is we just cut the law half now that's a very drastic way to deal with that but so you reduce the redundancy but you are not shorten the band with a bike off so you just left with 1 are kind of sine waves which a carrier plus something not carrier minus that exact same thing and that's the upper sideband modulation so and there you go that's s appear as it was made from this and the other thing to note is that the central spike gets cut out an upper sideband modulation these central spike in AM radio occurs at the position of that would be 0 hertz and audio so it doesn't actually contain any information instead it acts as a way to allow the receiver to know where the transmitter is centered so that if the receiver and the transmitter disagree a little bit in a and you still get a clean signal that way and my father in his 57 Studebaker can listen to a modern AM radio station and here it correctly even though that's due to Baker has no chance in hell of accurately generating um a reference clock In single-sideband modulation you have to generate your own reference clock and reverts wrong that that adds to or subtracts from the frequency of the thing you listen to so if you're off by just a few hertz as an adult voice will turn into a child mammal turn into woman or vise versa so but again this is the wonderful world in which it's all about the receiving circuit it's all about the pasture in so we can actually of high quite a bit of information and have quite a few public lots by using those properties so we're going to skip the story but largely which you will
find in the upper liquidity of for why you might want to do that I hope here we need to convince no 1 that book linking is a good thing and of furthermore that the dystopia in which we have to do it uh is well kind of upon us by show of hands is anyone here opposed to reading and I get out the at but of course but now we have this
self and the situation in which the book lighting is done by really large antennas is see you have like a little of the heart out the wood somewhere you run some gigantic wires off of that they have to be a specific length to match the frequency the transmitting were skipping over that here but if there is any amateur radio book should explain this to you I should stress so that the modulation tricks in the receiver tricks are the same for grown-up protocols of course these have much faster than the rate but they have the same modulation schemes were of build on existing modulation schemes that are we're going to talk about PSK for example is what you would find that so so the 1st protocol we're going to discuss is
called RTT wine it was also called reading and reading it is a military protocol from the late thirties and early forties this is used in practice in World War 2 the idea is that you have a a ticker and the ticker tape on the right is a from our military teletypewriter that was brought to the fore the most recent Dutch hacker camp and and uh they actually had 2 of them wired up so you can send a signal between each other and any is of Bordeaux tape which is the the paper tape that you see on the right you'll notice that there are 5 bit positions 1 and that there is like a center line that has smaller holes and the line is used for timing in order to transmit a message of this machine that you 1st type it into a typewriter which punches the the holes that you see here and then it you take that tape and you run into the radio transmitter and radio transmitter feeds it through and runs it into an FSK modulator In order to send a radius all that the other unit could receive and to the nifty thing about this is that a ton of military surplus equipment was available in the wake of the Korean War and this bound up in amateur Hans and so and and this encoding is kind of very much like a serial port you have 5 data bits you have no parity bits and you have to stop it so if anyone here is old enough to remember 81 this is just 5 and 2 more than you actually I said well I know will just put the picture of a serial port interest said it it's all older than that for the would this definitely predates the D B 9 connector and a website pretentious name for the D B 9 connector once finally get standardized any with this is a picture of the machine from an original catalog that have not been able to find a vintage picture in color in modern times the operator will use software that's compatible with so
the audio is run out from the sound card outside out from the radio to the sound card and back from san kinds output to be as input and any sort of go blind when you're transmitting because new transmitter sending so much power that you're not able to receive in the same frequency at the same time but then of course you always do in your wife Wi-Fi you have exactly the same situation and a collision avoidance is another MAC protocols are developed specifically for you to dancers dance without stepping on anyone's transmissions of because you can't unlike Evernet here that somebody into your transmission these upper left of this window shows the frequency that the radius tends to you either synchronizes manually or you run a serial port from your computer to your radio as I have some ideas back in America that I can access from here of 3 SSH and I can have transmit the as examples of ensuring today the and here the this is all of these people transmits CQ CQ CQ which means how as I learned yeah they're they're not been for long conversations I think they're constantly impressed with the functioning of hundred years so as you can see here that the radius Tunis to a little bit higher than 14 megahertz of 40 megahertz and 70 kilohertz and then it you'll notice that there is a smaller number to the right which is 1 4 0 7 1 . 0 8 5 and that is the center frequency that has been selected In the graphical program and because you're at your upper sideband receiver has a radio frequency that is changed to but your actual signal is based on a really cancer that's a bit higher so you need both numbers and at the bottom there's a waterfall diagram that shows you what the frequencies of the sound look like in this case here X is the frequency of your y axis is time and the brightness is the amount of energy on that frequency at that point in time here if you have to FSK signal she to see that the and the signal itself is centered on 2 different frequencies which our 45 megahertz apart as a 45 hour xi 174 support so at the receiver sort of cuts the them in half and all its listening for is whether there's more energy in the higher side or the lower side at that moment in time and that gives it the serial port signal and it goes up and down just like you would see if you put a logic analyser on the you arts in an odd so again all you have as signs in moreover you need to compare those signs as you receive them this is the shifting In apart but that's the whole as much as there is to this modulation but you know you can transmit pictures like in people and a clever things it there it does this make the RTT TTY
artwork that looks very much like ASCII art work and this is uh Seattle slow who is an American begin racing deleted when and there is something else to notice notice where this is centered now this is the audio frequency this is the down-shifted signals it has been shifted from the are actual radio our carry
here but you need a range of frequencies that you can hear in sound card can produce so if 19 fifties technology you would line up with the Giants full of paper tape and running that paper-tape India receiver would produce this um text art image in the 19 seventies you would have uh
reel-to-reel tape recorder and you would record the audio tones and play those back in order to recreate the message and in 2015 you just copy and paste it and there's a lot less sport to it the alphabet used in this protocol is quite different from ASCII that you're used to and 1 thing that you'll notice is that this protocol does not have a concept of upper and lower case letters all the letters the upper case the other than legal notice is that for these 5 bit patterns they can be either a letter or symbol and the way that they implement both is that there are commands that will shift to figures or shift to letters so if you send the command ship to figures then it it stops interpreting the future bytes as letters and it knows each 1 of them will be assembled like a common our question mark or number the conversely if you send the letters command it jumps back to figures it as I said letters that it switches back to letters from figures and begins to send a letter a letter being and so on this is what we would call a context-sensitive protocol in order to know what you're hearing you should have heard the proper register 1st so if I were terribly thirsty after drinking of indicates that a canadian brand India pale ale water and is the stuff is guilty of everything about light is accused of but but light is at least honest in its uh advertising the things to good neighbors whenever 1 for a scorched yes thank you kindly again for that was so if I were drinking indicates that is really needed something that was not watery and I as it is to their gay agitated capitalist then it it we might send this over the radius something like that's a a anyone who reads rational note this is transliterated instead of translated and there's a reason for that so when
you send letters command it such as the letters mode and he said this sequence of bytes after has for vodkas the receiver will see for but the and notice that sooner or later need to add Cyrillic uh that is to say what could you protocol and for that the null character was used yes so it if you send the figs symbol 1st then everything after gets treated as um a number or as a symbol of w are you it is like a special characters of an entire character in this language that just means who the hell are you In order to for 1 station synchronize another station is also a bell symbol and so just like a Unix terminally can make the receiver start beeping if you don't like the guy on the other side of um and this when chat applications have died his head start ringing the bells you got mad that the null character with his co opted for Russian RTT transceivers in order to add up Cyrillic characters and in this case if your receiver could not support Cyrillic it would let it would render the same message in Latin because it doesn't know and that the null does anything else doesn't know that it's been overloaded to these recording these encodings are a loose and forgiving and again on how loose and how forgiving other well what if you were human typing those letters he is actually typing them on the keyboard rather than 1st of a punching them at to a tape and then running the tape whale then you have the idle tell literacy is the I 0 you just keep repeating it until there is an actual symbol and this is called uh
and now what happens if you run another shift character in are of the same way way I'll need a receiver are ignores so it doesn't actually know are would whether a you know a figure is coming or a letter is coming you can lead people those shift characters in any combination and for new limp of time before an actual character outcomes in the receiver will be non otherwise because this is a finite state machine only the very last 1 counts so you can stuff in warmer sequences of shifts in this encoding you can stop a beer in there this is a wonderful picture of the this is the wood of a beer is passing through the village in Siberia this is from
Europe in the 18th century when that sort of our ideas still reigns but we can do better these bears are now hearing useful payload the book lighting there's coming from the real so in in practice you would do send a message from bob alice uh in which never actually starts a conversation about us at least publicly instead what he does is he starts a conversation with a Jim Bob and Bob and Jim Bob that they just talk back and forth about the diabetes and diabetes testing supplies in but every time but it is kind of slow about hitting a key and bob is going to pretend to be a terrible typist for this transmission every time it's idling it can start sending 1 Hidden bit per symbol like so the now let's take another protocol is weak we can't do in a polyglot TTS were Camara's until we've done a 2nd protocol
and so the 2nd introduce you to is
called PSK 31 and this
is the 19 nineties replacement for RTT y so RTD why was designed the in the thirties in order to be used for military equipment and was used at a time in which short wave communication was often intentionally jammed but it was not accidentally jammed by over years he didn't have to worry about that too many people in occupied Paris sending messages to England you had to worry about the 1 died not getting shot and found so piscatory 1 is designed to be narrower than RT to what at the same time RTT why with is of at a very nice speed in the RTD wise translates characters about as fast as the average typist can keep up so it's a very good protocol for alive conversation but I can talk to you and I'm typing about as fast as it can get through when I'm done that you start talking a taking back to me and it cares about as fast as you can type and if you just trying to direct you is it's called this is a very good for and the symbol rate is 31 and 1 quarter board I which with run-length encoding and other things is about the same rate as you type but it also has a much narrower bandwidth and RTT why it only takes 60 hertz where's RTT widespread out by 150 years so you're able to fit tons of PSK 31 conversations into a single voice channel as he tended to come 0 28 . 1 2 0 0 megahertz you'll you'll see just the waterfall fill up with these different conversations and you can click on any of them in In the receiver in order to tell what this thing so here is finally something that actually does do the fourier transform in the receiver will it does the fourier transform in the receiver in order to visualize that's what the waterfall goes through and it's also it takes quite a bit of the processing power of the program if you have a terribly old computer or if you try to run this on a cell phone it's kind of common to turn off the waterfall after you found you're signal frequency in order to save power and computation and of course are again we want the least amount of B and at taken by any particular conversation because well a whole lot of people can hear each other of those waves travel quite far you don't want to or pollute the band of beyond necessity ACL that anti-black space you can fit multiple little yellow lines in their in order to have many conversations but again the the year modulation scheme is a pretty simple this time it's phase not frequency as with the market you white again you have a carrier in and then you have you the assigned work so this is the encoding so PSK 31 works by inverting the phase sine i which is a fancy way to say that you switch from the cosine of the absolute position
to the sign of the absolute position and multiply this by and a couple of scalars in order to stretch out the signal so that it's at the appropriate audio tone and so they the truck if you 1st sit down like a big cup of coffee and you try to implement this which you can do in a week and you'll find it that um and the 1st reading of think it should look like this top signal and in which the sine-wave just abruptly in in the middle decides to switch upside down and start going the other way I I would play this for you except that our friendly sound I would yell at me and all of you would yell at me because it sounds atrocious and we'll get to why in a 2nd a but notice before we go on or to that that this is a shift please encoding again you change in the phase to indicate a is 0 if you keep the phase as it was to indicate the 1 that you can't know which way was coming for you sign up course sign it's just a bright line 1 you waterfall I you don't know its initial phase however you can detect when the phase changes when the phase changes it should not change abruptly because that would hurt your years in that would actually do nasty things to the membrane of the speaker so at this size
it's a bit hard to see but the wave here is actually shrinking down to nothing and then growing back and it's at that moment when it's nothing that we invert the face so you visually you don't actually see the phase inverts and it by audio you almost can't hear it instead you hear the drop in amplitude the the whole signal sort of fades out this a little bit man comes right back um and we do this in order to reduce the artifacts when you abruptly change the face of a signal it spreads out over the entire bandwidth and starts interfering with other transmitters a we're actually going to see the example of the but now how to decode the so and if you'll forgive me for reiterating elementary school math the recall the positive and positive is a positive and you remember the negative times
negative is also a positive so what we're going to do is we're going to delay in the signal by just a little bit and then multiplied by itself and the way they were doing this is we're trying to make sure that the delayed signal if the faces the same will always I disagree with the as a sign of the new modern signal so that if it is now a positive if the face has not changed the old 1 was negative or vice-versa and when you do that on a sine wave that you find that you have what looks like a new sine wave it's just all beneath the 0 line the only exception is the phase is changed and in this case you multiplying a a a positive by positive or negative by negative and it will jump above the 0 line and so in the product of these 2 signals you just look to see where the peaks are and every gence above a certain threshold you know that that's where you're signal and that's how the decoding circuit would actually work it cares nothing for the amplitude it here is of not that much for the frequency so long as you don't you face too much the and and just like RTD why there's a special alphabet for this it does not use ASCII and because as he is very efficient for Inverse text instead he it it tries to do like Morse code does where the short letters are kept short and added at the concept of upper and lower case letters to it and so this will find in the recon edition of property to follow if you zoom in on this table you'll notice that the lowercase A. shorter than the uppercase A. the lowercase be shorter than the upper case B and this is because as you type in a sentence there the 1st letter of each sentence is more likely to be capitalized but the majority of what's inside of the sentence is not when you do announcements if you're saying CQC UCQ call sign book that's all in upper case and because of that it takes a bit longer to transmit the notice something about the encoding scheme here but 1st of all every letter begins and ends with 1 right no all letter contains more than 1 0 in fact 2 or more zeros that separate letters that's the very cold of encoding conventions so what happens if you send me more than to use euros again you're circuit doesn't here your decoder latches on on the double
0 and add it can tolerate in as many of those years as you like if letter is about to long it will be ignored so that's how you could add Russian and call for more workers uh in that sky and this is how the original author of the original author of the pis k 31 protocol as British and at some point he tried to type the pound symbol into his terminal Internet work and he realize at that point pound was in the upper half of the ASCII table so in order to add support for that he just added up all of the upper 128 symbols of of asking all at once and if your local code that matters this of course predates unit code I'm and he did this because the original code examples of the provided would ignore any symbol that was too long it we just assume that it was a transmission would throw it out so by sending ones that were longer than that he knew that they would not be interpreted as anything else but we know that further than that we can have thousands of bits in a row and the common receiver is don't actually look up at the letter is until they get that final 0 0 to have large binaries thrown in the middle the PSK 31 transmission that at the end of the day look like a single misinterpreted letter to the receiver so again you can have a whole herd of bears a passing through unbeknownst to the receiving cell but then of course all of these are in coding tricks coding tricks water let's do something more interesting and schizophrenia let you fight tricks so at this point I'm going to play for you a a uh PSK 31 sounds even a feel for how it is comes in over the air so imagine a set up like this you have a machine with a song part In you feed that of through the sound card to the radio it's this out all your range that you can actually hear In the end
of the year AD or will then shifted and uh centered off around the key area so as I play this now keep in mind that someone who has a good copy this audio recording perhaps in the video can decode the message is being transmitted after the fact because it carries through just like motor noise but it's such a lower rate but it's more error tolerance how the signals coming here and waving in amplitude our the that's when a 0 crossing occurs in the wrong being the power of the signal in order to make sure that it finishes uh clearly a zero-crossing without spelling out of bed and in a real world use I would run an audio cable from my computer to my short wave radio and tell the radio to transmit whenever heard noise and the event cases for Cuban numbers stations where they've been able to identify which version of Windows they run because the here the Windows XP start-up noise on that frequency every couple of days and this is where highly recommend that you use a secondary sound card the so it's not all that hard to make those symbol to make those signals I here is a bit of op Python the mass but that does that so the
1st thing that you need is your audio sample rate and most of you are if you do audio work stick to 44 . 1 kilohertz as a sample rate because that is used by an audio CD and unfortunately when this particle is designed in the nineties audio CDs still rather rare and the extended thing to work for was and audio DSP and audio DSP is worked on samples of a multiples of 8 kilohertz so in this case we use 48 kilohertz in order to make everything evenly divide and we also need to choose a volume and in my case I wanted my signal be rather weak because I have a friend down the street who also plays of amateur radio news frequencies and I didn't want to jam his entire view of the world by transmitting too loudly for him to Europe yeah but you also need user devices in this case we're taking the audio rate which is 48 thousand and we're dividing that by a thousand in order to get 48 and you also need a length which is the integer number of samples per symbol but in this case audio rate divided by 31 . 2 5 which happens to be an even integer numbers samples for 48 kilohertz audio rates but not for 44 . 1 there are also some variables within Europeiska 31 generator but in this case I is going to be a sample index and that's the index within the sample so like from 0 to length and the next symbol it it starts over again at 0 I we do this so that the symbols can be loaded into a buffer and then copied and pasted elsewhere in the In the audio file without having to recompute them but also you'll find that in Python if you keep adding 1 symbol to a buffer things take forever and and the phase is just a 0 or 1 0 is for the initial phase of 1 is the opposite of that so we call a signing cosine workers sign from the receiver's position because it doesn't know where 0 is is might as well be the same thing and you will have this groups to play with so that a way to generate this is that the sample a given index is the sign of pi times the phase that's to give us our a phase inversion
plus 2 pi times the index over the either which is like the fraction through sampled we are and we multiply the whole thing by the volume and this sounds terrible for reasons we'll get back to in a 2nd but it produces that nice clean inversion of phase because the inverting the phase on 1 exact sample but is the we get a little mcdonald's lodges there in the middle the right way to do this is to filter out and when we filter it is that we add an attenuation variable in which the at 10 of i equals the sign of the index times pi divided by the length and what this does is it causes the signal strength of the entire symbol to begin at 0 work its way up to full volume and then drop back down to 0 for the next symbol and this version is slightly simplified in that I'm assuming that we are at transitioning on both this symbol and at the next symbol but if you wanted to keep everything at full power when you could you would instead make this only rise a drop on 1 side of the screen shot is in the bottom is that style in which whenever the phase is not changing the amplitude is not drop of these are in the audio spectrums of wave files were generated by each method you'll note that the 1 on the left is a nice clean thin green line with a few harmonics where it's
unavoidable and the harmonics are very thin and the very weak and also know that the 2nd 1 is a bright green and wherever you see like that horizontal green line but there's a speaker is making a really loud and annoying click um and then make 1 of those clicks every couple tens of milliseconds so as you listening to it the original signals there because still past message out of it but it's spewing out all over the spectrum and radio it spews out into adjacent audio channels to not only taking off the people were sharing the PSK 31 audio signal with you but also all the channels above and beneath you so there is a reason for that if you think about how this rapid transition at a high amplitude breaks down under the Fourier transform to represent this gap this non-continuous shape you need all kinds of sine waves you need sine waves with much higher frequency than your band and of course when you do your actual Fourier-transform your foster Fourier-transform you get those boundary artifacts at
so all kinds of those are higher and lower frequencies and uh of course the Fourier transforms tries to represent the shape all you or strange on sign piece of the wave as carefully as it as can at the same happens on the circuits if you're not using a filter in and out that's why you're getting so that spill over all over the place so the amplitude trick is actually essential uh it's a lie to show the PS without as enabled by the native Craig have here is here and as as describing this to in Boston uh he says laughing and he tells me that when he built appears get 31 Dakota he never paid attention to the phase it just look for that drop in amplitude but I'm and so the he taught me uh track and I love when you drink with people who like you standard paper to them and then they immediately think of how I did with it talking about but by a completely different method that happens also work on so his idea which also works is that you can bomb you can drop the amplitude anyways even tho it's not required during a 1 and so that the till waveforms here are as audacity and let the power envelopes are drastically different so that the above 1 I can visually
readers Kidscape 31 is like a bunch of zeros and then 1 and 0 and then a bunch of ones and then uh 0 at the end of the bottom 1 you cannot read visually and his interpreter will fail to see this because it sees everything is being a 0 um but the traditional commercial receivers and who will interpret the lower message fine and this trick works beautifully so here is not polyglot are quite unintended side you to create and we're going to mark those tricks with cats if you will the so here's another and the next
operator is a kiss 31 Morse code polyglot um these um if you listen
carefully from Hong Kong
Hong studied that that it out on our data on putting the bomb bomb I and this is my cousin were silent on but if you look deeper into it and you'll see that the uh this is a spectrogram left the top 1 the 1st day uh . but that it as the letter K. in
Morse code and in the upper does actually contains the letter k's PSK 31 so by encoding persuade him a message that is is valid as both PSK 31 and is Morse code in the same duration of the Morse code message would take and the only expense here is that instead of doing like uh simple carrier wave and spreading it out a little bit and keeping it is the escape 31 for copper covering um and you a real-world implementation of this you have to drop the PSK 31 amplitude to be very low but not actually 0 because we to 0 then the receiver loses track and start spewing noise industry under the screen so consider this is I a signal that is a valid for fortune receiving circuits at once it's different things to those different circuits the PSK receiver doesn't actually hear about the amplitude of of Craig's receiver in which a does in which case it does that whereas a Morse code receiver the on all of the receiver a does not care about things there and only cares about amplitude and if you do a similar thing to create PSK 31 RTD why polyglot i'm just by having to PSK 31 transmissions and rapidly changing which 1 of them is the stronger of the 2 and because the RTT wide receiver is trying to receive its bits with noise in the background so it's perfectly OK with a little bit of energy being on each channel all cares about is which 1 it is the more powerful and the escape anyone receiver only caring about phase allows for rapid changes in amplitude with at most 1 bit error so that's 1 sneaky cat of and and the single bit 1 nite in a string of zeroes happens to be a space so if you make sure that the error occurs on that bit it looks like a space to the receiver which is easy to read around and you can also do work with Adam and error correcting codes in these so PSK 31 does not have error correcting codes but QPS PSK 31 dots and a death this and past summer the polling it's presented a version of JET 65 in which the assignor rapidly encoding data with in the error correcting that's and it's even in the same thing in key PSK 31 worry many these other particles and there some of the open questions and stuff like if I send a very strong signal in which the that's a very clear and unintentionally flipping them then your receiver should be able to tell that I'm doing because you'll visually see that it's very good signal and you'll also see that the bit error rate is garbage but to the best of my knowledge no 1 was written as a tool at least for the amateur radio particles maybe not of the higher particles either that actually looks to see like whether the error correcting that was intentionally transmitted and such a tool would not be terribly hard to make so this is a very important question whenever you have a protocol whenever you have a modulation scheme the 1st question should be what is you noise someone well as you normally so what does this sound like a normal because you know you sort of have this idea that you ways is uniform and random but it's not the fact that makes up packet possible is that for example in using the oriented to are 11 your noise comes in short bursts it kills a symbol for 2 know what the entire frame somehow I mean of course if you turn on the microwave them it's a different story up but your naturally occurring in ways that comes in short bursts 1 ever you have a circuit then it's built 2 are practical in ways that how we probably wallet of but what if you start playing with that noise what then what can you hide them so were running low on time but there's 1 thing this is so cool we had to include it and so the you've all seen this like crazy clip-art with the uh the Ethernet cable in the better just flying out of it no ones and zeros everywhere but it turns out that actually works
so and we all know the data runs everything that and we also know that you quite often control a piece of that data and you but you don't usually control it very well in your attack for example I
might control the Tor hidden services is running http and I control server-side scripts on that service and server-side scripts whenever a did it puts out goes down to your machine through the Tor network and and I don't know where your machine is I don't know exactly how to get there and I don't even really control the latency very good I'm but I do have a pretty good options as to how fast I supply data to the proxy so what I can do is I can send you like a burst data and I can sort of back off that's enough and and then I can censor more and then I can come back down so I sometimes 1 axletree data from that like for example uh if I suspect that someone in a particular area is accessing my hidden service I might want to identify the person right so the really handy if I could turn his home network into a radio transmitter and then drive around with receiver until I found the that so if I also like we've all done a Ethernet wiring and we've all been a little bit cheap about and 1 of the cheap things you can do is you can buy a bargain-basement that brand Ethernet switch and the other thing that you can do is you can have that when you untwist the pairs to crimp the even and twist them a little bit earlier makes it so much easier come so I made the mistake of doing this my apartment yet if you think of a theoretical it's not yet a planet mistake my partner but don't switch the slide and eliminate the menace data is my apartment and connected into this apartment remotely by SSH and I am looking at the waterfall and I see a giant chunk of noise right on a frequency that I wanna use and then I move over to another of virtual desktop on my Mac and this in a Mac actually stop sending packets when you're not viewing the screen or sends a a quite Lyttleton is something and and I moved back and from the waterfall I could see that the noise actually went away all to very thin carrier wave at exactly the time that I was looking away from and as soon as I came back to begin noisy and I didn't then go to the apartment and sitting in front of the computer I see that's very narrow I see that my interference is mostly gone away and start pirate movie instantly there's a bunch of noise everywhere but still we realized was that the interference is actually coming from the bad wiring and that you could transmit Morse code this way uh because the Non-Aligned protocol is successfully sent Morse code from my apartment down the street and remotely just by triggering large file transfers ensure ones no printer came just by sending a long pulse for a Diana a short pulse through dead as you'll see like a couple of points in between where other uses the same network created similar artifacts and but it being less bandwidth mine stands out and their cables were probably better in a 0 there on life I actually so is a shorter or out to the switch and so you 2 can do this we have to use the cool thing about these particles is that they're short wave which means that you can go to a local store and buy shortwave receiver and the having license can
transmit a signal with a ton of power from the northeast United States and this matches roughly where the signal gets to on a bad day on a good day it gets to Europe and South America and also for the fun places and so it's employing the next month I'm going to start transmitting sort of fox hunt signals are properly identifying without photography and of being all the other rules and that you can receive these pretty much anywhere in North America or in Europe if patient or in South America and you can record them and then you can try and find the hidden message in each signal so in the current issue of the book Reddy differ so that you will find an article about the desk on wireless village CTF but of course to come to that city if you had to come to it corn and then go to the wireless religion sit there with a long history of the and so what are the conclusions that are very simple protocols yet the use exactly the same machinery as the more complex protocols are the use of the same are kinds of modulation of free phase-shift keying
frequency-shift keying that is the grown-up protocols that we think of them as levers and the blocks as the simple mechanisms as the years but that you start practicing with and perhaps also sometimes build a huge pyramid with if you get enough if you put enough from patients and labor time so the same cost differentials abound in those protocols they should be understood and then with more expensive equipment you might actually be able to bring them the 2 up to the complexity a slope that to the more complicated protocols and out no longer quite limited to polyglot in just PDF or or j for j paired or the other kinds of those forms that the the Journal of appears UG cheerful comes and now you can have digital passes digital radio Poleglass what's out which that take advantage of both fly In encoding and sometimes even error correction so there is 5 go find it of our talk is meant to just show you some very simple examples of art where it can be found but of course at the further you go into that forest the more interesting and told thank you kindly as a dangerous says there's not enough time in the world so thank you for your but thank you thank you it should but of our and it