I'm having difficulty finding documentation for the over-the-air protocols used by encrypted public safety radios. It seems that most systems are based on Project 25, previously known as APCO Project 25, now simply called P25, and that this encryption standard is based on AES-256.

What's not clear to me:

  1. Is P25 the state-of-the-art, it it an aspirational system that hasn't been deployed yet, or is it legacy?
  2. Is everything done with hard-coded symmetric keys, or is there public key to exchange the AES keys?
  • $\begingroup$ The 4th link is broken — the UPenn one $\endgroup$ Jul 27, 2023 at 11:49
  • $\begingroup$ The 2nd link is also broken — the DHS one $\endgroup$ Jul 28, 2023 at 9:13

1 Answer 1


P25 AFAIK does not include a radio to radio key exchange protocol. Keys are loaded onto the radio by a key fill device or over the air rekeying which relies on a long term per device key protects the key being loaded wirelessly onto the radio.

Here's a good talk by Matt Blaze about the P25 system (timestamp for algorithm/key details):


There's also some marketing material about Motorola's key management offerings that goes over the "features" their "solutions" can provide you that hint pretty well that it's just managing symmetric keys sent to radios.

In answer to your two questions:

  • certainly not state of the art
  • it uses only symmetric keys

Very much still in use though.

The obvious downside to putting a single primary (for transmit) and maybe a few secondary (decrypt) keys on each radio is user inconvenience. P25 radios can't interoperate in encrypted mode with radios not loaded with the same keys. In some cases this leads to users disabling encryption to allow for inter-agency communication ... which is bad.

Government/Military cryptosystems (that we know about) are usually centrally managed, with centrally chosen keys loaded into communications equipment.

There's a few reasons for this:

  • Asymmetric cryptography relies on strictly weaker assumptions than Symmetric cryptography.
  • It is speculated that governments might design their encryption algorithms with a mathematical backdoor in the form of weak keys. The algorithm designers know about the weakness and can mitigate it by choosing only strong keys for distribution. An adversary who discovers and uses the algorithm does not know about this and if using random keys will use weak, easily attacked keys, some of the time.
  • any key exchange protocol will need authentication of the other party anyways. This means a centralized structure to certify devices and their owners. If you need a centralized infrastructure anyways, why not just fill devices with keys as needed?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.