I'm having difficulty finding documentation for the over-the-air protocols used by encrypted public safety radios. It seems that most systems are based on Project 25, previously known as APCO Project 25, now simply called P25, and that this encryption standard is based on AES-256.
FPIC published a report in September 2016 entitled "Best Practices for Encryption in P25 Public Safety Land Mobile Radio Systems".
Clark et. al at University of Pennsylvania published a paper at Security 11 in which the P25 protocol was analyzed and found wanting. (Full Technical Report here.)
I found this NPSTC paper which strongly implies that there is no public key availability in the standards, but that paper is from January 9, 2018.
What's not clear to me:
- Is P25 the state-of-the-art, it it an aspirational system that hasn't been deployed yet, or is it legacy?
- Is everything done with hard-coded symmetric keys, or is there public key to exchange the AES keys?