Time-division speech scrambler SV12
Vericrypt 1100 was a
time-division speech scrambling device,
Brown Boveri and Company (BBC)
in Switzerland around 1980
as the successor to the Cryptophon 1100
with which it was compatible .
It was intended for use with narrow band VHF/UHF 2-way radios
and was widely used by Police Forces in Europe in the days before digital
encryption became mainstream. It is also known as SV12-1101
and by its military designator NSN 5810-12-188-5670.
The Vericrypt 1100 series can be seen as the miniaturised version of
the Cryptophon 1100
series, that was released six years earlier.
Unlike the Cryptophon, where the daily key was set by means of six
thumbwheels hidden behind a flap, the encryption keys of the Vericrypt
had to be entered by means of an external
The image on the right shows a typical Vericypt 1100 unit  with the
proprietary Vericrypt key loader  connected to the LEMO socket at the
front panel. The keypad on the key loader is used to enter the 6
digits of the crypto key.
Once the key is entered, it is stored inside a Static RAM chip
and retained by a small lithium battery so that it does not get
lost when power is cut-off. Like the Cryptophon, the Vericrypt
also has an internal or basic key, which is fixed in a PROM.
Is is currently unknown how it is changed.
Although the Vericrypt unit above has nearly the same dimemensions
as the older Cryptophon, the actual crypto module itself is much
smaller. At the heart of the device,
behind the lockable door, is
a removable unit
that has the same size and shape of an average
portable police radio.
It can be removed by pulling-out a knob
to the right of the door. At the rear of the crypto heart is a
25-way male plug that mates with a
female socket inside the unit.
The image on the right shows how the crypto unit is installed again.
The door should be locked to keep it in place.
The configuration shown above was used for mobile applications,
such as in a police car or a military vehicle. As the unit shown
here is green, it was probably used by the Army or the Border
Patrol. The green case merely acts as a carrier for the actual
1101 crypto unit. It houses quite a bit of additional electronics
though, which allows it to be connected to a telephone line as well.
There was another version of the carrier that had a socket for
the connection of a handset, to the right of the lockable door,
together with a switch and an indicator light. That version was
used for legacy installations in existing (police) cars.
Unlike the older Cryptophon,
the Vericrypt was suitable for portable
applications as well. By adding a
small adapter to the
bare crypto unit,
the device was converted to a
that was roughly the same size as a conventional handheld radio.
The image on the right shows the unit with the portable adapter
The portable adapter has a small rotary selector on its
front panel, probably for the selection of the key, plus two leads
with connectors at the end: a short one and a longer one.
The female connector was for connection of the handset, whilst the
male connected mated with the handset socket of the radio.
In other words: the unit was inserted between the handset
and the radio.
When using the Vericrypt, the user has to be aware of a 0.5 second
delay in the audio path. This is a feature of the
time-domain scrambling that is used here.
The Vericrypt 1100 could also be used
on telephone networks, although it does not have
echo cancellation on 2-wire networks .
The unit shown here was used for many years by a crime unit
of the Dutch police, who used it in a number of high-profile cases.
Note however, that this type of encryption is inherently unsafe.
Between 1978 and 1981, the Cryptophon 1100
and Vericrypt 1100 were tested
by a number of West-German agencies, such as the police, the Ministry of
Internal Affairs and the
German Intelligence Agency (BND).
They considered the system safe and between 1981 and 1982, a large number
of Cryptophon and Vericrypt 1100 units were installed with the various agencies.
In 1983 the East-German cipher bureau managed to break the cipher by
reconstructing the keys from a series of intercepts.
They also built their own equivalent of the Cryptophon, known as the
A-003, that was used in the breaks.
Another device, the so-called A-004,
was used to decipher the Vericrypt 1100.
As a result, they managed to read about 90% of the West-German Cryptophon
1100 and Vericrypt 1100-based radio traffic
during the 2nd quarter of 1988 .
The interior consists of two printed circuit boards (PCBs)
that are mounted together as a
One PCB, the digital board,
acts as the carrier to which the rear panel (i.e. the
25-way male sub-D connector) is fitted. The other board contains
the analogue electronics.
The boards are connected together by
means of a long row of pins
along one of the long sides (blue strip).
The analogue board is held in place by four bolts at the corners.
After removing these bolts, the board can be taken out, as shown
in the image on the right.
It contains the main oscillator.
The digital board
is densely populated and hold a number of
components that are marked with OEM numbers. Nevertheless, we can
make a few 'educated guesses'. At the bottom left is the
(the white LN1091E) with a PROM or masked-ROM just
above it (LN1281E).
To the right of the processor are two Harris HM1-6504 CMOS RAM chips
that can hold 4096 bits each. These RAMs are used to hold the
6-digit cryptographic keys. They are retained by a small lithium
battery that is installed in a
fitting at the top right
(the battery is not installed here).
The big white chip marked LN1171 at the top edge of the board,
is an IO-expander. It forms the bridge to the analogue board.
The 25-way sub-D connector at the left is the bridge to the
outside world (i.e. the carrier). At the right is the front panel
that is fitted onto a 6-pin connector.
The analogue board
is clearly the more complex one. It consists
of various layers of components that are cleverly mounted on
top of each other in order to save space. It contains the same
analogue electronics as its predecessor, the
albeit in a much smaller space.
Looking at the board from one of its sides
shows us that there are
three layers of components. All conventional components
(resistors, capacitors, diodes, ICs, etc.) are mounted directly onto
the PCB, whilst a number of sub-circuits are present in the form
of hybrid modules. These are the bright brown and green
A hybrid circuit generally consists of a ceramic carrier with
SMD 1 components on it. Note that the brown rectangle at the right
actually consists of
two stacked hybrid circuits,
each soldered to the board by means of a single row of pins.
Also note that between the green hybrid and the board are two further
white hybrids. Another white hybrid is located under the brown one
at the top left. At the bottom (along one of the longer sides) is a row
of 32 pins by which the analogue board is connected to the digital one.
The central oscillator
is located at the bottom right corner of the
analogue board. It contains a 4.1666 MHz crystal that produces a
240 µs clock for both the analogue and the digital circuits.
For mobile and desktop applications, the crypto unit is usually
mounted inside the wide case
that is shown at the top of this page. Apart from acting as a
carrier for the crypto unit, this case contains some
additional electronic circuits
to make it suitable for the radio to which it is connected or,
as in this case, to adapt the audio signals for connection
to a PSTN telephone line.
In the same vein, the small
that can be inserted
directly into the main Vericrypt 1101 crypto unit, contains a small
electronic circuit that adapts the audio levels of the crypto unit to
those of the handheld radio to which it is connected, and to
the handset of that radio.
SMD = Surface Mounted Device.
The cryptographic principle used in the Cryptophon 1100 and the Vericrypt 1100,
is of the time-division speech scrambler type.
Speech is recorded (sampled) and divided over the time domain (scrambling).
The simplified diagram below, shows how this works.
Speech is cut into small time segments of 30 ms each, and is scrambled
with other time segments in an ever changing order.
The order in which the packets are scrambled is
determined by a pseudo random number generator, or PRNG,
that is seeded the cryptographic key that is set with the
external key loader.
In this diagram, the top row shows the clear speech (input) in time.
The second row shows the speech after it is scrambled.
Finally, the bottom row shows the speech once it is descrambled again (output).
The process of scrambling and descrambling, causes a delay of approx.
As the time segments are scrambled in an ever changing pattern, it is important
that transmitter and receiver are correctly synchronised. To ensure that both
ends are kept 'in sync', a pilot signal (FSK) is transmitted with the
Below is the blockdiagram of the Vericrypt 1100. The audio input is at the
top left. In transmission mode, audio is filtered, digitised and stored in
a temporary memory buffer. The order in which the samples are read out of
the buffer, is determined by the number generator (PRN). The new (scrambled)
signal is then converted back to the analogue domain again.
In order to allow the receiving end to stay in sync, an FSK signal (pilot)
is inserted into the output path.
In receiving mode, the synchronisation signal (pilot) is extracted from
the incoming audio signal (top left) and decoded. It is then used by the
program register (CPU) to keep the pseudo-random number generator (PRN)
in sync, so that the packets are re-assembled in the correct order.
SV12-1101Vericrypt 1100 scrambler
We are looking for futher details about the Cryptophon and Vericrypt
range of products, such as brochures, system descriptions and service
manuals. We are also looking for information about other voice encryption
products produced by BBC over the years. If you have any of these
available, please contact us.
Any links shown in red are currently unavailable.
If you like the information on this website, why not make a donation?|
© Crypto Museum. Last changed: Friday, 16 October 2015 - 10:11 CET.