Click for homepage
Crypto AG
Voice
  
CRYPTOVOX →
  
CVX-396   SVZ-B
Wideband voice encryption unit · CRYPTOVOX

CVX-396 was a military-grade voice encryption device, developed around 1976 by Crypto AG (Hagelin) in Zug (Switzerland). The device was intended for use in combination with the PRC-77 radio, but was also suitable for other military radio sets [1]. In the Swiss Army, a variant – known as SVZ-B 1 – was used from 1983 to 2008, after which is was succeeded by the SE-x35 [2]. It was supplied to the German Bundeswehr as a rebadged product by Telemit in München (Germany).

The device is housed in a strong aluminium enclosure that measures 280 x 270 x 70 mm and weights less that 4 kg. Although initially designed for use in combination with the PRC-77 radio, it is suitable for any military VHF or UHF radio set that has a so-called X-MODE.

All controls and connections are at the front. In most setups, a single cable between socket PL2 and the radio will be sufficient, but if necessary, a handset can be connected directly to the U-229 socket (U-183/U) at the top left. At the right are a keypad and a display for entry of the key.
  
CVX-396 with open door

Development of the CVX-396 dates back to 1975, as a prototype was shown in 1976/1977 in a lecture by Crypto AG's chief developer Oskar Stürzinger at the ETH in Zürich [1]. The CVX-396 was based on the earlier development of the CSE-280 (1971 - 1973) which was Crypto AG's first real voice encryption device. It is entirely built with discrete logic components. In 1983 a national (and arguably more secure) variant — known as SVZ-B 1 — was introduced in the Swiss Army [2]. The device was in production until 1990 and was used in several countries until at least 2008.

  1. SVZ-B = Sprachverschlüsselungszusatz Breitband (wideband speech encryption add-on) [2].

CVX-396
CVX-396 with open door
Front view
CVX-396 with open door
Front panel with door open
Key setting
Connections
Front panel facing upwards
A
×
A
1 / 8
CVX-396
A
2 / 8
CVX-396 with open door
A
3 / 8
Front view
A
4 / 8
CVX-396 with open door
A
5 / 8
Front panel with door open
A
6 / 8
Key setting
A
7 / 8
Connections
A
8 / 8
Front panel facing upwards

Features
All controls and connections of the CVX-396 are located at the device's front panel, as shown in the diagram below. At the left are the sockets for connection of the power, the radio set (PL2) and a handset (AUDIO). At the centre is a 2-position switch that allows selection between Plain (P) and Crypto (C). On the SVZ-B, this switch has 3 positions, allowing two different keys to be used.

Click to see more

At the right is a numeric keypad with a 6-digit red LED display, that are used for entering the cryptographic key(s). This section can be covered by a locked door, for improved crypto security. Each key consists of 28 decimal digits that are entered as 7 groups 1 of 4 digits each. To enter a key, press (✱). Next, enter the group number (1-7) followed by four digits and a (✱). Repeat this process until all groups have been entered. A key is now loaded and the device is ready for use.

Zeroizing
In case of an emergency, the cryptographic key(s) can be purged by pressing the (✱) and (0) buttons simultaneously. This process is known as zeroizing. Unfortunately, this is only possible when the door over the keypad is unlocked, which means that in normal operation (i.e. with a locked door), the device can not be zeroized. This might be considered a design flaw.

  1. On the SVZ-B, each key consists of 36 digits that are entered as 9 groups of 4 digits each. Furthermore, the SVZ-B allows two keys to be stored.

Printed instructions on the inside of the door
SVZ-B (Swiss version of CVX-396) on top of a PRC-77 radio. Photograph via Stiftung HAMFU [2]
Complete setup with three SVZ-B units, as used in the Swiss Army.
Two stacked SVZ-B devices
Key entry instructions of the SVZ-B
B
×
B
1 / 5
Printed instructions on the inside of the door
B
2 / 5
SVZ-B (Swiss version of CVX-396) on top of a PRC-77 radio. Photograph via Stiftung HAMFU [2]
B
3 / 5
Complete setup with three SVZ-B units, as used in the Swiss Army.
B
4 / 5
Two stacked SVZ-B devices
B
5 / 5
Key entry instructions of the SVZ-B

SVZ-B
Within the Swiss Army, a variant of the CVX-396 was used from 1983 onwards. It was designated SVZ-B 1 and has improved security as each key is 36 digits long, whereas the cryptographic keys of the regular version (used for example in the German Bundeswehr) were only 28 digits long.

In addition, the SVZ-B allows two cryptographic keys to be stored simultaneously, whereas the CVX-396 can hold only one key. The image on the right shows a typical Swiss Army setup with three SVZ-B units at the top. The key-loading procedure is printed inside the locked door.

Government procurement for the SVZ-B started as early as 1977. The Swiss military were initially very impressed with the device's weight and the intelligibility of the speech, which were much better than that of its competitors Siemens-Albis and Gretag. It clearly was the 'optimal solution'.
  
Complete setup with three SVZ-B units, as used in the Swiss Army.

But there were also doubts. The Swiss military cryptographers who had evaluated the CVX-396, found its encryption algorithm — which had been approved by CIA and BND for export — far too weak, and summoned experts from Crypto AG to Bern. On 2 March 2020, three weeks after the revelation of Operation RUBICON, 2 former Crypto AG employee Jürg Spörndli revealed in an interview that the Swiss military allowed the firm to submit a better proposal, which they did [4]. The improved algorithm was accepted and the Swiss military subsequently ordered 6900 units.

In the interview, it was also revealed that the Swiss Army was well aware of manipulation of the encryption algorithms by foreign intelligence services. According to Spörndli, the Swiss federal cryptologist stated 'We know what you are doing, we know about the double game'. It startled Spörndli, and made him think of the days in 1974, when the Yugoslav Army had discovered a similar weakness in the MCC-314 device. At that event, they had supplied an improved algorithm.

 Operation RUBICON

  1. SVZ-B = Sprachverschlüsselungszusatz Breitband (wideband speech encryption add-on) [2].
  2. Operation RUBICON was a secret German/American operation, in which the German BND and the American CIA had purchased the Swiss crypto manufacturer Crypto AG in 1970, and used it to spy on other nations.

Known radio sets
The CVX-396 is known to have been used with the following radio sets:

PRC-77 radio
The AN/PRC-77 radio was in fact a PRC-25 that had been given a solid state RF power amplifier, and was modified for the connection of digital voice encryption equipment, by adding a so-called X-MODE to the circuitry.

When in X-Mode, the filters in the audio path of transmitter and receiver are bypassed so that the full bandwidth of the set can be used.

 More about the PRC-77

  
CVX-396 on top of a PRC-77 radio




CVX-396 interior seen from the rear

Interior
The CVX-396 is housed in a strong aluminium enclosure, similar in design and width to the case of a PRC-77 radio set. It consists of a die-cast aluminium front panel with a single case shell behind it. The case shell is held in place by for hex bolts that are located behind the two grips.

After loosening these bolts, the case shell can be separated from the front panel. This reveals the interior, which consists of a black plastic frame with 8 PCBs that are slotted into a backplane that is mounted to the rear of the front panel. An additional PCB is fitted inside the front panel.

The image on the right shows the interior as seen from the rear. Note that there is no microcontroller and, hence, no firmware that controls the device. Instead, encryption and decryption is entirely done by means of shift registers, built from discrete logic components.
  
Interior

Most PCBs are EUROCARD size (16 x 10 cm) and are slotted into the packplane by means of a 2-row DIN connector. The only exception is the internal power supply unit (PSU) which is connected to the backplane by means of the DE9 connector. Note that the second board on the left holds the backup batteries that retain the key(s) in the internal registers. Also note that the two boards at the top right are sandwiched. At the lower left is an empty slot for expansion. As we don't have access to the original circuit diagrams, we are showing the PCB numbers in the images below.

Case locking bolts
Removing he CVX-396 from the case shell
Interior seen from the rear
Interior
Interior - rear view
Close-up of backup battery
Close-up of board 517.416
Board 517.404
Board 513.554
Board 517.429
Board 517.420
Board 517.437
Board 517.437 and 517.433
Board 517.416
Board 517.412
Board 517.404 top view
C
×
C
1 / 16
Case locking bolts
C
2 / 16
Removing he CVX-396 from the case shell
C
3 / 16
Interior seen from the rear
C
4 / 16
Interior
C
5 / 16
Interior - rear view
C
6 / 16
Close-up of backup battery
C
7 / 16
Close-up of board 517.416
C
8 / 16
Board 517.404
C
9 / 16
Board 513.554
C
10 / 16
Board 517.429
C
11 / 16
Board 517.420
C
12 / 16
Board 517.437
C
13 / 16
Board 517.437 and 517.433
C
14 / 16
Board 517.416
C
15 / 16
Board 517.412
C
16 / 16
Board 517.404 top view

Specifications
CVX-396
  • Power
    10 — 30V DC
  • Consumption
    < 1.2W
  • Keys
    1
  • Key length
    28 decimal digits ( ~ 67 bits)
SVZ-B
  • Power
    10 — 30V DC
  • Consumption
    < 1.2W
  • Keys
    2
  • Key length
    36 decimal digits ( ~ 100 bits)
Connections
Audio
At the top left of the front panel is a standard (US/NATO) 5-pin U-229 socket (U-183/U) for connection of a handset. The pinout of this socket is given below, when looking into the socket.

  1. Ground
  2. Speaker
  3. PTT
  4. Microphone
  5. not connected
    Click to see more
PL1
As preset, the pinout of this connector is unknown. If you can provide this information, please contact us.

  1. ?
  2. ?
  3. ?
  4. ?
  5. ?
  6. ?
  7. ?
  8. ?
  9. ?
  10. ?
  11. ?
  12. ?
  13. ?
  14. ?
PL2
Socket PL2 is used for connection to the radio set. It carries the audio input and output lines, as well as the power lines. As preset, the pinout of this connector is unknown. If you can provide this information, please contact us.

  1. ?
  2. ?
  3. ?
  4. ?
  5. ?
  6. ?
  7. ?
  8. ?
  9. ?
  10. ?
  11. ?
  12. ?
  13. ?
  14. ?
  15. ?
  16. ?
  17. ?
  18. ?
  19. ?
Help wanted
At present, no further information about the CVX-396 and the SVZ-B is available to us. We are currently looking for operating instructions, technical documentation and information about the pinout of the connectors at the front. We would also like to know where and how the CVX-396 was used. If you have any additional information, please contact us.

Documentation
  1. CVX-396 advertisement
    ASMZ 145, Volume 4, 1979. Page 190.
References
  1. Oskar Stürzinger, Chiffriertechnik Heute
    Vorlesung Krieg im Aether 1976/1977, ETH Zürich (German). 1

  2. Sprachverschlüsselungszusatz Breitband - SVZ-B
    Stiftung HAMFU. Retrieved December 2018.

  3. Crypto AG, Company brochure, Crypto Products
    Crypto AG, 1992. 8 pages, page 2.

  4. News Switzerland: Cryptoleaks, Army exposed the crypto spies early
    EN24. 2 March 2020.
  1. Retrieved from HAMFU History, December 2018.

Further information
Any links shown in red are currently unavailable. If you like the information on this website, why not make a donation?
© Crypto Museum. Created: Friday 21 December 2018. Last changed: Monday, 02 March 2020 - 11:18 CET.
Click for homepage