Encryption

Direbox messages and bulletins can be encrypted or encoded when being sent over the air.

Encryption is disabled by default but can be activated by the Settings > Encryption drop-down:

In addition to AES encrypted messaging, Direbox also offers base64 encoding as well as the ability to easily share encryption keys with contacts via QR code.

Read on to learn more about these features.

Warning

Encryption is disabled by default as it is not legal on the majority of bands or license types globally.

This feature is intended for FCC Part 90 operators in the United States where encryption is legal as well as other commercial, itinerant, and emergency service operators globally where encryption is allowed.

It's up to you to use Direbox's encryption suite legally and responsibly.

AES-128 Encryption

Encryption can be enabled by selecting the AES-128 drop-down option.

Enabling this setting will encrypt all messages and bulletins sent over the air from Direbox by default. Position reports and location beaconing will remain unencrypted.

As Direbox uses symmetric encryption, your contacts will need a copy of your encryption key saved under your callsign's entry in Contacts before they can decrypt your traffic. Key exchange does not happen automatically over the mesh as it might in popular Internet-based encrypted apps like Signal.

Bear in mind that the APRS network requires your callsign to be transmitted in plaintext for deliverability, so your callsign will always be visible even if you are transmitting with encryption enabled. Only the contents of your message are encrypted.

For more information about how encryption works in Direbox, please see Technical Information.

Base64 Encoding

Direbox can also send messages and bulletins using the Base64 encoding algorithm.

Unlike encryption, Base64 encoding is an open standard that is not designed to obfuscate message details, as anyone is capable of decoding its content. It is more akin to something like D-Star, which also uses an encoding scheme.

Encoding in Direbox is designed for expandability of data transfer in the future, as Base64 encoding can carry binary data in addition to plaintext over the air. In the same way that some may use AX.25 packets instead of voice due to the overhead required to decode digital traffic, Base64 can potentially be used to achieve security through obscurity over APRS.

Generate & Share Keys

If your encryption keys are compromised or you otherwise need to shuffle your keys, you can generate new ones by clicking the Generate new key button.

Your encryption key is also shown here in plaintext and as a QR code for you to share with intended contacts.

If you change your encryption keys, messages decrypted with your old key will still be visible to your contacts. While Direbox encrypts your traffic over the air, messages received previously are decrypted and stored in your local database as plaintext.

Whenever you change your encryption keys, your contacts will have to update your information with your new key in order to decrypt future messages from you.

Technical Information

Direbox uses symmetric key encryption via the AES-128-CBC block cipher.

Specifically, we use the Fernet implementation of this encryption scheme. Symmetric key encryption is also called PSK (pre-shared key) encryption, as it requires the decryption key to be shared ahead of time since messages are encrypted and decrypted with the same key.

Despite the increasing popularity of asymmetric (or public-private key) cryptography used in many Internet-based messaging platforms, it is unfortunately not well suited to APRS for several reasons:

  1. Payload Size - Output of encrypted data via symmetric key cryptography is relatively short. By contrast, asymmetric key cryptography produces very large payloads, which drastically reduces deliverability over flood networks like APRS and can cause congestion over limited bandwidth protocols like AX.25 that operate at a standard 1200 baud.
  2. Key Exchange - Like their payloads, public keys in asymmetric cyptography are also much larger than symmetric keys. The minimum safe size for a symmetric key is 128 bytes, whereas asymmetric public keys are at least 2048 bytes. This makes key exchange over low-speed RF networks impractical.
  3. Regional Capability - Line-of-sight mesh networks like APRS are intended to be regional. While they are technically capable of covering very wide areas, typical VHF implementations of these networks operate in a radius of 100 miles or so. The implication here is that anyone you're making private contact with knows you in real life and can facilitate key exchange in person, unlike asymmetric key cryptography which is largely designed for encrypted comms between strangers or over long distances. This is also in keeping with the spirit of FCC Part 90 regulations where legal encryption assumes members are part of the same organization and operating within a default 50 mile radius.
  4. Analog Data Transfer - One of the strengths of Direbox and AX.25 packets in general is that they are digital signals transmitted via analog audio modulation. This means that any radio on any frequency can be easily turned into a packet radio station, but at the expense of speed. By contrast, purely digital modes may require special hardware and limited frequency range but are capable of higher speeds that can facilitate public key exchange.

Direbox uses industry-standard AES encryption with a 128 bit key size. Why not use AES-256?

The primary reason for this is that Direbox's back-end is written in Python, which includes Fernet as a common cryptography recipe. Implementing AES-256 would require a custom implementation with cryptographic primitives, and while we plan on supporting different encryption schemes in the future, the safer option for a first release is to use a battle-hardened library like Fernet for encryption.

The same is true for Direbox's decision to use a block cipher like AES instead of a symmetric key stream cipher, which has the advantage of an even smaller output payload. We're very interested in emergent cryptographic algorithms like ChaCha20-Poly1305 as they're very well suited to networks like APRS.

The APRSChat protocol developed for Direbox contains namespace to identify many different encryption and encoding schemes for future extensibility.