KFDPro
Buy

A complete P25 keyloader. No laptop required.

  • Laptop + software not needed
  • Adapter built in
  • Drivers none

KFDPro is a complete P25 key fill device: a rugged Sonim XP8 with a security adapter built onto its back. Store, generate and load encryption keys right at the radio, with nothing to boot, nothing to install and no Wi-Fi, Bluetooth or cellular link. The same unit runs KMF store and forward, Tactical OTAR and radio authentication over its built-in Ethernet port.

Buy direct Save $30 Buy on eBay

Sold and shipped within the United States only. Read the notice.

Already have an Android device? The standalone kit is the same adapter and app without the handset, for $349.

Built to
TIA-102.AACD
Also runs
KMF, OTAR, radio auth
Price vs. manufacturer
About a tenth
KFDPro on a Sonim XP8 rugged handset

Open. Connect. Load.

The whole job happens on one device that fits in a cargo pocket — at the bench, in the vehicle bay or wherever the radio is.

  1. Open it

    Unlock the handset and KFDPro is ready. There is no software to launch on another machine, no driver to install and no port to pick from a list.

  2. Connect it

    Run a male-to-male Hirose 6-pin cable from the connector on the back of the unit to your radio's keyload adapter — or, for radios that keyload over USB, plug the radio's USB programming cable into the USB-A port. Verify communication confirms the radio answers before you trust the cable.

  3. Load it

    Choose a key or a whole group and send it. Each key reports its own result, and the operation is written to the audit log as it happens.

The jobs that used to need a manufacturer keyloader

Until now, store and forward with a KMF, Tactical OTAR and radio authentication were jobs for the radio makers' own keyloaders. KFDPro does all three, and each has been tested against real equipment.

Store and forward with a KMF

Beta Tested · KMF R10.00 · R10.02
  1. Your KMF
  2. Wired Ethernet · jobs in, answers back
  3. KFDPro
  4. Hirose cable or USB · jobs delivered
  5. Your radios

BetaStore and forward is built to the relevant TIA standard as closely as we can make it, and it is still being tested against more KMF setups. Check it on your own system before you rely on it in the field.

Connect to your Key Management Facility and collect the rekey jobs it has queued for your radios. Take the unit to each radio and deliver them over the Hirose cable or USB. The radios' answers go back to the KMF the next time you connect, so its records stay current.

Tested
Against Motorola ASTRO 25 KMF releases R10.00 and R10.02 (2025). Jobs were delivered and answered on an APX 6000 over three-wire and an APX 900 over USB.
Connection
Wired Ethernet, through the 10/100 Ethernet port built into the unit's security adapter. RS-232 and dial-up modem connections are not offered, because most modern KMFs have them switched off. The standalone kit has the same port.
Remote KMF
There's no VPN on the unit itself. A VPN on a travel router, such as a GL.iNet, does work: KFDPro just sees a wired network.

Tactical OTAR

Tested · APX 6000
  1. KFDPro
  2. Radio's USB programming cable
  3. Modem radio
  4. Over the air · rekey and acknowledge
  5. The group

Rekey a whole group of radios over the air, from the unit. One radio plugs into KFDPro with its USB programming cable and acts as the modem. KFDPro sends the new keys through it to every member of the group, and each radio confirms it is current.

Tested
On APX 6000 subscribers, with the modem radio connected to KFDPro over USB. The group was rekeyed with AES-256, and the second radio took its keys over the air.
Connection
The modem radio connects over USB with its own programming cable. The radios need the Tactical OTAR option.

Radio authentication

Tested · APX · AuC R25
  1. Your radios
  2. Radio's USB cable · SUID read, key loaded
  3. KFDPro
  4. Wired Ethernet · key pairs sent, AuC confirms
  5. Your AuC

No network link to the AuC from where you are? Export the pairs as an HTML report to a USB drive and enter them into the AuC by hand.

Load P25 radio authentication keys into your radios over their USB programming cable. KFDPro can generate each key or take one you type in. It keeps every radio's key with its SUID and sends the pairs straight to your Authentication Center (AuC) over wired Ethernet. Where the AuC can't be reached, it exports them as an HTML report instead.

Tested
Loading keys on APX radios over the USB cable, and sending them straight to an Authentication Center, release R25.
Connection
Wired Ethernet through the built-in Ethernet port, as for a KMF, on the complete unit and the standalone kit alike.
Keys
AES-128. Generate each one on the unit or enter it on KFDPro's own keyboard.
The report
Holds the keys in the clear, because the AuC needs them. Once the AuC has every pair, destroy the file and any copy of it.

KFDPro radio authentication keys

1 radio, generated 2026-09-23 15:12:00 UTC by KVL Radio Auth ID 9999998

Contains authentication keys in the clear. Enter every pair into the Authentication Centre's record for that radio, then destroy this file and any copy of it.

Radio IDSUIDAuthentication key (K), AES-128
1201BEE001A40004B13C 9E 07 D1 52 A8 6F 14
E0 7B 29 C5 88 0D 4A F6
Example report Sample values, not real key material.

Add an algorithm. Don't buy one.

Manufacturer keyloaders sell each encryption algorithm as a paid option. KFDPro comes with the common P25 algorithms. If yours isn't among them, including one released after you bought the unit, you can add it yourself at no charge, as long as it loads through the standard TIA-102.AACD key fill.

AlgorithmALGIDKey lengthChecked for you
AES-2560x8432 bytesLength
AES-1280x8516 bytesLength
DES-OFB0x818 bytesLength and parity
DES-XL0x9F8 bytesLength and parity
ADP / RC40xAA5 bytesLength
YoursAny P25 ALGIDThe length you setLength only; the values are up to you
Add algorithmSettings · Advanced settings
Name
Shown in your key lists. Never sent to the radio.
ALGID
The P25 algorithm ID, one byte in hex: 0x00 to 0xFF.
Key length
In bytes. Key entry and generation follow it.
ExperimentalSpecify your own ALGID and key length to add other P25 algorithms.
Key values are your responsibility

KFDPro checks keys for the algorithms it includes. DES-OFB keys, for example, need correct parity, so KFDPro checks every DES-OFB key you enter. For an algorithm you add, KFDPro knows only its ID and key length, so it's up to you to make sure each key value meets that algorithm's requirements. A wrong ALGID or length is accepted on the unit and then fails at the radio.

Adding an algorithm to KFDPro doesn't install anything in a radio. The radio must already have the algorithm installed and enabled.

Adding your own algorithm is an experimental feature, meant for advanced users who know the algorithm's ID and key format.

What's in it

The everyday work of a key fill device: keeping keys, putting them into radios, taking them out again, and proving what was done.

Radio operations
Load keys Three-wireSend stored keys to a radio over the standard three-wire key fill interface — single keys, keysets or a whole group in one session.
USB keyloading Radio's USB cableKeyload a radio over its own USB port, as TIA-102.AACD allows. Plug the radio's USB programming cable into the unit's USB-A port. Radios use their own programming cables rather than a standard USB cable.
Erase keysRemove a selection, or zeroize the radio entirely. Destructive actions live on their own screen and need a deliberate swipe to confirm.
Verify communicationCheck that a radio answers before you rely on the cable or the radio itself.
Configure a deviceSee what a target holds — RSIs, keysets and key slots, listed by reference — and remove keys. Viewing is read-only by design, so looking can never become erasing.
Built-in adapterThe security adapter on the back carries the Hirose key fill connector, and its firmware is based on the proven open-source KFDtool adapter firmware.
System operations
Store and forward BetaCollect rekey jobs from your KMF over wired Ethernet, deliver them to radios, and return the radios' answers. How it works
Tactical OTARRekey a group of radios over the air through a modem radio connected by USB. How it works
Radio authenticationLoad generated or entered authentication keys into radios over USB, and send the pairs to your AuC directly or as a report. How it works
Key management
Manage keysAdd, edit, group and delete keys stored on the unit. There is no Save button to forget — every change is written as it is made.
Generate keys on the deviceCreate new keys from the handset's hardware-backed random number generator, with correct parity where the radio demands it.
Security-hardened keyboardKey values are entered on KFDPro's own on-screen keyboard, built into the app. Android's keyboard never sees the input, so no input method, dictionary, suggestion engine or cloud sync can intercept key material.
Import and export containersReads and writes .ekc files, the KFDtool Key Container Standard from the open-source KFDtool project, so the key files you already keep can come with you, and go back again.
Share and receive keysSend keys to another keyloader, or act as the target so another keyloader can fill this one.
Export for a KMFWrite a key-dissemination file that a console or key management facility can load, wrapped with the key-encryption key you select.
Security and administration
Audit logEvery action that moves, changes or destroys key material is recorded. Filter it on the device or export it as a report.
Offline field updatesUpdates arrive as one signed, encrypted package on a USB drive, plugged into the unit's own USB-A port. The unit never goes online to fetch an update.
Key types AES-256AES-128DES-OFBDES-XLADP / RC4+ any P25 ALGID you add KFDPro fills keys for algorithms your radio already has — it does not install, remove or unlock any.

Built to the standard, not to a model list

KFDPro speaks TIA-102.AACD, the published P25 key fill standard, so it should work with any radio that follows it. Its security adapter's firmware is based on the proven open-source KFDtool adapter firmware (v1.8.8), so it is expected to work with the same radios the KFDtool community has already keyed.

Motorola
  • APX portables and mobiles (three-wire)
  • APX over USB (USB keyloading)
  • ASTRO 25, including MACE and UCM
  • Earlier ASTRO digital radios
L3Harris
  • XL series
  • Unity XG-100
EF Johnson
  • VP/VM 8000
  • VP/VM x00
  • 5100 / ES
Kenwood
  • NX series
Thales
  • Liberty
Anything else

If your radio accepts a standard TIA-102.AACD key fill, KFDPro should be able to load it.

Verified on our own bench

APX 6000, APX 7000 and APX 8000 over the three-wire interface, and APX 900 by USB keyloading.

Radio families listed from the open-source KFDtool project's published compatibility table. Some radios need a model-specific cable, a hardware module or a minimum radio firmware version — for example, USB keyloading on APX radios applies to the newer-architecture models (APX 900, 6000 BN, 8000, 8500, NEXT, N-series) on radio firmware R27.03 or later. Check your radio's requirements before you rely on it.

Nothing near your keys that doesn't need to be

A keyloader is only as trustworthy as everything else running beside it. KFDPro is a single-purpose unit, and the one network connection it makes is one you open yourself, over a cable.

  • One wired connection, and only when you open it

    The app holds a single network permission, for talking to key-management infrastructure you choose to connect to. Today that means your KMF or your AuC: you enter the address, you press connect, and the connection runs over the unit's wired Ethernet port and closes when the session ends. The app holds no Wi-Fi, Bluetooth or network-state permission.

  • A locked-down handset

    The XP8 is set up as a dedicated keyloader. There are no Google services, no bloatware and no launcher to get into, and installing other apps is restricted, so nobody using the unit can weaken its security. Wi-Fi, Bluetooth and cellular are switched off by device policy. The standalone kit runs on a device you supply, so that device's security is yours to manage.

  • A key store bound to the hardware

    Keys rest in an encrypted container sealed by a non-exportable key inside the handset's hardware keystore. Copy the file to another device and it opens nothing.

  • Key values stay out of sight

    Values are masked by default, and the key entry screens block screenshots and the recent-apps preview.

  • Made for gloves and daylight

    Large rows, oversized icons and high contrast, on a rugged handset you can work with gloves on.

Plain words, big targets

Every row is a verb and the thing it acts on. If you have used a key fill device before, you already know your way around.

    Three kits that can load a key

    All three do the core job. They differ in what you carry, what sits next to your keys, and what it costs.

    Adapter + PC softwareA key fill adapter driven from a computer KFDProThe complete unit Manufacturer keyloaderThe radio vendor's own handheld
    What you carryAdapter, cables and a laptopOne unit, plus your radio's keyload adapter and a Hirose cableOne handheld unit
    At the radioBoot the computer, start the software, choose the port, then loadWake, connect, loadPower on, connect, load
    Where keys restA container file on a general-purpose computerAn encrypted store sealed to the handset's hardware keystoreDedicated internal storage
    Network exposureWhatever the computer is connected to, and however it is managedWi-Fi, Bluetooth and cellular off by device policy; wired KMF and AuC connections, only when you open themVaries by model
    Audit trailDepends on the softwareBuilt in, exportableBuilt in
    RuggednessDepends on the laptopRugged handset, glove-friendly interfacePurpose-built rugged unit
    Store and forward with a KMFNoYes, in beta, over wired Ethernet (details)Yes, by model
    Tactical OTARNoYes, through a modem radio on USB (details)Yes, by model
    Radio authentication keysNoYes, with the keys sent straight to the AuC (details)Yes, by model
    AlgorithmsDepends on the softwareCommon P25 algorithms included; add any other P25 ALGID yourself, free (details)Each algorithm a paid option
    Algorithm installationNoNoYes, by model
    FIPS 140 validationNoNoAvailable on some models
    Typical costThe adapter, plus a computer you are willing to dedicate to keysRoughly a tenth of a manufacturer unitSeveral thousand dollars

    The KFDPro column describes the complete unit. The standalone kit does the same jobs, Ethernet port included, on an Android device you supply, without the locked-down handset. General characteristics, for orientation only; specific products vary. If you need FIPS validation, algorithm installation or other vendor-specific functions, a manufacturer device is the right tool.

    Product photo · back of the unit

    Bring your radio's keyload adapter.

    A Sonim XP8 rugged handset with a security adapter mounted to its back. Handset and adapter travel, and work, as one piece. The adapter carries the key fill port, a USB-A port and a wired Ethernet port. A male-to-male Hirose 6-pin cable runs from the unit to your radio's keyload adapter; if you don't already have one, add it when you buy.

    Hirose 6-pin
    Connects to your radio's keyload adapter with a male-to-male Hirose 6-pin cable, the same cable you would use with any key fill device (see Accessories).
    USB-A
    For USB keyloading, radio authentication and Tactical OTAR with the radio's own USB programming cable, and for USB drives carrying updates, key containers or radio authentication reports.
    Ethernet
    A 10/100 wired network port, built in, for store and forward with a KMF and for sending radio authentication keys to an AuC. Any standard patch cable; nothing to add.
    USB-C
    The link between the handset and its adapter.
    Firmware
    The adapter's firmware is based on the open-source KFDtool adapter firmware, v1.8.8, chosen because it is proven. The KFDPro application on the handset is our own, written from the ground up.

    See what's included for the full box contents.

    What's included

    The complete unit. Everything ships provisioned and licensed, ready to load keys. The standalone kit is listed below.

    • Sonim XP8 rugged handset*

      Professionally refurbished and in very good condition.

    • KFDPro security adapter New

      Pre-mounted to the XP8 and not user-removable, with the Hirose 6-pin key fill port, a USB-A port and a wired Ethernet port. The XP8's battery compartment stays fully accessible with the adapter installed.

    • USB-C charging cable and AC adapter New

      Charges the handset.

    • KFDPro app, installed and licensed

      Free software updates for the life of the device.

    * Our XP8 handsets are refurbished by a professional mobile-device refurbisher and are in very good condition. When a handset reaches us, we image it and harden it with our own Android provisioning, so it arrives set up and ready to use as a key fill device. Buying refurbished substantially reduces the cost to you and lets this package sell for much less than it would with a new handset. Everything else in the kit, including the security adapter and the charging cable, is brand new.

    Not included, unless the listing says otherwise: your radio's keyload adapter or USB programming cable, which are specific to your radio model, and the male-to-male Hirose 6-pin cable (see Accessories). For KMF and AuC sessions, any standard Ethernet patch cable.

    Bring your own Android device.

    The KFDPro standalone kit is the same security adapter in its own enclosure, with the same app, licensed for one Android device you already own. Its ports match the complete unit's, Ethernet included, so everything works as it does there: key fill, USB keyloading, store and forward with a KMF and the direct AuC link.

    What's in the kit

    You install the app and license it with the key in the box.

    • KFDPro security adapter New

      In its own enclosure, with the Hirose 6-pin key fill port, a USB-A port and a 10/100 Ethernet port, powered by your device over USB-C. The same adapter and firmware as on the complete unit.

    • USB-C cable New

      Connects the adapter to your Android device.

    • Activation key for one Android device

      On a card in the box. Enter it on this site together with the license request the app saves, and download your license in about a minute.

    • KFDPro app download

      The same app as on the complete unit, downloaded from this site and installed on your device, with free updates for the life of the kit.

    Not included: your Android device, your radio's keyload adapter or USB programming cable, and the male-to-male Hirose 6-pin cable (see Accessories). For KMF and AuC sessions, any standard Ethernet patch cable.

    Ordered a standalone kit before October 29, 2026? Those first-revision kits have no Ethernet port, so store and forward and the direct AuC link aren't available on them; radio authentication keys reach the AuC as the HTML report instead. Everything else works as described here.

    What you need

    • Android 7.0 or later, on a device with USB host (OTG) support. Nearly every phone and tablet of the last several years qualifies.
    • A USB-C port, for the included cable.
    • Permission to install apps from outside Google Play, often called sideloading. The app comes from this site, not from an app store.
    • One device per key. The license binds to the device it is activated on.
    • For the Ethernet port, Android's own support for wired networks. It should work on most Android devices, but a few leave it out. Everything else in the kit works either way.
    Not a locked-down device

    The complete unit is a dedicated keyloader: Wi-Fi, Bluetooth and cellular off by policy, and no other apps. A general-purpose Android device with network connectivity is a less secure place for key material. Depending on your use case that may be acceptable. The judgement is yours, and your organization's policy comes first.

    $349 direct, with free ground shipping. $30 off with code DIRECT30.

    Order the standalone kit

    Accessories

    The one extra not every owner needs, because many already have it. We leave it out of the box to keep the price down, and you can add it when you buy either kit.

    Hirose 6-pin cable, male to male

    Not included

    Add at purchase +$30

    Connects the Hirose 6-pin port of the complete unit or the standalone adapter to your radio's keyload adapter. You need one to load keys over the key fill interface. Many owners already have one, so it isn't in the box or in the price.

    From us
    Add it when you buy your complete unit or standalone kit.
    Already have one?
    Use the cable you have.

    Close the laptop. Carry one unit.

    The complete unit is $499 and the standalone kit $349, direct from us with free ground shipping. Take $30 off either with code DIRECT30 at checkout, or buy the complete unit through our eBay store.

    Complete unit $499 · Save $30 Standalone kit $349 · Save $30 Buy on eBay

    United States sales and shipping only. See the notice below.

    Before you ask

    Which radios does it work with?

    KFDPro should generally be able to load keys into any radio that complies with TIA-102.AACD. Because its adapter firmware is based on the open-source KFDtool firmware, it is expected to work with the same radios as KFDtool — see Compatibility. We have verified it ourselves on the APX 6000, APX 7000 and APX 8000 over the three-wire interface, and on the APX 900 by USB keyloading.

    It can only fill algorithms the radio already has installed and enabled.

    Do I need a separate KFD adapter?

    No. The security adapter is part of the unit and has the Hirose 6-pin connector. A male-to-male Hirose 6-pin cable runs from it to your radio's keyload adapter, and we can supply one (see Accessories).

    How does KFDPro relate to KFDtool?

    The KFDPro application is a native Android application we wrote from the ground up — it is not a port or a repackaging of the desktop software. The security adapter's firmware, on the other hand, is deliberately based on the open-source KFDtool adapter firmware, version 1.8.8, because it is proven across a wide range of radios.

    KFDPro also reads and writes the same .ekc key containers as the KFDtool desktop software.

    Can I bring the key containers I already have?

    Yes. KFDPro reads and writes .ekc files — the KFDtool Key Container Standard, the encrypted container format defined by the open-source KFDtool project — in both directions. Your key store can be exported to a container and carried to a PC at any time, which is also your answer to “what if the handset is lost or damaged”.

    How do updates work without going online?

    You download a signed update package on any computer, copy it to a USB drive, plug that into the unit's USB-A port, and install it from KFDPro's own update screen. See Firmware & support.

    With the standalone kit, an update is a new app download from this site, installed over the one you have. Your keys, settings and license stay in place.

    How does KFDPro connect to our KMF?

    Over wired Ethernet, through the Ethernet port built into the unit's security adapter: plug in a standard patch cable. That is the only store-and-forward connection offered. RS-232 and dial-up modem connections are not built, because most modern KMFs have them switched off. We have tested it against Motorola ASTRO 25 KMF releases R10.00 and R10.02.

    The standalone kit has the same Ethernet port, so store and forward works on it too, on most Android devices (see what you need). First-revision standalone kits, ordered before October 29, 2026, have no Ethernet port (details).

    Store and forward is a beta feature: it follows the relevant TIA standard as closely as we can make it, and testing continues. Try it on your own system before you rely on it.

    There is no VPN on the unit itself. If your KMF is only reachable over a VPN, a travel router running the VPN, such as a GL.iNet, works well. KFDPro just sees a wired network. See Store and forward.

    Can KFDPro send radio authentication keys to our AuC?

    Yes. KFDPro sends the radios' keys and SUIDs straight to the AuC over wired Ethernet, through the unit's built-in Ethernet port. We have validated this against Authentication Center release R25. If the AuC can't be reached from where you are, KFDPro exports the pairs as an HTML report instead, which you save to a USB drive and enter into the AuC by hand. See Radio authentication.

    Can I run KFDPro on my own Android device?

    Yes: that is the standalone kit, $349. It is the KFDPro security adapter in its own enclosure, with the same Ethernet port as the complete unit, a USB-C cable, an activation key that licenses the app on one Android device, and the app itself, which you download from this site. The device needs Android 7.0 or later, USB host (OTG) support, a USB-C port and permission to install apps from outside Google Play.

    The app isn't sold on its own: the license comes only with the kit.

    Is the standalone kit as secure as the complete unit?

    No, and we don't claim it is. The complete unit is a dedicated keyloader with Wi-Fi, Bluetooth and cellular switched off by device policy and no other apps on it. A general-purpose Android device with network connectivity is a less secure place for key material. The app's own protections apply on either: the key store is sealed to the device's hardware keystore, key values are masked, and the key entry screens block screenshots. Whether that is acceptable depends on your use case and your organization's policy.

    Can I move the standalone kit's license to another device?

    The license binds to the device it was activated on. Your activation key allows a small number of activations, so a replacement device can be licensed with the same key. If you run out, email us and quote the reference printed on the card.

    Is it FIPS-compliant?

    No. KFDPro is not FIPS-validated and may not be appropriate where policy requires a validated device. Check your organization's requirements before you buy.

    Do you ship outside the United States?

    Not at this time. See the notice below.