Glossary of P25 keyfill terms

ALGID: Algorithm ID. A one-byte number naming an encryption algorithm, such as 0x84 for AES-256.
AuC: Authentication Center. The system component that holds each radio's authentication key and checks radios as they register.
CKR: Common Key Reference. The number by which a radio and a key management system refer to a key. Also called the SLN. On KFDPro a TEK uses 1 to 4095 and a KEK 61440 to 65535.
.ekc: The encrypted key container file defined by the KFDtool Key Container Standard of the open-source KFDtool project. KFDPro reads and writes it.
KEK: Key Encryption Key. A key that protects other keys while they are sent or stored.
Keyload adapter: The radio-specific adapter that fits a radio's accessory or side connector and presents its key fill interface. KFDPro connects to it with a Hirose 6-pin cable.
Keyset: A set of keys in a radio. A radio can hold more than one and use one at a time; activating another is a changeover.
KFD: Key Fill Device. The standard's name for a device that loads keys into radios. KFDPro is one.
Key ID (KID): A 16-bit identifier for a key, written in hex. Together with the algorithm it identifies the key a radio uses for a call.
KMF: Key Management Facility. The system that plans and distributes keys to radios, over the air or through a keyloader by store and forward.
KVL: Key Variable Loader. Another common name for a keyloader. A KMF keeps a KVL record for each keyloader it works with.
MNP: Message Number Period. The window of message numbers a radio accepts from its KMF, which protects against replayed messages.
OTAR: Over-the-air rekeying. Sending new keys to radios by radio instead of by cable. Tactical OTAR does it from a keyloader, through a modem radio.
Radio key pair: On KFDPro, a radio's SUID and its authentication key, kept until they have been sent to the AuC or exported.
RSI: Radio Set Identifier. The address used in key management messages. A radio has an individual RSI and may have a group RSI; a KMF and a keyloader have their own.
SEK: In Tactical OTAR, the group key under which the rekeying messages sent over the air are encrypted. Each member receives it by cable when it joins the group.
SLN: Storage Location Number. The same number as the CKR; the app shows both names as CKR (SLN).
Store and forward: Carrying KMF jobs to radios by keyloader: the keyloader collects jobs from the KMF, delivers them at each radio, and brings the answers back.
SUID: Subscriber Unit ID. A radio's full identity on a system: its WACN, System ID and Unit ID. Radio authentication keys are stored against it.
TEK: Traffic Encryption Key. The key that encrypts voice and data.
TIA-102.AACD: The TIA standard for the P25 key fill device interface: how a keyloader talks to a radio over the three-wire interface or USB. KFDPro implements it and no vendor-proprietary protocol.
TWI: Three-wire interface. The key fill interface of the standard, carried on a data line, a sense line and ground.
UKEK: Unique Key Encryption Key. A KEK unique to one device, used by a KMF or an AuC to protect the keys it exchanges with that device.
WACN: Wide Area Communications Network ID. A 5-hex-digit identifier for a P25 network, part of a radio's SUID.
Zeroize: Erase every key a radio holds in one command.