KFDPro
Buy

Radio authentication

Load P25 radio authentication keys into radios over USB, keep each radio's key with its SUID, and send the pairs to your Authentication Center, or export them for entry by hand.

A radio is provisioned with an AES-128 authentication key stored against its SUID (WACN, System ID and Unit ID). KFDPro loads the key into the radio and keeps a copy as a radio key pair, until it has been sent to the AuC or exported. It can hold up to 475 pairs. Our AuC connection is validated against Authentication Center release R25.

  1. Your radios
  2. Radio's USB cable · key loaded, SUID read
  3. KFDPro
  4. Wired Ethernet · key pairs sent
  5. Your AuC

USB only

Authentication keys are loaded over the radio's USB programming cable, never the three-wire adapter. The radio must have radio authentication enabled.

Set up (once)

  1. Open Radio authentication from the main menu, then the Radio authentication settings row.

  2. Set System ID (3 hex digits) and WACN ID (5 hex digits) for your system. An auto-generated key is only loaded into a radio on this system.

  3. Leave Radio port (49165) and KVL Radio Auth ID as they are unless your system uses other values. The KVL Radio Auth ID is this unit's RSI toward the radios and the AuC.

  4. Tap Authentication center and set the AuC ID, the AuC port (default 49165), the Main AuC IP address (and a Backup AuC if you have one), and the AES128 UKEK from this unit's KVL record in the AuC.

The Radio authentication settings: System ID, WACN ID, Radio port, KVL Radio Auth ID and Authentication center.
Radio authentication settings Set the system before provisioning.

Caution

Changing the System ID or WACN ID removes every radio key pair held on the unit. Send or export them first.

Provision a radio

  1. Turn the radio on and switch it to a channel on the trunking system, so it has an active SUID.

  2. Connect it with its USB programming cable (see USB keyloading).

  3. In Radio authentication, tap Provision radio, then:

    • Auto generated to have the unit generate the key, or
    • Manually entered to type the 32 hex digits of an AES-128 key (Auto fills in a random one).

  4. The unit reads the radio's SUID and loads the key. If the radio already has an authentication key, you are asked whether to replace it.

  5. The result reads Radio ID: 1092 Succeeded (with the radio's unit ID). Tap Provision next radio and connect the next one.

The Provision radio screen offering Auto generated or Manually entered.
Provision radio Generate the key, or enter one.

Send the key pairs to the AuC

  1. Connect the unit's Ethernet port to a network from which the AuC can be reached.

  2. In Radio authentication, tap Connect to AuC, then Network.

  3. The session runs by itself: Connect, then Send (Sent 3/5 radio key pairs), then Complete.

Pairs the AuC accepts are removed from the unit. Any it doesn't accept stay on the unit (Send failed: The AuC did not accept…) so you can try again.

Export the key pairs for entry by hand

Where the AuC can't be reached from where you are, export the pairs as an HTML report and enter them into the AuC by hand.

  1. Switch on Settings › View stored key material (it asks for your PIN if one is set).

  2. Plug a USB drive into the USB-A port.

  3. In Radio authentication, tap View provisioned radios. Select the radios, or none for all of them, then tap Export keys.

  4. Swipe to confirm Export authentication keys in the clear?, then choose the USB drive. The file is named like KFDPro-radio-auth-keys-20260925-143000.html.

Caution

The report holds every authentication key in the clear, because the AuC needs them. Once the AuC has every pair, destroy the file and any copy of it. Switch View stored key material off again.

Managing provisioned radios

View provisioned radios lists every pair waiting to go to the AuC, by radio ID, System and WACN. Sort them by time or radio ID, filter by radio ID, and use Remove selected to delete pairs you no longer need. A removed pair can't be sent to the AuC. The unit warns you once it holds 200 pairs; send them before it fills at 475.

Problems provisioning? See Radio authentication problems.