TETRA and P25 Radio Security: Encryption and Keys

Police, fire, ambulance, utilities, transport and industrial sites still run critical voice and data over land mobile radio, and the security of those networks rests on encryption choices and key management that many operators inherited rather than chose. TETRA (Terrestrial Trunked Radio, standardised by ETSI) dominates in Europe and much of the world; P25 (Project 25, the TIA-102 suite) dominates North American public safety. Both offer air interface and end-to-end encryption, but the protection depends on which algorithm is configured, how keys are generated, loaded and changed over the air, and how radios are tracked when lost. Public research disclosed in 2023, known as TETRA:BURST, and ETSI's decision to put the TETRA algorithms into the public domain made these choices a board-level question for critical communications buyers. This guide explains the encryption layers, algorithm choices, key management and OTAR, and the move towards mission critical broadband, for radio network managers, security architects and procurement teams. It is defensive and describes no attack techniques.

Key takeaways

Know which algorithm each talkgroup really uses. TETRA networks may run TEA1, TEA2, TEA3 or TEA4 on the air interface; P25 systems may run AES-256, DES or proprietary algorithms. The configured algorithm, not the radio brochure, decides your protection.
Air interface encryption is not end-to-end. It protects the radio hop between terminal and base station; traffic is in the clear inside the infrastructure unless end-to-end encryption is used.
AES-256 is the P25 baseline. CISA's SAFECOM guidance strongly recommends 256-bit AES for public safety, and DHS will not approve P25 products that offer non-standard encryption without P25 AES-256.
Key management is the real control. Multi-key radios with OTAR, hardened key loaders, defined crypto periods and a lost radio procedure matter as much as the algorithm.
Plan the next algorithms and the broadband move. ETSI has added TEA5, TEA6 and TEA7 and is working on interworking security between mission critical broadband and TETRA; procurement now should assume both.

Where encryption sits in TETRA and P25

Both technologies separate protection of the radio link from protection of the conversation itself. Mixing the two up is the most common misunderstanding in risk assessments and procurement documents.

Layer	TETRA	P25	What it protects	What it does not protect
Authentication	Mutual authentication of terminal and network using the TETRA authentication and key management algorithms (TAA1, and the newer TAA2)	Link layer authentication of subscriber units to the system (where enabled)	Stops unregistered or cloned terminals joining the network	Confidentiality of traffic
Air interface encryption	TEA algorithms between terminal and base station	Not the usual model: P25 encryption is normally applied end to end by the subscriber unit	Eavesdropping on the radio hop; traffic analysis on the air	Traffic inside switches, dispatch and interconnects
End-to-end encryption	Optional E2EE layer between terminals (for example for police and security services)	Voice and data encryption with AES-256 (TIA-102.AAAD block encryption protocol), DES-OFB on legacy fleets	Content from the sending to the receiving terminal, including inside the infrastructure	Metadata such as who called whom and when
Key management	Static and derived cipher keys, over the air key management	Key management facility (KMF), key fill devices, OTAR	Keeps keys fresh and limits damage from a lost radio	Weak algorithms

The practical rule: if a threat model includes an insider or compromise inside the radio infrastructure, dispatch or interconnect links, air interface encryption alone does not meet it. Specify end-to-end encryption for those user groups, and protect the core network as an OT system with segmentation and monitoring.

TETRA encryption algorithms and the TETRA:BURST findings

The original TETRA air interface algorithm set is TEA1 to TEA4, each intended for a different user community and export context. In its 2023 activity report, ETSI's TCCE committee states that TEA2 is used in Europe and that no weaknesses have been found in TEA2, and that TEA3, used elsewhere, has not been shown to be weak. It also states that the vulnerabilities identified by research sponsored by the NLnet Foundation since 2021 were mitigated by longer keys and improvements to TS 100 392-6 and TS 100 396-6, and that there has been no reported successful attack on an operational system.

The researchers published their findings in 2023 under the name TETRA:BURST. The finding most relevant to operators was that TEA1, intended for commercial and export use, reduces its 80-bit key to a much shorter effective key, far below what modern practice accepts. For defenders the conclusion is simple: TEA1 should not be relied on to protect sensitive traffic, and fleets using it need either a move to a stronger algorithm or end-to-end encryption on top.

Public release of the algorithms: on 14 November 2023 ETSI announced that TCCE had reached full consensus, at an October 2023 meeting, to make the primitives of all TETRA air interface cryptographic algorithms public: TEA1 to TEA4, the newer TEA5 to TEA7, and the TAA1 and TAA2 authentication and key management specifications, with TCCA support.
New algorithms: ETSI added TEA5, TEA6 and TEA7 in 2022, which it describes as future-proofing TETRA against quantum attacks and as appropriate for a lifetime beyond 2040. Management rules for TEA2 and TEA5 were published at the end of 2022 and for the others in 2023 (TS 101 053-3, -4, -6, -7 and TS 101 052-1, -2).
Infrastructure updates: ask your network and terminal suppliers which firmware versions implement the mitigations ETSI references, and confirm they are deployed on every base station and terminal model in the fleet.

Situation	Recommended action
Network runs TEA1 for any sensitive traffic	Plan migration to a stronger algorithm permitted for your user community (TEA2, TEA3 or the newer TEA5 to TEA7 under ETSI rules), and add end-to-end encryption for sensitive groups meanwhile
Network runs TEA2 or TEA3	Confirm supplier mitigations are deployed, add E2EE where infrastructure compromise is in scope, plan the roadmap to TEA5 to TEA7
Clear mode talkgroups still in use	Restrict to non-sensitive operations and label them clearly to users; set terminals to warn when transmitting in clear
Industrial or transport operator on a commercial TETRA service	Ask the provider in writing which algorithm and key management are used, and whether E2EE is available for control and safety traffic

P25 encryption choices

CISA's SAFECOM guidelines on encryption in land mobile radio strongly recommend 256-bit AES for public safety systems, following the P25 Block Encryption Protocol (TIA-102.AAAD-B), and note that the P25 Statement of Requirements makes AES-256 the preferred algorithm for new systems. AES-128 and AES-192 are authorised but not preferred. The same guidance describes 56-bit DES as inadequate for new systems and suitable only for backward interoperability, and advises against proprietary or unapproved algorithms, which may not deliver their advertised key length and only interoperate with agencies using the same algorithm.

Compliance assessment: the DHS P25 Compliance Assessment Program bulletin on encryption requirements (March 2017) states that a P25 product with non-P25 standard encryption and without P25 standard AES-256 will not be approved. Acceptable configurations are no encryption, AES-256 only, or AES-256 plus a non-standard algorithm.
Validated modules: the SAFECOM guidance recommends FIPS 140 validated cryptographic modules (validated under NIST's Cryptographic Module Validation Program) for all agencies operating in secure mode, because a single radio with a weak module puts the shared key at risk for every user.
Interoperability: AES is royalty free, so it is the only option that gives encrypted interoperability across agencies and with federal partners. SAFECOM grant guidance requires NIST-compliant AES when encryption is required and federal grant funds are used.
Decision guidance: retire DES and proprietary algorithms from day-to-day talkgroups; keep any legacy algorithm only on specific interoperability keys with a dated exit plan agreed with partner agencies.

Key management and OTAR

CISA's operational best practices for encryption key management in LMR show that most real-world failures are procedural. Strong algorithms fail when keys are generated by hand, loaded with unmanaged devices, never changed or left in lost radios.

Practice	What CISA guidance says	How to implement
Key generation	Never manually generate keys; use NIST-approved methods	Generate in the KMF or an approved key generator; never type keys in
Radio capability	Buy multi-key radios that support OTAR	Make multi-key and OTAR mandatory in procurement
Key fill devices	Use hardened KFDs with Wi-Fi disabled; never use Wi-Fi enabled devices to receive or share keys	Register every KFD, restrict to named staff, store securely
Crypto periods	Define a crypto period and change schedule; monthly changing AES-256 keys are the preferred level for national interoperability keys; reduce reliance on static keys	Publish a rekey calendar; track key age per storage location
OTAR events	Announce at least two months ahead; schedule early in the day	Coordinate with partner agencies and test on a pilot group first
Lost or stolen radios	Report immediately (procedures within 24 hours); disable the device and change keys	Inhibit the terminal where supported and rekey affected groups
Records	Keep accurate records of KFDs, subscriber units and key recipients	Maintain a radio to key inventory in the asset system
Agreements	Use an MOU or MOA for shared keys with other agencies	Document key control, update timing and methods

The same principles apply to TETRA: manage static cipher keys and group keys centrally, use over the air rekeying rather than manual loading where the system supports it, and treat the key management system as one of the most sensitive assets in the organisation. See the Cryptographic Key Management Guide for the general discipline.

Where identity fits

Every radio terminal is a device identity: in TETRA it is authenticated to the network with its own key material, and in P25 it holds the traffic keys for its talkgroups. Treat terminals as non-human identities with an owner, a status and a revocation path. Link the radio inventory to the HR record of the person or vehicle it is issued to, revoke or inhibit terminals when staff leave or devices go missing, and review dispatcher and network management accounts as privileged access. The Critical Infrastructure Identity Security Guide covers this pattern across sectors.

Migration to mission critical broadband

Many operators are planning or running mission critical push to talk (MCPTT) and related services over LTE and 5G, defined by 3GPP, while keeping TETRA or P25 for years. ETSI TCCE lists ongoing work on the security required between mission critical broadband systems and TETRA. The migration period is where security gaps appear.

Interworking gateways: traffic crossing between narrowband and broadband passes through gateways that may decrypt and re-encrypt it. Specify where keys exist, who administers the gateway and how it is logged.
Two key systems: narrowband KMF and broadband identity and key management run side by side; align crypto periods and revocation so a lost device is revoked in both.
Device security: broadband terminals are smartphones and rugged devices with apps; they need mobile device management and the controls in the Private 5G and CBRS Enterprise Network Security Guide and the 5G Security Guide.
Fallback: keep narrowband encrypted talkgroups as a tested fallback for broadband outages, with the same key discipline.

Decision guidance for different operators

National public safety networks: end-to-end encryption for police and security services, current air interface algorithms for all users, central key management with OTAR, and formal key sharing agreements with neighbouring agencies.
Utilities, transport and industrial operators: radio often carries operational and safety traffic, sometimes including telemetry. Treat the radio core as part of the OT estate, require air interface encryption on all operational groups, and use end-to-end encryption where control or safety messages travel over radio.
Smaller agencies on shared systems: the system owner usually controls algorithms and keys; confirm in writing which protections apply to your talkgroups, and who can access your keys.
Buyers of new systems: require published, standard algorithms, multi-key and OTAR capable terminals, validated cryptographic modules, a firmware update commitment for the system lifetime and a stated path to broadband interworking.

Implementation roadmap

Inventory: every network, talkgroup, algorithm, key, radio model, firmware version, KFD and interconnect.
Classify traffic: decide which talkgroups need end-to-end encryption, which can use air interface encryption, and which may stay in clear.
Close the urgent gaps: deploy supplier security updates, retire TEA1 and DES from sensitive use, disable Wi-Fi on KFDs, write the lost radio procedure.
Pilot: test new algorithms or E2EE on one talkgroup, including interoperability with neighbouring agencies and dispatch recording.
Roll out by group with rollback: migrate talkgroup by talkgroup during OTAR windows; keep the previous key set available for a defined period so a failed rekey can be reversed.
Operate: scheduled rekeys, quarterly key inventory reconciliation, annual review of algorithm roadmap and broadband interworking.

Detection and measurement

Monitor: authentication failures and unknown terminal registrations, terminals transmitting in clear on encrypted talkgroups, OTAR failures, KMF administrative actions, interference reports and network management logins.
Metric: share of sensitive talkgroups on AES-256 or a current TEA with E2EE where required.
Metric: radios that missed the last OTAR, with time to remediate.
Metric: lost radio to inhibit and rekey time, against a 24-hour target.
Metric: average key age per storage location against the defined crypto period.
Metric: KFDs accounted for in the quarterly reconciliation.

Framework mapping

Control area	NIST CSF 2.0	NIST SP 800-53 Rev 5	ATT&CK
Algorithm choice and encryption	PR.DS-02	SC-8, SC-13	T1040 Network Sniffing
Key generation, distribution, OTAR	PR.DS-02	SC-12
Terminal authentication and inventory	PR.AA-01, ID.AM-01	IA-2, CM-2
Infrastructure segmentation	PR.IR-01	SC-7	T1557 Adversary-in-the-Middle
Firmware and supplier updates	PR.PS-02	SA-22
Network monitoring	DE.CM-01	SI-4

Common failure patterns

Assuming "encrypted" means end to end. Risk registers record the network as encrypted when only the air interface is protected.
Legacy algorithms kept for convenience. TEA1 or DES stays on everyday talkgroups because one partner agency or radio model has not been upgraded.
Static keys that never change. Keys loaded at commissioning remain years later, so every lost radio is a standing exposure.
Unmanaged key loaders. KFDs and programming laptops are shared, untracked or Wi-Fi enabled.
Slow lost radio handling. A missing terminal is reported days later and never inhibited or rekeyed.
Gateways outside security scope. Interworking and dispatch gateways decrypt traffic but are managed as plain IT servers.

Practitioner checklist

Document the algorithm, key type and encryption layer for every talkgroup and network.
Remove TEA1 and DES from sensitive traffic, or add end-to-end encryption, with a dated plan.
Standardise P25 on AES-256 with FIPS 140 validated modules and buy only multi-key, OTAR-capable radios.
Confirm supplier mitigations referenced by ETSI are deployed on all TETRA infrastructure and terminals.
Generate keys only in the KMF or approved generators; register and harden every key fill device.
Publish a crypto period and rekey calendar and announce OTAR events to partners in advance.
Inhibit and rekey within 24 hours of a radio being reported lost or stolen.
Bring interworking gateways and the key management system into privileged access and monitoring scope.

TETRA and P25 Radio Security Guide: Encryption, Key Management and Safe Migration