KG-84 is a dedicated loop
encryption device
for digital data, introduced around 1981 by the USNational Security Agency (NSA), for use
by the American Department of Defense (DoD) and by
NATO. The device
uses the SAVILLE encryption algorithm[1]
– jointly developed by GCHQ
and the NSA
– and was approved for all levels of classification.
When unkeyed, the KG-84 is unclassified, but remains a Controlled
Cryptographic Item (CCI). It was succeeded in the mid-1990s by
KIV-7.
The KG-84 measures 38 x 19.5 x 19 cm and weighs approx. 10 kg.
Its form factor allows two units to be installed side-by-side
in a single 19" rack space. All controls are at the front,
with the configuration settings hidden behind a hinged lid.
All connections – with the exception of the U-229 key FILL socket –
are located at the rear.
The KG-84 was manufactuered in the United States
by Bendix Communications Division, Pulse Engineering
and E-Systems (now: Raytheon).
The image on the right shows a typical KG-84A
that has been in service at NATO
until at least 1992.
The KG-84 (A/C) has a wide range of configuration options, most of which
are hidden behind the hinged lid
that covers the upper half of the
front panel. In asynchronous mode, it can handle data rates between
50 and 9600 baud. In synchronous mode – using the internal clock –
it can handle data up to 32,000 baud, and with an external clock connected
it can even go up to 64,000 baud.
Furthermore, the KG-84 is suitable for full-duplex, half-duplex and
simplex communication.
The KG-84 was developed in 1981 and was first introduced with the US Army
and the US Navy in early 1984.
Following the John Walker Incident
— in which the KW-7 cipher machine had been
compromised for many years — the US
Central Intelligence Agency (CIA)
also introduced the KG-84 on its main communications
circuits [6].
In 1988, the improved KG-84C was introduced, which offered several
advantages over the KG-84 and KG-84A, including an improved handling
of synchronisation on unstable HF radio links and the ability to handle the
European telex protocol.
The device replaced earlier and ageing encryption systems, like the
KW-7,
KG-13,
KG-30,
KG-33
and the KG-34.
The KG-84 was also used by NATO
and, from 6 November 1989 onwards,
by the Government of Australia [8].
The price for a single KG-84A unit in 1988, was US$ 5000.
From the mid-1990s onwards, KG-84 was gruadually replaced
by the smaller and more versatile KIV-7 —
announced as an embeddable KG-84 module —
which has the form factor of a CD-ROM player.
The diagram below provides a quick overview of the controls at
the front panel of the KG-84A.
The upper half is covered by a hinged lid, behind which the
configuration of the device can be set.
Below the lid is the ON/OFF switch, the INITIATE switch and
a compartment for the backup battery, which is needed for retaining
the keys when the device is not powered externally.
To the right of the battery compartment is the ZEROIZE switch.
Activating this switch — pull out and push it down —
purges the cryptographic keys instantly. As the KG-84 uses the highly secret
SAVILLE cryptographic algorithm, its keys are 128 bits long
(120 key bits plus 8-bit checksum).
This means that a regular DS-102 compatible FILL device
– such as the KYK-13 – can be used to transfer the keys.
The KG-84 can hold up to four such Traffic Encryption Keys, or TEKs,
selectable with a rotary switch at the bottom left.
The image on the right shows a regular KYK-13 fill device
connected to the U-229 FILL socket at the bottom right of
the front panel of the KG-84. To transfer a key, the MODE selector of the
KG-84 should be set to FILL-V and the desired key compartment should be
selected with the rotary switch at the bottom left of the front panel.
Next, the corrsponding key compartment on the KYK-13 should be selected,
after which the INITIATE button is pressed to start the transfer.
Up to four keys can be loaded this way. Once all keys are installed,
the MODE selector is set to the desired mode of operation, and the
KYK-13 is removed again. The FILL socket is normally covered by a
rubber cap, to keep its contacts clean.
Versions
KG-84
Initial version of the KG-84 Dedicated Loop Encryption Device (DLED),
introduced in 1984.
RS-232 serial interface. Single-ended data signals.
KG-84A
Improved version of the KG-84.
Suitable for use over landlines, microwave links and satellite.
Supports TRI-TAC switched networks,
RS-232 or RS-449 serial interface (strap selectable).
Single-ended or balanced control signals. Addition of X-VAR mode.
Improved remote keying.
The device featured on this page, is of this type.
KG-84C
Same as KG-84A, but with improved HF capability, out-of-sync detection,
asynchronous ciphertext, plaintext bypass and European Telex protocol.
The KG-84 is housed in a die-cast aluminium enclosure that mesasures
38 × 19.5 × 19 cm and weighs just over 10 kg.
The interior is accessible from the top and from the bottom, by removing the
bolted panels. The case has several
shielded compartments for full RED/BLACK separation.
At the bottom are two backplanes:
one for the BLACK side and one for the RED side. Printed circuit boards (PCBs)
are inserted into this backplane from the top of the device.
The diagram above gives a clear overview of the PCBs and the compartments
into which they are installed.
The compartments at the rear hold the PSU and the
physical line interface. The compartments at the front hold the controls
and their wiring to the backplane. At the centre are three further
compartments: one for the black side, one for red and one for
the interface between them.
With the exception of the Power Supply Unit (PSU), all board are
removable and have a metal tag with their ID and serial number at
the upper edge. They can be extracted by folding out the two plastic levers
and lifting the board upwards. Only two boards are marked CCI (in earlier
versions they were marked: CONFIDENTIAL). These boards contain the
custom-made chips that hold the SAVILLE encryption algorithm.
They are identical to the ones found in the
KY-68 crypto phone.
The simplified block diagram below shows the working principle of the
KG-84.At the left is the black side, which is connected to the outside
world. This is usually an (insecure) telephone line or (microwave) radio link.
At the right is the red side, to which the (secure) equipment is connected.
Each side (black and red) has its own power supply unit (PSU), input/output
circuitry (I/O) and control (CTL). At the centre (the grey area) is the
bridge that connects the red and black sides.
The bridge is also responsible for distributing the clock signals (CLK)
to both sides without loosing the red/black isolation. The (full-duplex)
crypto-logic is located at the red side (CCI).
Circuit boards
Below is an overview of the various plug-in cards of the KG-84a, complete with
a description of their function. Note that two boards are marked CCI, which means
that help hold classified parts. The individual chips (custom-made by RCA) on
these boards are also marked CCI (confidential).
Modification of AN/TYC-5A(V) to accept TSEC/KG-84 equipment
Glossary
CCI
Controlled Cryptographic Item
Expression, introduced by the US
National Security Agency (NSA), for equipment
that handles information, secure communications, or otherwise contains a
cryptographic component which performs a critcal communications security
(COMSEC) function. CCI items are subject to special
accounting controls and required markings.
➤ Wikipedia
DLED
Dedicated Loop Encryption Device
General purpose encryption device for the protection of data streams
between two fixed points (point-to-point).
The KG-84 is such a DLED.
Any links shown in red are currently unavailable.
If you like the information on this website, why not make a donation?
Đ Crypto Museum. Created: Tuesday 24 August 2010. Last changed: Monday, 03 August 2026 - 16:15 CET.
