Wisconsin Statewide Encryption Plan

Wisconsin Statewide Encryption Plan: Addendum A

October 2025
v1.1
Developed by the Land Mobile Radio Subcommittee of the Interoperability Council.

EXECUTIVE SUMMARY

This plan provides a framework for Public Safety Radio communications encryption programming within the State of Wisconsin to help ensure interoperability, compatibility, and safety, and to prevent programming conflicts. All Wisconsin agencies and radio programmers are asked to comply with this plan. In some cases, grant funding may depend on compliance with this plan. This plan is currently being used with the legacy WISCOM radio system and will be used with the new WISCOM 800 statewide radio system.

Many Wisconsin agencies have used locally focused encryption planning, with many agencies inadvertently duplicating other agencies’ chosen Storage Location Number (SLN) or Common Key Reference (CKR) identifiers, with many using SLN 1. In addition to these conflicts, evolution of encryption features and terminology within the industry has introduced new terminology pertaining to the identification of encryption keys and the key storage locations into which they are stored in a subscriber radio or encryption key fill device (“keyloader”).

This plan was created and designed with the surrounding states and their known encryption plans in mind, along with those of the federal government, which has set aside KID 1-20 for federal use, along with KID 800-899 for state use. Additional research has been done to minimize other potential conflicts. The revised assignment and programming guidance contained herein seeks to eliminate this very real problem occurring today.

This plan should be disseminated to all public safety radio system administrators, technicians, programmers, and consultants operating in the State of Wisconsin.

This plan is maintained by the Land Mobile Radio (LMR) Subcommittee of the Wisconsin Interoperability Council. Inquiries may be directed to the LMR Subcommittee via the Wisconsin Department of Military Affairs – Office of Emergency Communications (OEC) (https://oec.wi.gov) at interop@widma.gov.

KEY ID AND STORAGE LOCATION OVERLAP

It is critical to note that any subscriber radio or keyloader can only have one instance of any SLN programmed per specific stored cryptographic key and its associated Key ID (KID). Any one SLN cannot be replicated over and over to accomplish storing numerous keys for different agencies that all use the same SLN for different cryptographic keys.

This issue appears especially with single key subscriber radios or agencies that have been using SLN 1 regardless of key/KID value. Any agency wishing to have encrypted communications with mutual aid partners cannot continue to use SLN 1 as subscriber radios capable of multiple key encryption cannot store more than one key/KID per each unique SLN.

Example:

“Agency A” stores their single AES-256 cryptographic key in subscriber radios using SLN 1, but the actual KID is 1000

“Agency B” stores their single AES-256 cryptographic key, which is different than “Agency A”, in subscriber radios using SLN 1 but the actual KID is 2000

“Agency C” needs to interoperate with both “Agency A” and “Agency B”, but has multiple cryptographic keys stored in their subscriber radios given their large area of responsibility. This agency already has a neighboring state’s AES-256 key that uses SLN 1, but the actual key/KID is 3000.

Even though all three agencies have SLN 1 used in the subscriber radio programming, these agencies cannot talk encrypted to each other. This is because these agencies cannot store each other agency’s AES-256 cryptographic key in such a manner that the subscriber radio will recognize where to look for the other agency’s key location (SLN) within the radio programming.

If all three agencies are able to equip their subscriber radios with multi-key AES-256 encryption and then follow the guidance of this plan, namely using an SLN that matches their KID, this conflict is avoided, and each radio can have all 3 unique cryptographic keys programmed and accessible.

TYPES OF ENCRYPTION

There are various encryption algorithms on the market today for public safety users. Three earlier variants include Advanced Digital Privacy/Alleged RC4 (ADP/ARC4), Data Encryption Standard-Open Feedback Mode (DES-OFB), and DES-XL, a vendor proprietary implementation of DES. The latest algorithm widely supported for public safety use is Advanced Encryption Standard, 256 bits (AES-256). AES-256 is the only radio encryption algorithm recognized as secure by the federal government and will be the encryption algorithm allowed on the WISCOM 800 system

This plan also recommends the use of “strapped” encryption on any encrypted channel or talkgroup. “Strapped” encryption refers to encryption that is permanently enabled on the channel or talkgroup with no option for the user to turn it off; all communication is encrypted whenever the channel or talkgroup is selected. The WISCOM 800 system will require the use of strapped encryption.

ENCRYPTION PLAN

The assignment table in Addendum A assigns a unique KID/LID range to each county to be used by that county and other agencies within the county. The table also lists the legacy State of Wisconsin plan assignments, along with active ranges and assignments managed by other entities.

The plan shows the KID/LID (Key ID (digital) / Logical ID (analog)) range in decimal format and hexadecimal (HEX) format. For example, Adams County has the KID/LID range of 2810 to 2819 assigned to it, allowing multiple agencies within the county to have their own unique KID/LID. The Sheriff’s Office could use KID 2810 (0xAFA); if the City of Adams wanted their own KID/LID, it could be 2811 (0xAFB), the next agency could be 2812 (0xAFC), and so on. Individual KID/LID assignments within each county are to be managed by an appropriate authority within the county (i.e. county radio system administrator or manager, etc.).

The plan does not list separate SLN/CKR assignments; rather, this plan suggests the use of the KID/LID in decimal format as the SLN/CKR when assigning a key storage location to avoid conflicts in subscriber radios and keyloaders.

IMPLEMENTATION

This plan is currently in effect, however if not in compliance, agencies should start migrating to this plan at their first opportunity (on their next reprogramming). As agencies across the state are preparing to migrate to the new WISCOM 800 radio system and begin sourcing new subscriber radio equipment, opportunities exist for local, county, and regional encryption plans to be brought into compliance with this plan. Agencies that continue to use SLN/KID 1, or any other SLN/KID assigned under the old plan will encounter overlap issues with other agencies that migrate to the new plan, which will limit interoperability.

For OEC grant programs associated with the migration to WISCOM 800, compliance with this plan is mandatory for any radio purchased or upgraded with awarded grant funds to include encryption capability. Only AES-256 multi-key encryption is eligible for grant funding. Please refer to the applicable grant guidance documents for more information.

Compliance to this plan for grant purposes is the responsibility of the owner, manager, or maintainer of the encrypted talkgroup(s) or channel(s) and the associated encryption key(s)/KID(s). Owners of encrypted talkgroup(s) or channels and keys/KIDs that are not currently in compliance with this plan shall submit a written plan to bring encryption usage into compliance with the state plan, with a certification to that effect, with their grant application.