While definitely better than the non-encryption of CTCSS etc, P25 encryption has some relatively concerning implementation problems. It's possible none of these actually matter for your usecase as many are related to UX around configuring and using encryption in an institutional setting, but the unauthenticated traffic injection, induced transmission and jamming issues are, well, not great no matter how you look at it.
I will grant that the open-source kfdtool keyloader boxes are neat.
I have been meaning to see if I can repro the induced transmission via retransmission requests thing when the data packet stuff is fully disabled via CPS, but a friend permanently borrowed my hackrf so that project is on hold for now. I'm not optimistic, though, due to the comments in the paper about where in the stack the retransmission request is processed.
https://www.mattblaze.org/blog/p25
https://www.mattblaze.org/papers/p25sec.pdf
I will grant that the open-source kfdtool keyloader boxes are neat.
I have been meaning to see if I can repro the induced transmission via retransmission requests thing when the data packet stuff is fully disabled via CPS, but a friend permanently borrowed my hackrf so that project is on hold for now. I'm not optimistic, though, due to the comments in the paper about where in the stack the retransmission request is processed.