Radio, SDR and RF Security Fundamentals — DedSec Project

Build the signal-processing literacy needed to reason about wireless systems safely: spectrum, modulation, framing, synchronization, RF fingerprints, replay risk and legal/ethical lab boundaries.

Learning objectives

By the end of this module you should be able to:

• Explain frequency, bandwidth and sampling and identify its most important trust boundary, state transition, and evidence source.
• Explain I/Q representation and identify its most important trust boundary, state transition, and evidence source.
• Explain modulation and symbol timing and identify its most important trust boundary, state transition, and evidence source.
• Explain preambles, frames and checksums and identify its most important trust boundary, state transition, and evidence source.
• Explain noise, interference and SNR and identify its most important trust boundary, state transition, and evidence source.
• Explain receive-only spectrum analysis and identify its most important trust boundary, state transition, and evidence source.

Deep concepts

1. frequency, bandwidth and sampling

RF analysis starts with frequency range, occupied bandwidth, sample rate, and receiver limitations. A sampled signal is only a representation of energy within the configured front end, so document gain, filters, antenna, clock, and environment before drawing protocol conclusions.

2. I/Q representation

Software-defined radios commonly represent a signal as in-phase and quadrature samples. I/Q preserves amplitude and phase information needed for digital demodulation, but raw samples do not identify a protocol or sender without additional framing and context.

3. modulation and symbol timing

Modulation maps information onto changes in amplitude, phase, frequency, or combinations of them. Correct decoding also depends on symbol timing, carrier synchronization, channel conditions, and protocol parameters, which should be measured rather than guessed.

4. preambles, frames and checksums

Wireless protocols use synchronization/preamble patterns, headers, payloads, checksums or stronger integrity mechanisms to frame data. A checksum detects accidental corruption but is not an authentication mechanism unless a cryptographic construction explicitly provides authenticity.

5. noise, interference and SNR

Noise and interference can look like protocol failure or security events. Measure signal-to-noise ratio, channel occupancy, receiver saturation, and environmental changes before attributing missing or malformed frames to an attacker.

6. receive-only spectrum analysis

Receive-only analysis is the safest default for learning RF behavior. Use owned devices or licensed/public test signals, record only what is necessary, and avoid decoding private communications that you are not authorized to inspect.

7. authentication versus signal presence

Detecting a waveform or valid-looking frame proves only that energy or syntax was observed. Security decisions require cryptographic or trusted identity context; physical proximity and RF strength are not reliable authentication by themselves.

8. replay resistance and rolling state

Protocols that authorize physical actions need freshness such as nonces, counters, challenge-response, or carefully managed rolling state. Test replay resistance with synthetic/owned devices and focus on state synchronization and recovery rather than reproducing unauthorized control actions.

Authorized lab sequence

• Lab 1 — Use a prerecorded or synthetic IQ dataset and identify signal bandwidth, bursts and framing without transmitting.

• Lab 2 — Create a toy digital-radio frame format and add sequence numbers plus a MAC in software to demonstrate freshness/integrity.

• Lab 3 — Document how a rolling-code design differs from a static replayable identifier.

Knowledge checks

Answer these without looking at the notes:

Next modules

Recommended related modules: 016, 051, 055, 077, 083, 122. From the main menu, choose Search lessons to find related sections across the full guide.