Testing MIKEY-SAKKE Encryption – Securing Real-time Communication

We have talked often on this blog about the importance of reliability of Mission Critical Communcations for public safety, and the importance of interoperability with technologies such as MCX, MCX-IWF, P25, NG911, and other emerging technologies.  But what about the security of communications.  

Emergency services in mission-critical sectors need the ability to communicate in real-time across a variety of devices via secure connections.  Cybercriminals continue to look for ways to attack infrastructure, so a scalable, secure encryption exchange is important.  

Multimedia Internet KEYing – Sakai-Kasahara Key Encryption (MIKEY-SAKKE)

MIKEY-SAKKE is a highly scalable encryption key exchange protocol created to ensure secure, real-time communication for voice, video and data.  The protocol is designed to be centrally managed and does not require an always on (PKI) or certificate validation during the call.  In addition, while centrally managed, MIKEY-SAKKE does not require interaction with the centralized architecture during the call.  

As described by the UK National Cyber Security Centre in their FAQs page, “Like other enterprise services, such as Blackberry's Enterprise Server and Microsoft's Active Directory (and other Kerbero-based authentication systems), it requires central management by the enterprise, in this case through a 'Key Management Server' (KMS). Once set up, it allows members of the government department or enterprise to communicate securely by providing their key material. To be clear, the security of the system is entirely controlled by the enterprise through the KMS.”  

Some of the features of MIKEY-SAKKE include:

• Identity-Based Encryption (IBE): Uses Sakai-Kasahara IBE, allowing a user’s identity (e.g., phone number, SIP URI) to act as their public key.

• Pre-Distributed Private Keys: Private keys are securely provisioned by a central authority in advance, removing the need for complex PKI lookups in real time.

• No Real-Time Certificate Validation: Simplifies session setup and reduces latency for time-sensitive communications like Push-to-Talk (PTT) or emergency calling.

• End-to-End Encryption:  Ensures only the intended recipients can decrypt communications, even if transmitted over untrusted networks.

• Scalable Management:  A central Key Management Server (KMS) can provision, revoke, and rotate keys for large numbers of users efficiently.

Applications of MIKEY-SAKKE

While the MIKEY-SAKKE technology is primarily intended to secure sensitive exchanges between public safety or other government staff, other industries where security is important, such as the financial, legal or healthcare sectors, can benefit from the protocol.

Testing MIKEY-SAKKE with Valid8

Valid8’s Virtual Labs solution enables organizations to test their equipment and networks for compliance with MIKEY-SAKKE.  Tests can monitor the call flow from the user through the MCX service to the other user, ensuring the encryption and decryption process operates correctly.  In addition, Virtual Labs allows businesses to simulate unexpected events to ensure the robustness of the equipment.  

‍

Conclusion

MIKEY-SAKKE offers a unique balance of strong cryptography, operational efficiency, and centralized trust control—making it particularly suited to organizations needing secure, high-availability, interoperable communications without the complexity of conventional PKI systems.  

Valid8 Virtual Labs delivers a comprehensive testing platform to ensure the security of critical communications, including the testing of MIKEY-SAKKE.  

‍