Spy sets
Burst encoders
Logo (click for homepage)
Key transfer device

The UP-2001 (or PKMX-2001) was an electronic transfer device (key-filler) for the distribution of cryptographic material , commonly referred to as Transmission Encryption Keys (TEK) [2]. It was developed by Philips Crypto in Eindhoven (Netherlands) in 1990, as an alternative to the rather limited KYK-13 filler that was used by the Army. Nevertheless it was only produced in small quantities. It was intended for users of ZODIAC equipment and for users of the Spendex 40.
The image on the right shows a typical UP-2001, as it was found on a Dutch fleamarket in 2011 [1]. It is similar in appearance to the American KYK-13 but is slightly bigger and uses a 5-pin U-229 connector, rather than the 6-pin U-329.

It has a rotary switch that is used to select the mode of operation. At the center is a red ACTIVATE button that is used in combination with a particular setting of the mode selector. The mode selector is also used for reading keys via the DB9 connector at the bottom and writing them to the U-229 connector at the top.
Philips UP-2001 key-filler, kindly donated by Remco Hopman [2].

It has some important improvements over the KYK-13 however. First of all is has room for 40 sets of key variables (compartments), whereas the KYK-13 has only 6. The required key compartment is selected by setting the 2-digit selector at the top to the corresponding number (00-39). This greatly increases the number of keys that can be carried around at any time.

The UP-2001 also features a standard RS-232 serial port which is present on a 9-pin Sub-D connector (DB-9) at the bottom. The RS-232 port makes it possible to connect a standard PC, allowing keys to be generated stored directly inside the UP-2001. The UP-2001 was succeeded in 1992 by the slightly improved UP-2101. More...
Philips UP-2001 key filler Philips UP-2001 key filler 40 key compartments Mode selector Type number plate Pressing the activate button Using the UP-2100 The UP-2001 in use with a Spendex 40 crypto phone

The UP-2001 used the DS-102 protocol, developed by the NSA, and was suitable for all Usfa/Crypto-developed military encryption devices, such as the Spendex-40, Spendex-50 (DBT) and the Trunk Encryption Device BVO. The UP-2001 featured on this page was donated to Crypto Museum in 2012 by mr. Remco Hopman [1]. He found the device for a modest price on a local fleamarket in 2011. It had probably been used with a Spendex 40 crypto phone, as the text 'fill gun (spendex)' is pencil-written on its side.
Key loading
Keys can be loaded into the UP-2001 by means of a (DOS) PC running the UP-2002 Net Key Program (NKP) software [2]. For this, the DB9 connector of the UP-2001 was connected to the COM1 port of the PC via a simple 2-wire cable. Keys were generated by the NKP and were then transferred to the UP-2001 via the serial port, one at a time, each with a suitable checksum.

This was done by placing the MODE selector on the UP-2001 in the WRITE position and selecting the desired key compartment (00-39). Next, the Net Key Program on the PC (UP-2002) is instructed to send the key (with the calculated checksum) to its COM port. The UP-2001 will produce one long beep when a valid key has been read, or three short beeps when it is wrong.
Barcode reader
It was also possible to load keys into the UP-2001 via barcodes, by using an HP HBCR-8300 barcode reader [4]. The UP-2002 NKP (see above) could be used to print suitable barcodes onto paper. This allowed the keys to be sent securely by means of a (trusted) courier, or via a fax unit connected to a secure crypto telephone, such as the Spendex 40, or a fax encryptor (PFDX).
The image on the right shows a typical Hewlett-Packard HBCR-8300 stylus-type barcode reader as it was used at Philips with the UP-2001. It is connected to the UP-2001 by means of the 9-pin male DB9 connector at the end of the cable.

Although the interface of this barcode reader is specified as RS232, its signal levels are at TTL level (0-5V) rather than the official RS232 levels (-12/+12V) [4]. Furthermore, it uses a rather strange pinout of the connector as it 'steals' its power from the host device. In order to connect this reader to a PC, an interface may be required.
The HP barcode pen connected to the UP-2001

The UP-2001 has been designed to accept both the TTL and RS232 levels and does not need any modifications for connecting the barcode reader. Furthermore, the data from the HBR-8300 is interpreted directly by the firmware of the UP-2001 and converted to the appropriate key format.

When transferring keys to the UP-2001 using barcode, the barcode has to be in a particular format. The barcode always starts and ends with a star symbol (*). Between the stars is the key, in which each character represents one nibble (i.e. 4 bits) of the key. As the key consists of 120 bits plus an 8-bit checksum (i.e. 128 bits in total), 32 characters are needed.

The MODE selector of the UP2001 is now set to WRITE and the desired key compartment is chosen (00 to 39). The barcode is then used to swipe over the barcode. When a valid barcode is read, the UP-2001 will beep. If the barcode represents a valid key, one long beep will be heard. If the key was not valid, the device will produce three short beeps.
HP HBCS-6300 barcode reader Barcode pen The HP barcode pen connected to the UP-2001

FILL connector
The UP-2001 uses a 5-pin U-229 type connector for connection to the crypto device, rather than the more common 6-pin U-284. Is it nevertheless compatible as the extra pin (F) is not used. The table below shows the pin-out of the connector. More information on the special U-229 page [3].

U-229 pinout. Click for more information.

Pin DS-102 Description
A GND Ground (common wire)
B - Not used
C ACK FILL request acknowlegment
D DATA Fill data into radio or crypto device
E CLK Fill clock into radio or crypto device
F - -

RS-232 socket
Pin Name Description
1 n.c.  
2 TX Data from the barcode reader
3 RX Data from the UP-2001 to the barcode reader
4 n.c.  
5 n.c.  
6 n.c.  
7 GND Ground (common 0V line)
8 n.c.  
9 Vcc 5V power supply to the barcode reader

The body of the UP-2001 measures only 9.5 x 5 x 5.5 cm and is made of die-cast aluminium, with a folded aluminium lid. The device can be opened by removing 4 2.5 mm screws from the lid, after which the battery compartment and part of the main PCB is exposed. The device is powered by two Philips UP-6303 batteries of 3.6V each (7.2V total). These batteries have the shape of a standard penlight battery. Good alternatives are available from Tadiran (TL-5104) or Contrad Elektronik in Germany (EVE, order number 650773-89, or Emmerich 651244-89).
The main PCB consists of 3 (rigid) parts that are interconnected by integrated flex PCBs. The entire flex-rigid contruction can be folded in such a way that it nicely fits the case. Each PCB is held in place by a set of 2.5 mm bolts.

The image on the right shows the opened UP-2001. The battery compartment and the 2-digit key selector have been removed (front right), and the 3-part PCB has been folded-out. The center part holds the main 8051 microcontroller. According to the label on the controller, the firmware was released on 7 November 1990.
UP-2100 interior

To the right of the controller is a pair of (white) sockets that normally hold the key selectors. Once the PCM is mounted inside the case, the key selectors are inserted through a hole in the front panel and mate with the white sockets on the center PCB.

The upper board holds 3 PCF-8570P memory chips that contain 256 bytes of low-voltage RAM each. This is enough to hold 40 keys of 128 bits each. The memory chips communicate with the microcontroller via the I2C bus. The lower PCB holds a MAX-666 power supervisor.
UP-2100 interior Battery compartment (2 x AA-size battery) Interior, showing the battery compartment and part of the PCB Interior of the UP-2100 8051 Microcontroller PCF8570P Memory 8051 microcontroller UP-2100 interior

Technical specifications
  • Identification: UP-2001 or PKMX-2001, Philips Usfa BV, Fill Gun
  • Storage capacity: 40 keys
  • Transmission: serial asynchronous (DB9) or synchronous (U-183U)
  • Asynchronous data: 9600 baud (DB9)
  • Synchronous data: conform DS-102 (U-183U) 1bps-5kbps (RX), 1.6kbps (TX)
  • Dimensions: 125 x 50 x 71 cm
  • Temperature range: -20 to +45°C (operating), -25 to +60°C (storage)
  • Power supply: 2 x UA-6303 lithium cells (3.6V each)

  1. Remco Hopman, Philips UP-2001 - THANKS!
    Donator of the UP-2001 featured on this page. Eindhoven, April 2012.

  2. Philips Crypto BV, PKMX-2001 (UP-2001) System description and Operating Instructions
    Philips publication 9922 154 13672. Date unknown.

  3. Crypto Museum, U-229 Connector
    Description of the US Army and NATO standard audio and FILL connector.

  4. Hewlett Packard, Hewlett-Packard SmartWand Bar Code Reader
    HBSW-8000 series datasheet. Tecnical Data. Retrieved July 2012.

Further information

Any links shown in red are currently unavailable. If you like this website, why not make a donation?
Copyright 2009-2013, Paul Reuvers & Marc Simons. Last changed: Tuesday, 16 April 2013 - 20:22 CET
Click for homepage