Nagra Hex block Decryption

[jor]

Not everything and not all correct ... At least this is my opinion.

 

[jor]

The conclusion I came to for the wrong results, is that if I use CMD0E either with FFFFFFFFF stbird or the real one then I have to use, during building payload CMD03, not the RSA68 from dt05_10 but the RSA68 that comes from the expansion of 0x18 of rsamod88 to 2 primes 0x34 long. Is it right ??

 

[electron112]

i talk you if you want have right calculation you need work with your proper log

you need log complete init of your card / box

 

[jor]

I replied you that i have a log of a same card HD02 in an alphacrypt module and I am trying to adapt it to my case. I am not owner of such a module unfortunately.

 

[electron112]

friend you dont want listen
if you want understand the init process you must

in first time
- dump your box
- extract your data
- make a complete log init of your card / box with season
- ( hard work you need make access to your cpu too ) this is for complet work

in second time
you can study

 

[jor]

Maybe you don't know about alphacrypt module. This card can be read outside of any box and inside this module. They have managed to extract all the necessary "stuff" and now the card runs to this module. From this case I have a log which shows all the steps which I followed with success except cmd03 which I cannot reproduce the data of the log. No more no less. Thank you very much for your effort but your approach is general.

 

[jor]

First of all is this procedure to produce cm03 payload special for HD02 ?? Because in pdf is described totally different.
Next, at first step which is "a - your secret " ?? How is it calculated ??
At 2nd step which are "d - exponent, source is decrompressed pk35[0..23] n - modulo, source is decompressed pk35[0..23]" ?? How are they calculated ?? Are 24 bytes long ??
At 3rd step, now it is clear that I have to use the RSAN68 which comes out of dt05_10 reply.
Thank you very much for sharing your knowledgement.

 

[wasserwaage]

Before asking any further questions, please study Diffie-Hellman and RSA.

 

[jor]

@wasserwaage
please correct if I am wrong. I found the next example about Diddie-Hellman

1 Alice and Bob agree on p = 23 and g = 5.
2 Alice chooses a = 6 and sends 5 ^ 6 mod 23 = 8.
3 Bob chooses b = 15 and sends 5^15 mod 23 = 19.
4 Alice computes 19^ 6 mod 23 = 2.
5 Bob computes 8^15 mod 23 = 2.
Then 2 is the shared secret.

Let's suppose that Alice is receiver/cam and Bob is the card. How do I know what the receiver and the card have chosen a, b??

 

[wasserwaage]

How do I know what the receiver and the card have chosen a, b??

you did not understand the secret of dh...

 

[blubber83]

just use random data for 'a' lol - as long as the length is correct

 

[jor]

I think that the secret of dh is that you don't send the secret that you choose randomly but g^a mod p and the receiver-card computes (g^a mod p)^b mod p to find the common secret number where b is his secret number. So I guess to choose 0x010001 as my secret.

 

[jor]

Going one step further is it right to assume that
d - exponent, source is decrompressed pk35[0..23]
n - modulo, source is decompressed pk35[0..23]
are calculated from the 2 primes 0x30 long of 0x18 rsa88 expansion ???

 

[XIL1NX]

if you have to assume: jmp 0

 

[jor]

if you have to assume: jmp 0

Sorry but I didn't understand you. What do you want to say ??

 

[wasserwaage]

he try to said, you know nothing about this ca system and the basics

 

[Benfica200]

I think that the secret of dh is that you don't send the secret that you choose randomly but g^a mod p and the receiver-card computes (g^a mod p)^b mod p to find the common secret number where b is his secret number. So I guess to choose 0x010001 as my secret.

aliceSecret = 11
sharedBase = B6711Cxx592
sharedPrime = DB9ExxD5
bobSecret = 03
Alice Sends Over Public Channel = 194F8658219F2BC608CADD6E09C930B81EA4A29253D46203EA810203FA892DF80B20C6069829C4E3F755B3BC903BEBA0DEE4DC9DADAFA00072613F77ECB76F567BE0D3FCC9BDD48369ACC8598B612F61----->A = g^a mod p
Bob Sends Over Public Channel = C5FE31929E7FA003C3AA6CDB64BC50F608DA45002AAD140A999D24B91343D022CD1A12C01691AD5A737C0C62E15D9E1EAB04FDAB87EF656324512B4851F6251B5093E8550F8C7B4F2DEE88511DF04CC3
Alice Shared Secret = 89956A4B73C0E3DA9648CDE7799683891D54FA69CDEB8704E2EB0AD18E57B3D7B418C8DC5C43AE2D77FC46003740B4B3DECE2DD72464999280E2ECF1306C14C1C6F3D4DA32087066B0E6A4DE6E61118A
Bob Shared Secret = 89956A4B73C0E3DA9648CDE7799683891D54FA69CDEB8704E2EB0AD18E57B3D7B418C8DC5C43AE2D77FC46003740B4B3DECE2DD72464999280E2ECF1306C14C1C6F3D4DA32087066B0E6A4DE6E61118A

 

[jor]

he try to said, you know nothing about this ca system and the basics

Maybe you are right about this ca because last days I started to deal with it but I am satisfied with the progress I made taking into account that I had only one pdf with a lot wrong informations and the help of a few people. Regarding the "basics" I think you judge me very strictly. If I have made you feel nervous with my questions please accept my apology.

 

[blubber83]

I think you are just trolling with pretended smattering knowledge

 

[jor]

I think you are just trolling with pretended smattering knowledge

Wrong thought but I have no way to convince you.