I'm taking another look at this after a year or so. To summarise:
1. Anubis_Ir reversed this D5/T3 style EC tag ECM, and with the AES keys that were/are available, we are able to see an encouraging cycling pattern of odd/even CWs.
2. Anubis_Ir was the first to point out that the supplied AES IV might be wrong, and we'd still see the CW cycling pattern. Where did that IV come from? And why the doubt - the rest of the reversing appears perfect?
3. The AV (elementary) streams are not crypted with DVB-CSA / 48 bit key - other cyphers must be tried.
Of those candidate cyphers - and there may be others - 3DES & AES can be rejected as their key is > 64 bits.
I'm assuming that the IV *is* correct, then testing different cyphers on the stream. Test method:
1. I've logged ecms covering one crypto period, and captured payloads marked with the PUSI bit set for the same period.
2. After applying the correct key / cypher, the first 3 bytes of those payloads with PUSI bit set should decrypt to known plaintext 00 00 01.
I've tried CSA with uncorrected checksums, both enc & dec. I've tried DES, enc & dec, ecb & cbc. Doesn't seem to be those, but I might be wrong.
Multi2 is new to me, used in the Japanese digital TV standard ARIB B25. There' a variable number of rounds (but it appears 32 are used in Japan). And an extra system_key, quoted in some literature as the same across all DVB usage (or at least that's how I read it).
Anyone know what the needed multi2 DVB system_key might be?
