New BISS algo? (TESTCA @ 7°E)

orangebirds

orangebirds

Member
Messages
337
campag5242 said:
@orangebirds - it's all detailed in the EBU specs: https://tech.ebu.ch/docs/tech/tech3292s1.pdf

Those IDs you mention are for use in Biss2-CA EMMs, which use RSA-2048, so that gives you the length of those keys.

The ECMs are decrypted using AES with an SK derived from the EMM for entitled decoders.

To gain a full understanding, write the specs up in source code - there are examples in the appendix to verify you've done it correctly. Or browse nautilus7's oscam-emu source as a further guide.
Click to expand...

I read that exact document before asking the question, I just did not understand that part, nor I understand OSCam's source code :confused:

harshy said:
So it’s openable?
Click to expand...

If it's meant to be opened of course it's openable, it's just on what ways it can be opened?
 
N

nautilus7

VIP
Messages
607
Yes, retrieving a PEM file/RSA private key from an ird will work. But they could easily revoke that PEM file/RSA private key once it gets leaked.

The reason you don't understand oscam-emu's code is because you don't know coding and C, or because it's not well written?

There are 2 separate operations for biss 2 mode ca:

the ecm algo (just 1 function): https://github.com/oscam-emu/oscam-patched/blob/master/module-emulator-biss.c#L561

and the emm algo (3-4 functions): https://github.com/oscam-emu/oscam-patched/blob/master/module-emulator-biss.c#L738

Also there is a function that reads PEM files and creates the ekid for each RSA private key: https://github.com/oscam-emu/oscam-patched/blob/master/module-emulator-biss.c#L831

I would say that it is pretty much straight forward to understand it, especially if you have the specification along side.


I uploaded a couple of RSA private keys in PEM format, for those who want to play. It's nothing special, everyone can create them with openssl commands, as I said earlier. Just throw them in the same folder where the softcam.key file is and oscam-emu will read them.

https://drive.google.com/file/d/14i4DPZ_2Rnvb96nCvn7o8zuRpX-DRmas/view?usp=sharing
https://drive.google.com/file/d/1HEI1hvRTtrMwhCV-6ejR-da2KoFqMiJq/view?usp=sharing
https://drive.google.com/file/d/1ybqTlrBWRsRJSdQlGMxaVKJOnQe8EtWn/view?usp=sharing
https://drive.google.com/file/d/1if0W4nh8-DbIj9eJWFR8zUz0rT8qbFKm/view?usp=sharing

The naming of the PEM files should be like in these example files and currently only 16 keys are supported (00 to 15). This might change in the future if, hopefully, dozens of such keys are leaked.


EDIT: Also don't forget that there is a wiki available for a couple of months now... https://github.com/oscam-emu/oscam-patched/wiki/BISS2-mode-CA-config
 
Last edited:
orangebirds

orangebirds

Member
Messages
337
nautilus7 said:
Yes, retrieving a PEM file/RSA private key from an ird will work. But they could easily revoke that PEM file/RSA private key once it gets leaked.

The reason you don't understand oscam-emu's code is because you don't know coding and C, or because it's not well written?

There are 2 separate operations for biss 2 mode ca:

the ecm algo (just 1 function): https://github.com/oscam-emu/oscam-patched/blob/master/module-emulator-biss.c#L561

and the emm algo (3-4 functions): https://github.com/oscam-emu/oscam-patched/blob/master/module-emulator-biss.c#L738

Also there is a function that reads PEM files and creates the ekid for each RSA private key: https://github.com/oscam-emu/oscam-patched/blob/master/module-emulator-biss.c#L831

I would say that it is pretty much straight forward to understand it, especially if you have the specification along side.


I uploaded a couple of RSA private keys in PEM format, for those who want to play. It's nothing special, everyone can create them with openssl commands, as I said earlier. Just throw them in the same folder where the softcam.key file is and oscam-emu will read them.

https://drive.google.com/file/d/14i4DPZ_2Rnvb96nCvn7o8zuRpX-DRmas/view?usp=sharing
https://drive.google.com/file/d/1HEI1hvRTtrMwhCV-6ejR-da2KoFqMiJq/view?usp=sharing
https://drive.google.com/file/d/1ybqTlrBWRsRJSdQlGMxaVKJOnQe8EtWn/view?usp=sharing
https://drive.google.com/file/d/1if0W4nh8-DbIj9eJWFR8zUz0rT8qbFKm/view?usp=sharing

The naming of the PEM files should be like in these example files and currently only 16 keys are supported (00 to 15). This might change in the future if, hopefully, dozens of such keys are leaked.


EDIT: Also don't forget that there is a wiki available for a couple of months now... https://github.com/oscam-emu/oscam-patched/wiki/BISS2-mode-CA-config
Click to expand...

I do understand C, and I do make application for my workplace with Delphi 7, but for C just a really basic stuff like Hello World and basic maths from school, that's it :D I know, embarassing...

I just hope EBU feeds especially ESC 2020 do not use BISS2 :(
 
N

nautilus7

VIP
Messages
607
Nothing is embarrassing. There are so many programming languages, so it's impossible to know them all.

ESC = Eurovision song contest?
Ha ha ha, I couldn't care less for that...
 
orangebirds

orangebirds

Member
Messages
337
nautilus7 said:
Nothing is embarrassing. There are so many programming languages, so it's impossible to know them all.

ESC = Eurovision song contest?
Ha ha ha, I couldn't care less for that...
Click to expand...

That show is my main source of music that I listened to when radio mainstream music sucks :D and the jury show feed is not broadcasted on TV channels, but also football because many of my people especially on remote can't afford to pay channel package to watch what they love and internet is almost non-existent

Is DVB-CISSA really just AES-128-CBC as previous post say?
 
C

campag5242

Feed Hunter
Messages
2,585
CISSA is pretty much AES cbc. Except if there are less than 16 bytes to encrypt at the end of a block, they are left unencrypted. The IV in ASCII is "DVBTMCPTAESCISSA"
 
C

campag5242

Feed Hunter
Messages
2,585
Ah yes good spot, bet that's what it is.

Wasted opportunity for a bit of fun - could've had something like "NipPEr Is a buTt liCkeR!", which was burnt into the ROMs of early Nagra smartcards. Fun times eh kebien?
 
K

kebien

Registered
Messages
1,329
campag5242 said:
Ah yes good spot, bet that's what it is.

Wasted opportunity for a bit of fun - could've had something like "NipPEr Is a buTt liCkeR!", which was burnt into the ROMs of early Nagra smartcards. Fun times eh kebien?
Click to expand...

Yep,nobody had such a fun attitude like nagra coders.
And to think they had to recruit many of our friends to work for them makes it even more ironic.
 
L

lemme

Registered
Messages
122
kebien said:
Yep,nobody had such a fun attitude like nagra coders.
And to think they had to recruit many of our friends to work for them makes it even more ironic.
Click to expand...


Yea like when they marked the otp area I cant remember the address 0ff 7 rings a bell for the card loop kill. Back then I had an unlooper that worked but it didnt wipe the indelible mark left. Those were the days...
 
K

kebien

Registered
Messages
1,329
lemme said:
Yea like when they marked the otp area I cant remember the address 0ff 7 rings a bell for the card loop kill. Back then I had an unlooper that worked but it didnt wipe the indelible mark left. Those were the days...
Click to expand...

Since we could rewrite all codespace,it was simply a matter of changing the cmd handler to make it ineffective.
In any case,discovered after the fact,could not prevent such a move,but avoid it later.

Fun days,rom 10 to 102 anyone?
 
D

digi_knarf

Banned
Messages
119
jenseneverest said:
:( game over
Click to expand...

Guaranteed, 100 percent. Announced some time ago and gradually becoming more and more BISS-CA broadcasts. The new encoders will all have implemented this mode and then it will be dark - forever.

If CW hadn't been released permanently, the EBU wouldn't have had any reason to develop a new biss version.
 
K

kebien

Registered
Messages
1,329
digi_knarf said:
Guaranteed, 100 percent. Announced some time ago and gradually becoming more and more BISS-CA broadcasts. The new encoders will all have implemented this mode and then it will be dark - forever.

If CW hadn't been released permanently, the EBU wouldn't have had any reason to develop a new biss version.
Click to expand...

Is just another encryption like the rest,and most all of them were publicly hacked,is easier to go with reality than with omens.
The hacking started back in the 90's and many,like you,saw the doom days.
Still going.
And making words like "forever" meaningless.
 
D

digi_knarf

Banned
Messages
119
kebien said:
Is just another encryption like the rest,and most all of them were publicly hacked,is easier to go with reality than with omens.
The hacking started back in the 90's and many,like you,saw the doom days.
Still going.
And making words like "forever" meaningless.
Click to expand...

Weren't you the one who wanted to "hack" tandberg V3 at the top of his voice? Where is the result?

Not one of the new encryptions of the last 10 years is open ... not one! So stop with such speeches. What do the mistakes of the 90s of the manufacturers have in common with the current encryption standards? NOTHING!

Nautilus ... you don't understand. The providers have to buy new hardware bit by bit. Is that so hard to understand? This will take a few years. The next time tests will take place. Currently 3 tests ... next year around time 30 and so on. Such a change will take many years and BISS-E will broadcast simultaneously.
Novelsat and BISS-CA will make sure that it gets dark in 5 - 10 years. Nobody speaks from one day to the next.

You should find out which encoders are capable of BISS-CA at the moment. Only the latest revision of the Ericsson RX8200 and the Kyrion CM5000 from ATEME have the embedded. All others have not yet.
 
You must log in or register to reply here.
Top