0

So I'm trying to reverse engineer a lock system that consists of a chip reader and a control unit.

There are only two devices on this network, the reader which reads a rfid like chip and the control unit, when the control unit has confirmation that the chip is ok it then powers up properly and carries out the tasks it needs to.

The communication works as follows:

  • The Reader sends 06 7F 01 00 00 00 00 03 when it reads a known chip

  • The controller replies with a random 4 byte value

  • The reader then responds with another 4 byte value based on the value it received

  • The controller replies with 81 7F 00 00 00 00 00 00 to confirm the reply is correct

  • The reader then responds with 00 to confirm everything is good.

Both then stop transmitting but the control unit 'unlocks' and works as required.

I know the encryption key doesn't change as you can remove the control unit from the device and transmit to the key reader with a 4 byte value it has previously received and it sends the same reply.

I have captured the data 3 times when inserting a programmed chip and this is what was sent:

Capture 1:

Control Unit 07 0F 66 6C BF 00 00 00

Chip Reader 08 2A 57 5A 54 01 00 03

Capture 2:

Control Unit 07 D1 5A B8 40 00 00 00

Chip Reader 08 17 25 36 DE 01 00 00

Capture 3:

Control Unit 07 6D 2E E4 73 00 00 00

Chip Reader 08 09 43 79 94 01 00 00

It appears to me that we can ignore the first byte and last 3 bytes and concentrate on 4 bytes 1-4

To gain further knowledge I replaced the control unit with my analyser and send it the following data and got these replies:

I'll only include the 4 bytes in question to make things easier to understand.

Test 1:

Sent 01 01 01 01

Received 7E F4 07 FA

Test 2:

Sent 02 02 02 02

Received 16 1D 8C 70

Test 3:

Sent 03 03 03 03

Received 58 DA FE A0

Test 4:

Sent 04 04 04 04

Received E2 54 56 3F

Test 5:

Sent 22 22 22 22

Received 11 1A BC 20

Can anyone work out the key? Or guide me in calculating it myself?

  • 1
    No one will break any (even leak) cipher without knowing its algorithm. You have to reverse engeneer the encryption algorithm, and write here back with its details to just start. – Vitaliy Dec 10 '18 at 7:52
  • Sometimes hardware reverse engineering is easier; but otherwise --- how fast does it take to make a test? Is it feasible to test all 2^32 combinations? If not, try getting at least about 1000 samples -- it's hard to guarantee accuracy when finding the algorithm with only 8 samples. – user202729 Dec 10 '18 at 10:38
  • Is the system well-known? Have you tried to search online to see if there is any information about the algorithm? – user202729 Dec 10 '18 at 10:40
  • Besides, this is not always possible if the algorithm is complex -- salted SHA256 or something similar. – user202729 Dec 10 '18 at 10:41

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.