9 hours ago
Hi everyone,
I'm analyzing a system (mifare1k) that derives sector keys using DES-ECB from the 4-byte card UID.
I have captured multiple known-plaintext test vectors, but the 56-bit DES master key needs to be recovered.
Target Details:
- Algorithm: DES (ECB Mode) / Mode 14000
- Plaintext (UID 0 padded): 0000000000000000
- Ciphertext (Key 0B): 9F39B67E0B64 (first 6 bytes are known, last 2 bytes are discarded by reader)
- Bitmask: FFFFFFFFFFFF0000
Crack.sh Token ($97$ format with bitmask):
$97$AAAAAAAAAAD///////8AAJ85tn4LZAAA
Secondary Verification Vector:
- Plaintext: 0000000100000000
- Ciphertext: B4A18FE1F51F
If anyone with an FPGA cluster or multi-GPU rig has spare cycles to run this keyspace, your help would be greatly appreciated!
Thanks in advance!
I'm analyzing a system (mifare1k) that derives sector keys using DES-ECB from the 4-byte card UID.
I have captured multiple known-plaintext test vectors, but the 56-bit DES master key needs to be recovered.
Target Details:
- Algorithm: DES (ECB Mode) / Mode 14000
- Plaintext (UID 0 padded): 0000000000000000
- Ciphertext (Key 0B): 9F39B67E0B64 (first 6 bytes are known, last 2 bytes are discarded by reader)
- Bitmask: FFFFFFFFFFFF0000
Crack.sh Token ($97$ format with bitmask):
$97$AAAAAAAAAAD///////8AAJ85tn4LZAAA
Secondary Verification Vector:
- Plaintext: 0000000100000000
- Ciphertext: B4A18FE1F51F
If anyone with an FPGA cluster or multi-GPU rig has spare cycles to run this keyspace, your help would be greatly appreciated!
Thanks in advance!
