help fot DES Known-Plaintext Key Recovery ($97$ token / 6-byte known ciphertext)
#1
Hi everyone,

I'm analyzing a system (mifare1k) that derives sector keys using DES-ECB from the 4-byte card UID.
I have captured multiple known-plaintext test vectors, but the 56-bit DES master key needs to be recovered.

Target Details:
- Algorithm: DES (ECB Mode) / Mode 14000
- Plaintext (UID 0 padded): 0000000000000000
- Ciphertext (Key 0B): 9F39B67E0B64 (first 6 bytes are known, last 2 bytes are discarded by reader)
- Bitmask: FFFFFFFFFFFF0000

Crack.sh Token ($97$ format with bitmask):
$97$AAAAAAAAAAD///////8AAJ85tn4LZAAA

Secondary Verification Vector:
- Plaintext: 0000000100000000
- Ciphertext: B4A18FE1F51F

If anyone with an FPGA cluster or multi-GPU rig has spare cycles to run this keyspace, your help would be greatly appreciated!

Thanks in advance!
Reply