[Ovmsdev] BCM seed key algorithm Maxus Euniq6

[Michael Balzer]

Jaime,

don't rule out a simple arithmetic operation too soon.

The VW eUp for example simply applies key = seed + passcode (each 32 
bits). The "security" is achieved here by obscurity, i.e. people simply 
need to know the function specific passcode.

As you've got access to a device that implements the access scheme, a 
decoding vector could be reading the firmware.

Regards,
Michael


Am 12.10.22 um 07:35 schrieb Chris van der Meijden:
> Hi Jaime
>
> Cool project on an interesting car.
>
> I can't help you directly on decyphring the seed-keys, but I found 
> information on the Tesla key algorithms recently:
>
> https://gist.github.com/darconeous/2cd2de11148e3a75685940158bddf933
>
> Perhaps you can find some hints there. Only a guess, but perhaps worth 
> reading.
>
> Regards
>
> Chris
>
>
> Am Dienstag, dem 11.10.2022 um 17:20 -0300 schrieb Jaime Middleton:
>> Hi all,
>> I am currently working on the implementation for the Maxus Euniq6. I 
>> have been able to decipher most of the metrics I wanted, but now I 
>> need to open and close doors.
>> I was able to get access to a scanner for the car and sniff the can 
>> while the scanner opened and closed the doors.
>> I mostly deciphered the interaction between the car and the scanner 
>> but there seems to be a seed-key algorithm in order to authenticate 
>> the scanner with the car. (I have ruled out a simple xor of bitshift).
>> Any ideas on how to decipher this?
>> I have a list of seed-keys and the chatter before in case someone 
>> wants to take a look.
>> Any help is greatly appreciated.
>>
>> Thanks,
>>
>> Jaime Middleton
>>
>> Software Engineer
>>
>> Tucar Spa
>>
>> ------------------------------------------------------------------------
>>
>> Tucar cell phone +56 9 42526635
>>
>> Tucar cell phone jmiddleton at tucar.app <mailto:jmiddleton at tucar.app>
>>
>> Tucar net www.tucar.app <https://www.tucar.app>
>>
>> Tucar location Plaza Yolanda 80, Las Condes, Santiago de Chile
>>
>>
>> _______________________________________________
>> OvmsDev mailing list
>> OvmsDev at lists.openvehicles.com
>> http://lists.openvehicles.com/mailman/listinfo/ovmsdev
>
>
> _______________________________________________
> OvmsDev mailing list
> OvmsDev at lists.openvehicles.com
> http://lists.openvehicles.com/mailman/listinfo/ovmsdev

-- 
Michael Balzer * Helkenberger Weg 9 * D-58256 Ennepetal
Fon 02333 / 833 5735 * Handy 0176 / 206 989 26

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openvehicles.com/pipermail/ovmsdev/attachments/20221012/af6d38d7/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 203 bytes
Desc: OpenPGP digital signature
URL: <http://lists.openvehicles.com/pipermail/ovmsdev/attachments/20221012/af6d38d7/attachment-0001.sig>