How Axi and Exi work?

[dilly]

Could anybody please explain how Exi and Axi work?

There seem to be many files for gammacard around, so I think this information must be known by some people. So could somebody please answer the following:

Is the Axi/Exi different for each card (linked to HSN) or is there only one Axi/Exi for all cards for one provider?

And if each card has its own Axi/Exi, how it is generated from the HSN?

Cheers
dil

[Mosc_007]

Could anybody please explain how Exi and Axi work?

There seem to be many files for gammacard around, so I think this information must be known by some people. So could somebody please answer the following:

Is the Axi/Exi different for each card (linked to HSN) or is there only one Axi/Exi for all cards for one provider?

And if each card has its own Axi/Exi, how it is generated from the HSN?

Cheers
dil

Each HSN has its own Axi/Exi (HMK's)

If you study the Gamma source code you will find that one of the keys is used to remove the first layer encryption from the EMM. Then the other key is used to decrypt the keys inside the EMM. That is for HSN addressed EMM's. Then for Group addressed EMM's you have two Group keys (MK's). Same decryption applies.

How it's generated....... I Want to know too..... And a Million others :)


Cya

[Tobycat]

Triple DES is used for the decryption and encryption process. The first layer of decryption is done with the Axi key. This provides the provID and MAC as the last 11 bytes. Now take the 16 bytes to the right and use the Exi key to reveal group key 0 and group key 1. You also need to use correct initial control vector (ICV).

This is only helpful if you know the Axi, Exi and ICV values. Can someone inform me (PM is OK) what ICV to use ?

[Tobycat]

Just to correct my post above, use the exi key to decrypt the 2x16 byte group keys immediately to the left of the decrypted provID. The ICV is provider dependent, and if you search in the right places you might find what you're looking for (clue: also known as ECM IV) ;). Finding the axi/exi keys is a lot more difficult :(