Revision as of 11:25, 11 November 2020

General Observations

always exactly 114 byte
there's two 14-15 byte variable lengths blocks towards the end with very high entropy, possibly some kind of signature
0:4 - 2:1 (14 bit) is "3018", which is the UIC operator code of Thalys. This matches Appendix C of ANNEX B.6 of TAP TSI, but unfortunately only for the first 18 bit it seems. Might still mean a similar encoding is used, but in a different layout.
all expected data has been located, but not the date/time?
This does seem to largely match what is described in "European Union Agency For Railways - Technical Document - Digital Security Elements For Rail Passenger Ticketing - TAP TSI TD B.12 - §7 SSB - Small Structured Barcode"

Byte[:Bit] (MSB)	Content	Meaning	Notes
0:0 - 4:7	0x32 F2 84 20 40		fixed in all samples
5:0 - 5:7	0x01 or 0x02	class
6:0 - 9:5	null
9:6 - 16:3	9 x 6bit string	ticket number
16:4 - 18:3	TODO
18:4 - 22:1	5 x 6bit string	departure station	see below
22:2 - 25:7	5 x 6bit string	arrival station	see below
26:0 - 27:7	TODO
28:0 - 29:1	null
29:2 - 32:1	4 x 6bit string	train number	preceding bits might be a 5th character for this
32:2 - 33:3	9bit uint	coach number	field seems a bit large for this?
33:4 - 35:5	3 x 6bit string	seat number
35:6 - 42:6	null
42:7 - 55:4	17 x 6 bit string	CIN	17 digit number, also seen on some PDF tickets, possibly sequential, common prefix "3084060" in all samples
55:5 - 55:7	TODO
56:0 - 58:7	0x0a 80 30		same TLV/BER/DER-like nested signature block as used by KDE_PIM/KItinerary/SBB_Barcode, 0x80 would be a null-terminated variable length block according to BER
59:0 - 59:7	1 byte	length of the following data	0x2C or 0x2E in current samples

After this there follow two blocks with the following variable length layout:

Byte[:Bit] (MSB)	Content	Meaning	Notes
0:0 - 0:7	0x02		fixed
1:0 - 1:7	8bit uint	length
N bytes			high entropy content

Remaining bytes are filled by null until reaching 114 bytes.

Strings:

Station identifiers:

using Benerail identifiers, which consists of 5 upper-case letters, the first two being the ISO 3166-1 alpha 2 code
very similar to SNCF identifiers, but there are slight differences e.g. for Amsterdam Central (NLASC vs NLAMA).

@@ Line 5: / Line 5: @@
 * 0:4 - 2:1 (14 bit) is "3018", which is the UIC operator code of Thalys. This matches Appendix C of ANNEX B.6 of TAP TSI, but unfortunately only for the first 18 bit it seems. Might still mean a similar encoding is used, but in a different layout.
 * all expected data has been located, but not the date/time?
-* This does seem to largely match what is described in "European Union Agency For Railways - Technical Document - Digital Security Elements For Rail Passenger Ticketing - §7 SSB - Small Structured Barcode"
+* This does seem to largely match what is described in "European Union Agency For Railways - Technical Document - Digital Security Elements For Rail Passenger Ticketing - TAP TSI TD B.12 - §7 SSB - Small Structured Barcode"
 = Bit Layout =