Revision as of 16:12, 12 September 2022

SNCF Tickets

Aztec code on SNCF tickets, PDF417 code on printed SNCF tickets
fixed size, 132 ASCII characters
can contain one or two legs
has large similarities with what is described in "European Union Agency For Railways - Technical Document - Digital Security Elements For Rail Passenger Ticketing - TAP TSI TD B.12 - §8 ELB - Element List Barcode"

Offset	Size	Content Type	Meaning	Notes
0	4	'i0CV' or 'i1CV'	constant	the second version so far only seen on paper tickets
4	6	alpha-numeric	PNR
10	9	numeric	document id / e-ticket number
19	4	'1211'	constant
23	10	dd'/'MM'/'yyyy	traveller birth date
33	5	SNCF station id	departure station first leg
38	5	SNCF station id	arrival station first leg
43	5	numeric	train number first leg
48	5	dd'/'MM	travel date
53	19	numeric	cliend id
72	19	string	traveler last name	blank padded, uppercase, right aligned (PDF) or left aligned (paper tickets)
91	19	string	travel first name	blank padded, uppercase, right aligned (PDF) or left aligned (paper tickets)
110	1	'1' or '2'	class first leg
111	4	alpha-numeric	tariff/price code	can be blank, see below
115	1	'0', '1' or '2'	class second leg	'0' if single leg
116	5	SNCF station id	departure station second leg	blank if single leg
121	5	SNCF station id	arrival station second leg	blank if single leg
126	5	numeric	train number second leg	'00000' if single leg

Offset	Size	Content Type	Meaning	Notes
0	4	'2200'	constant
4	256	binary	signature?	seems largely random
260	4	'00T1'	constant
264	4	number	UIC issuer or operator code	'0087' for SNCF
268	9	number	ticket number
277	5	SNCF station id	departure station
282	5	SNCF station id	arrival station
287	5	SNCF station id or blank	???
292	50	blank
342	1	'S'	constant
343	8	ddMMyyyy	travel date
351	1	number	class?
352	4	alpha-numeric	tariff/price code	see below
356	20	free text?	tariff/price info?
376	19	string	traveler last name	left aligned, blank padded, uppercase
395	19	string	traveler first name	light aligned, blank padded, uppercase
414	8	ddMMyyyy	traveler birth date
422	10	'ADULTE' or 'ENFANTE'	traveler type 1
432	2	number	traveler type quantity 1	zero-padded
434	10	'ADULTE'/'ENFANTE' or blank	traveler type 2	blank if not present
444	2	number	traveler type quantity 2	zero-padded, '00' if not present
446	8	ddMMyyyy	travel date?	again?
454	8	ddMMyyyy	travel date?	again??
462	12	'0'	constant
474	12	ddMMyyyyhhmm	purchase date/time
486	10	number	price	zero-padded, in Cent
496	190	text	free text?	blank-padded, right aligned

174 bytes of a base64-like looking string, but apparently not valid base64
seems largely random even for closely adjacent tickets, so possibly encrypted or just a token?

Aztec code, 176-179 bytes of binary content
Not byte aligned, big endian
First part seems to be neither encrypted nor compressed, and seems to contain trip information.
Second part has high entropy, suggesting a trailing signature as found in many ERA formats.
Content part is not byte aligned, but otherwise seems to have no similarities with ERA SSB.
Brute force search finds train number (14 bit) and TCN (32 bit), with slightly varying positions (starting at bit 443-467), with 31 bits between them. Suggests variable lengths elements in the content.
Brute force search for ERA SSB-style 6 bit text encoding yields no results.
Brute force search for unaligned 7 bit strings finds tariff code, UIC operator codes and the booking reference. Suggests ASN.1 IA5String in uPER encoding?
The above also finds the constant string "FCB2" in all samples, which could indicate ERA FCB and which would confirm an ASN.1 uPER encoding. But can ERA FCB even occur outside of an UIC 918.3 container?
Initial naive attempts to decode using the ERA FCB ASN.1 schema yield no results, but this could still be some variation of the FCB schema, or have its own container format that would need to be unwrapped first.

Offset	Size	Content Type	Meaning	Notes
0	4	'h0FV'
5	15	15x'0'
20	4	'1111'
24	10	10x'0'
34	10	dd'/'MM'/'yyyy	first day of validity	one day after of what's stated in the PDF!?
44	10	dd'/'MM'/'yyyy	last day of validity?	also observed with '31/12/2999', not matching the PDF claiming 1y validity
53	17	numeric	card number
70	2	blank
72	38	38x'X'
110	1	'1' or '2'	class
111	4	alphanumeric	tariff/program code?
115	10	dd'/'MM'/'yyyy	?	date with no correlation to anything in the PDF?

Observed tariff codes in any of the ticket barcodes:

CF00: "Ayant Droit Résa Payante", "Ayant Droit avec fichet" - 100% staff discount
CF90: "Ayant Droit 90%", "Ayant Droit sans fichet" - 90% staff discount
CJ11: "CARTE JEUNE"
CW11: "CARTE AVANTAGE ADULTE"
CW12: "NO FLEX CARTE AVANTAGE ADULTE"
CW25: "CARTE AVANTAGE ADULTE"
EF11: "CARTE ENFANT+" (parent)
EF99: "CARTE ENFANT+" (child)
IR00: "INTERRAIL CONTINGENTÉ 2ÈME CLASSE"
IR01: "INTERRAIL NON CONTINGENTÉ 2ÈME CLASSE"
JR11: occurs together with a loyalty program number in the PDF
NU44: "Billet illico PROMO VACANCES 40%"
NV30: "LIBERTIO’ JEUNES TRAIN JAUNE"
NW26: "BILLET ILLICO LIBERTE SEMAINE 25%"
PR11:
PX01: "TARIF NORMAL RÉGIONAL"
SE11: "BILLET CARTE AVANTAGE SENIOR"
SR50: "Carte Senior"
<empty>: not operated by SNCF

@@ Line 135: / Line 135: @@
 * Brute force search for unaligned 7 bit strings finds tariff code, UIC operator codes and the booking reference. Suggests ASN.1 IA5String in uPER encoding?
 * The above also finds the constant string "FCB2" in all samples, which could indicate ERA FCB and which would confirm an ASN.1 uPER encoding. But can ERA FCB even occur outside of an UIC 918.3 container?
+* Initial naive attempts to decode using the ERA FCB ASN.1 schema yield no results, but this could still be some variation of the FCB schema, or have its own container format that would need to be unwrapped first.
 = Carte Advantage =