SNCF Tickets
General Observations
- Aztec code on SNCF tickets, PDF417 code on printed SNCF tickets
- fixed size, 132 ASCII characters
- can contain one or two legs
- has large similarities with what is described in "European Union Agency For Railways - Technical Document - Digital Security Elements For Rail Passenger Ticketing - TAP TSI TD B.12 - §8 ELB - Element List Barcode"
Layout
| Offset |
Size |
Content Type |
Meaning |
Notes
|
| 0 |
4 |
'i0CV' or 'i1CV' |
constant |
the second version so far only seen on paper tickets
|
| 4 |
6 |
alpha-numeric |
PNR |
|
| 10 |
9 |
numeric |
document id / e-ticket number |
|
| 19 |
4 |
'1211' |
constant |
|
| 23 |
10 |
dd'/'MM'/'yyyy |
traveller birth date |
|
| 33 |
5 |
SNCF station id |
departure station first leg |
|
| 38 |
5 |
SNCF station id |
arrival station first leg |
|
| 43 |
5 |
numeric |
train number first leg |
|
| 48 |
5 |
dd'/'MM |
travel date |
|
| 53 |
19 |
numeric |
cliend id |
|
| 72 |
19 |
string |
traveler last name |
blank padded, uppercase, right aligned (PDF) or left aligned (paper tickets)
|
| 91 |
19 |
string |
travel first name |
blank padded, uppercase, right aligned (PDF) or left aligned (paper tickets)
|
| 110 |
1 |
'1' or '2' |
class first leg |
|
| 111 |
4 |
alpha-numeric |
tariff/price code |
can be blank, see below
|
| 115 |
1 |
'0', '1' or '2' |
class second leg |
'0' if single leg
|
| 116 |
5 |
SNCF station id |
departure station second leg |
blank if single leg
|
| 121 |
5 |
SNCF station id |
arrival station second leg |
blank if single leg
|
| 126 |
5 |
numeric |
train number second leg |
'00000' if single leg
|
SNCF Secutix Tickets
General Observations
- Aztec code
- found on some SNCF PDF tickets and in the app
- fixed size, 686 byte, mix of byte-aligned binary blob and ASCII content
Layout
| Offset |
Size |
Content Type |
Meaning |
Notes
|
| 0 |
4 |
'2200' |
constant |
|
| 4 |
256 |
binary |
signature? |
seems largely random
|
| 260 |
4 |
'00T1' |
constant |
|
| 264 |
4 |
number |
UIC issuer or operator code |
'0087' for SNCF
|
| 268 |
9 |
number |
ticket number |
|
| 277 |
5 |
SNCF station id |
departure station |
|
| 282 |
5 |
SNCF station id |
arrival station |
|
| 287 |
5 |
SNCF station id or blank |
??? |
|
| 292 |
50 |
blank |
|
|
| 342 |
1 |
'S' |
constant |
|
| 343 |
8 |
ddMMyyyy |
travel date |
|
| 351 |
1 |
number |
class? |
|
| 352 |
4 |
alpha-numeric |
tariff/price code |
see below
|
| 356 |
20 |
free text? |
tariff/price info? |
|
| 376 |
19 |
string |
traveler last name |
left aligned, blank padded, uppercase
|
| 395 |
19 |
string |
traveler first name |
light aligned, blank padded, uppercase
|
| 414 |
8 |
ddMMyyyy |
traveler birth date |
|
| 422 |
10 |
'ADULTE' or 'ENFANTE' |
traveler type 1 |
|
| 432 |
2 |
number |
traveler type quantity 1 |
zero-padded
|
| 434 |
10 |
'ADULTE'/'ENFANTE' or blank |
traveler type 2 |
blank if not present
|
| 444 |
2 |
number |
traveler type quantity 2 |
zero-padded, '00' if not present
|
| 446 |
8 |
ddMMyyyy |
travel date? |
again?
|
| 454 |
8 |
ddMMyyyy |
travel date? |
again??
|
| 462 |
12 |
'0' |
constant |
|
| 474 |
12 |
ddMMyyyyhhmm |
purchase date/time |
|
| 486 |
10 |
number |
price |
zero-padded, in Cent
|
| 496 |
190 |
text |
free text? |
blank-padded, right aligned
|
Ouigo Tickets
- 174 bytes of a base64-like looking string, but apparently not valid base64
- seems largely random even for closely adjacent tickets, so possibly encrypted or just a token?
SNCF Normandie Tickets
- Aztec code, 176-179 bytes of binary content
- Not byte aligned, big endian
- First part seems to be neither encrypted nor compressed, and seems to contain trip information.
- Second part has high entropy, suggesting a trailing signature as found in many ERA formats.
- Content part is not byte aligned, but otherwise seems to have no similarities with ERA SSB.
- Brute force search finds train number (14 bit) and TCN (32 bit), with slightly varying positions (starting at bit 443-467), with 31 bits between them. Suggests variable lengths elements in the content.
- Brute force search for ERA SSB-style 6 bit text encoding yields no results.
- Brute force search for unaligned 7 bit strings finds tariff code, UIC operator codes and the booking reference. Suggests ASN.1 IA5String in uPER encoding?
- The above also finds the constant string "FCB2" in all samples, which could indicate ERA FCB and which would confirm an ASN.1 uPER encoding. But can ERA FCB even occur outside of an UIC 918.3 container?
Carte Advantage
General Observations
- Aztec code, on a PDF
- vague similarities to the basic ticket barcode format
Layout
| Offset |
Size |
Content Type |
Meaning |
Notes
|
| 0 |
4 |
'h0FV' |
|
|
| 5 |
15 |
15x'0' |
|
|
| 20 |
4 |
'1111' |
|
|
| 24 |
10 |
10x'0' |
|
|
| 34 |
10 |
dd'/'MM'/'yyyy |
first day of validity |
one day after of what's stated in the PDF!?
|
| 44 |
10 |
dd'/'MM'/'yyyy |
last day of validity? |
also observed with '31/12/2999', not matching the PDF claiming 1y validity
|
| 53 |
17 |
numeric |
card number |
|
| 70 |
2 |
blank |
|
|
| 72 |
38 |
38x'X' |
|
|
| 110 |
1 |
'1' or '2' |
class |
|
| 111 |
4 |
alphanumeric |
tariff/program code? |
|
| 115 |
10 |
dd'/'MM'/'yyyy |
? |
date with no correlation to anything in the PDF?
|
Tariff Codes
Observed tariff codes in any of the ticket barcodes:
- CF00: "Ayant Droit Résa Payante", "Ayant Droit avec fichet" - 100% staff discount
- CF90: "Ayant Droit 90%", "Ayant Droit sans fichet" - 90% staff discount
- CJ11: "CARTE JEUNE"
- CW11: "CARTE AVANTAGE ADULTE"
- CW12: "NO FLEX CARTE AVANTAGE ADULTE"
- CW25: "CARTE AVANTAGE ADULTE"
- EF11: "CARTE ENFANT+" (parent)
- EF99: "CARTE ENFANT+" (child)
- IR00: "INTERRAIL CONTINGENTÉ 2ÈME CLASSE"
- IR01: "INTERRAIL NON CONTINGENTÉ 2ÈME CLASSE"
- JR11: occurs together with a loyalty program number in the PDF
- NU44: "Billet illico PROMO VACANCES 40%"
- NV30: "LIBERTIO’ JEUNES TRAIN JAUNE"
- NW26: "BILLET ILLICO LIBERTE SEMAINE 25%"
- PR11:
- PX01: "TARIF NORMAL RÉGIONAL"
- SE11: "BILLET CARTE AVANTAGE SENIOR"
- SR50: "Carte Senior"
- <empty>: not operated by SNCF
