KDE PIM/KItinerary/SNCF Barcodes: Difference between revisions

From KDE Community Wiki
Line 135: Line 135:
* Brute force search for unaligned 7 bit strings finds tariff code, UIC operator codes and the booking reference. Suggests ASN.1 IA5String in uPER encoding?
* Brute force search for unaligned 7 bit strings finds tariff code, UIC operator codes and the booking reference. Suggests ASN.1 IA5String in uPER encoding?
* The above also finds the constant string "FCB2" in all samples, which could indicate ERA FCB and which would confirm an ASN.1 uPER encoding. But can ERA FCB even occur outside of an UIC 918.3 container?
* The above also finds the constant string "FCB2" in all samples, which could indicate ERA FCB and which would confirm an ASN.1 uPER encoding. But can ERA FCB even occur outside of an UIC 918.3 container?
* Initial naive attempts to decode using the ERA FCB ASN.1 schema yield no results, but this could still be some variation of the FCB schema, or have its own container format that would need to be unwrapped first.


= Carte Advantage =
= Carte Advantage =

Revision as of 16:12, 12 September 2022

SNCF Tickets

General Observations

  • Aztec code on SNCF tickets, PDF417 code on printed SNCF tickets
  • fixed size, 132 ASCII characters
  • can contain one or two legs
  • has large similarities with what is described in "European Union Agency For Railways - Technical Document - Digital Security Elements For Rail Passenger Ticketing - TAP TSI TD B.12 - §8 ELB - Element List Barcode"

Layout

Offset Size Content Type Meaning Notes
0 4 'i0CV' or 'i1CV' constant the second version so far only seen on paper tickets
4 6 alpha-numeric PNR
10 9 numeric document id / e-ticket number
19 4 '1211' constant
23 10 dd'/'MM'/'yyyy traveller birth date
33 5 SNCF station id departure station first leg
38 5 SNCF station id arrival station first leg
43 5 numeric train number first leg
48 5 dd'/'MM travel date
53 19 numeric cliend id
72 19 string traveler last name blank padded, uppercase, right aligned (PDF) or left aligned (paper tickets)
91 19 string travel first name blank padded, uppercase, right aligned (PDF) or left aligned (paper tickets)
110 1 '1' or '2' class first leg
111 4 alpha-numeric tariff/price code can be blank, see below
115 1 '0', '1' or '2' class second leg '0' if single leg
116 5 SNCF station id departure station second leg blank if single leg
121 5 SNCF station id arrival station second leg blank if single leg
126 5 numeric train number second leg '00000' if single leg

SNCF Secutix Tickets

General Observations

  • Aztec code
  • found on some SNCF PDF tickets and in the app
  • fixed size, 686 byte, mix of byte-aligned binary blob and ASCII content

Layout

Offset Size Content Type Meaning Notes
0 4 '2200' constant
4 256 binary signature? seems largely random
260 4 '00T1' constant
264 4 number UIC issuer or operator code '0087' for SNCF
268 9 number ticket number
277 5 SNCF station id departure station
282 5 SNCF station id arrival station
287 5 SNCF station id or blank ???
292 50 blank
342 1 'S' constant
343 8 ddMMyyyy travel date
351 1 number class?
352 4 alpha-numeric tariff/price code see below
356 20 free text? tariff/price info?
376 19 string traveler last name left aligned, blank padded, uppercase
395 19 string traveler first name light aligned, blank padded, uppercase
414 8 ddMMyyyy traveler birth date
422 10 'ADULTE' or 'ENFANTE' traveler type 1
432 2 number traveler type quantity 1 zero-padded
434 10 'ADULTE'/'ENFANTE' or blank traveler type 2 blank if not present
444 2 number traveler type quantity 2 zero-padded, '00' if not present
446 8 ddMMyyyy travel date? again?
454 8 ddMMyyyy travel date? again??
462 12 '0' constant
474 12 ddMMyyyyhhmm purchase date/time
486 10 number price zero-padded, in Cent
496 190 text free text? blank-padded, right aligned

Ouigo Tickets

  • 174 bytes of a base64-like looking string, but apparently not valid base64
  • seems largely random even for closely adjacent tickets, so possibly encrypted or just a token?

SNCF Normandie Tickets

  • Aztec code, 176-179 bytes of binary content
  • Not byte aligned, big endian
  • First part seems to be neither encrypted nor compressed, and seems to contain trip information.
  • Second part has high entropy, suggesting a trailing signature as found in many ERA formats.
  • Content part is not byte aligned, but otherwise seems to have no similarities with ERA SSB.
  • Brute force search finds train number (14 bit) and TCN (32 bit), with slightly varying positions (starting at bit 443-467), with 31 bits between them. Suggests variable lengths elements in the content.
  • Brute force search for ERA SSB-style 6 bit text encoding yields no results.
  • Brute force search for unaligned 7 bit strings finds tariff code, UIC operator codes and the booking reference. Suggests ASN.1 IA5String in uPER encoding?
  • The above also finds the constant string "FCB2" in all samples, which could indicate ERA FCB and which would confirm an ASN.1 uPER encoding. But can ERA FCB even occur outside of an UIC 918.3 container?
  • Initial naive attempts to decode using the ERA FCB ASN.1 schema yield no results, but this could still be some variation of the FCB schema, or have its own container format that would need to be unwrapped first.

Carte Advantage

General Observations

  • Aztec code, on a PDF
  • vague similarities to the basic ticket barcode format

Layout

Offset Size Content Type Meaning Notes
0 4 'h0FV'
5 15 15x'0'
20 4 '1111'
24 10 10x'0'
34 10 dd'/'MM'/'yyyy first day of validity one day after of what's stated in the PDF!?
44 10 dd'/'MM'/'yyyy last day of validity? also observed with '31/12/2999', not matching the PDF claiming 1y validity
53 17 numeric card number
70 2 blank
72 38 38x'X'
110 1 '1' or '2' class
111 4 alphanumeric tariff/program code?
115 10 dd'/'MM'/'yyyy ? date with no correlation to anything in the PDF?

Tariff Codes

Observed tariff codes in any of the ticket barcodes:

  • CF00: "Ayant Droit Résa Payante", "Ayant Droit avec fichet" - 100% staff discount
  • CF90: "Ayant Droit 90%", "Ayant Droit sans fichet" - 90% staff discount
  • CJ11: "CARTE JEUNE"
  • CW11: "CARTE AVANTAGE ADULTE"
  • CW12: "NO FLEX CARTE AVANTAGE ADULTE"
  • CW25: "CARTE AVANTAGE ADULTE"
  • EF11: "CARTE ENFANT+" (parent)
  • EF99: "CARTE ENFANT+" (child)
  • IR00: "INTERRAIL CONTINGENTÉ 2ÈME CLASSE"
  • IR01: "INTERRAIL NON CONTINGENTÉ 2ÈME CLASSE"
  • JR11: occurs together with a loyalty program number in the PDF
  • NU44: "Billet illico PROMO VACANCES 40%"
  • NV30: "LIBERTIO’ JEUNES TRAIN JAUNE"
  • NW26: "BILLET ILLICO LIBERTE SEMAINE 25%"
  • PR11:
  • PX01: "TARIF NORMAL RÉGIONAL"
  • SE11: "BILLET CARTE AVANTAGE SENIOR"
  • SR50: "Carte Senior"
  • <empty>: not operated by SNCF