Interesting thread; N1/N2 was cracked by the spanish. They did not crack the Algo ( The algo for N1 is stil secure to this day ) ; what they did was find a loophole in the make up of the card and not a way to crack the code on the card. This allowed Keys to be read and the card to be dumped.
Once the tools where there we in the UK used/adapted them for our system.
As for our new encryption its a ROM 180 with an Atmel core - the 1st Nagra card to use Atmel and as such I suppose we could call it N3.5.
Opening a ROM 240 or similar from sat scene would help us in understanding the code structure after disasembly.
However it would not help us in a UK hack as we need the sets of keys off the ROM180 to code up any emu be it on AVR or Linux platform.
The 180 has anti glitch code and RAM that resets if we even sniff at it - so conventional glitching as we know it by faulting the CAM and loading and and payload to zero the bugcatchers alowing us to read in Nagra edit is not going to work.
The only way is to dump the card and thats going to take time and its probably going to have to be a lab and take the ROM apart by de layering it bit by bit. Thats unles we suss out a diff form of attack.
That leaves us with card share which is not a hack and tbh I hate - however it could give us data and help us understand code flow and cmd returns.
For this we need the RSA and pairing code code sets which if we look we should be able to do with a bit of effort.
Regards
Spark
Bookmarks