here some tool and what they can do :
DiscU From Crediar : Can extract a WUD and decrypt all the game files. Since v4.1b it can also extract the encrypted content file without decrypting them. Requires the Disc key to read the disc data. the key is usually provided by release groups. Common key included in 4.1b.
CDecrypt From Crediar : Decrypt encrypted content files to extracted game files. Requires the encrypted Title key located in a ticket (tik, title.tik). WiiU Common key required in v0.1, included in v0.2.
NUSGrabber From Crediar : Download encrypted content files from Nintendo Update Server. Requires a TitleID
JNUSTool From Maschell : NUSgrabber+Cdecrypt combined written in Java (multi platform), it downloads encrypted content from NUS and can also decrypts the files at the same time. It can also decrypt single files without downloading all the encrypted contents. it gets only the data where the file you want is located. Requires Common key and the encrypted title key if no ticket is provided with the download.
VGMToolbox : Game Music extraction tool, added WUD extraction features, same as DiscU. probably require disc key and common key.
All other released tools are mostly GUI over these program, or program doing the same thing.
I'm not sure about this, I haven't read any info about WUD format, but to me it's something like that :
note:
Encrypted content = .app, .h3, etc.
decrypted content = the game files (the one used by loadiine)
The full Disc is encrypted with a disc key. the key is released at the same time than the WUD by dumper groups.
When decrypting the disc with the disc key, you get different partitions, or maybe folders. (maybe each partition is encrypted individually with the disc key, instead of the full disc. I don't know)
Each partition contains encrypted content files (.app, .h3, tmd, certk, tik, etc.). this step used to be in memory only on first DiscU version. it's now possible to save these files.
Each encrypted content pack is then decrypted using the encrypted title key located in the ticket. I guess the encrypted title key is decrypted with the wiiu common key?
Wud > disc key > encrypted content > ticket > encrypted title key > Common key > decrypted title key > decrypted content.
I don't know how the disc key is found or where it's extracted from. It's probably somewhere on the disc, or the console wouldn't be able to read it.
I'm not sure how much the WiiU common key is used, maybe in more steps?
I should learn more about cryptology.
The only way to re-encrypt is to use official SDK tools, until a legal open source method is released. (work in progress to convert homebrew to encrypted content format)
It would also require the Private key (only Nintendo has it) to sign all files, like the ticket. But now that there's a signature check patch applied to CFW, the private key is not required to make false ticket.
But user made encrypted files will only work on CFW.
I don't know if there's a way to convert encrypted content into partition/wud.
On Wii, the disc format was known and we could do it, maybe it will be possible with wiiu disc format too.