Homebrew AES key scrambler

[Dazzozo]

Ok so say we set a bunch of KeyY's to try and decrypt something (set each time we want to try ofc) can we basically brute force it? I don't think there's too ridiculous an amount of permutations (2^128 for each key right?)

Not gonna happen. https://stackoverflow.com/questions/4376751/is-it-possible-to-break-a-128-bit-key

 

[dark_samus3]

Not gonna happen. https://stackoverflow.com/questions/4376751/is-it-possible-to-break-a-128-bit-key

Yeah I was looking at the numbers, not gonna happen for sure... For anyone else wondering there's at LEAST 340,282,400,000,000,000,000,000,000,000,000,000,000 combinations

 

[zecoxao]

so, how do we find 8.1+ normal key?

 

[motezazer]

so, how do we find 8.1+ normal key?

To find the key, we must search for it.
Seriously, I don't know. It doesn't seems to be "as-is" in Process9, unlike the keyY.

 

[zecoxao]

To find the key, we must search for it.
Seriously, I don't know. It doesn't seems to be "as-is" in Process9, unlike the keyY.

the interesting part about the slide that mentions the keys is that keyY is mentioned as "hardcoded" while normal key isn't, so someone got to reverse the firm apparently.

 

[dark_samus3]

the interesting part about the slide that mentions the keys is that keyY is mentioned as "hardcoded" while normal key isn't, so someone got to reverse the firm apparently.

KeyYs aren't hardcoded (except the one for UDP which is in the bootrom) it's all just stored in NAND, the reason they don't change them (they could) is because that'd be pointless, since we can read NAND and find them

 

[zecoxao]

KeyYs aren't hardcoded (except the one for UDP which is in the bootrom) it's all just stored in NAND, the reason they don't change them (they could) is because that'd be pointless, since we can read NAND and find them

i meant this http://prntscr.com/9jynju (from Earth97)
edit: plutoo: "PSPS service"
plutoo(continuing) :"This implementation uses the normal key"

 

[mathieulh]

Looking for the NFC normal key?

One thing : PSPS service.

Just my two cents

EDIT @zecoxao damn, you were too fast xD
Google talk will do that to you

 

[motezazer]

Looking for the NFC normal key?

One thing : PSPS service.

Just my two cents

https://www.3dbrew.org/wiki/Process_Services_PXI
But it seems we need a real amiibo to generate the normal key.

 

[mathieulh]

If I had a wild guess, I would look into PSPXI:EncryptDecryptAes on FIRM 8.1

 

[motezazer]

If I had a wild guess, I would look into PSPXI:EncryptDecryptAes on FIRM 8.1

Nothing special here, the NFC part of it was added on 9.3
The 8.1 NFC module used 0x04... commands of pxi: ps9

 

[mathieulh]

Nothing special here, the NFC part of it was added on 9.3
The 8.1 NFC module used 0x04... commands of pxi: ps9

Ok, that makes sense.

 

[Psi-hate]

http://pastebin.com/u/ryanrocks462

Mr RyanRocks is at it again. most likely retains info you already have though.

 

[windwakr]

Sha1(C) = 90EE1FF29FD7032176AD6D2222FA01C84BA6BF88

Thanks @Reisyukaku for helping me out.

 

[Suiginou]

Opening post rewritten to more accurately reflect that hunting the 0x39 keys is now a sport, apparently.

To find the key, we must search for it.
Seriously, I don't know. It doesn't seems to be "as-is" in Process9, unlike the keyY.

Did you try looking outside Process9? The ARM9 section also has the arm9loader and some other stuff before the Process9 NCCH begins.

 

[peteruk]

@dark_samus3 (sorry to tag you)

what do you make of this https://gbatemp.net/threads/clarification-thread-what-is-going-on.407074/page-63#post-5896511

 

[dark_samus3]

@dark_samus3 (sorry to tag you)

what do you make of this https://gbatemp.net/threads/clarification-thread-what-is-going-on.407074/page-63#post-5896511

Tag is fine... I'm pretty sure we have the keys now (not 100% sure, so don't quote) but yeah, as long as we actually do (we being the community) then 9.5+ emuNAND is possible

 

[peteruk]

Tag is fine... I'm pretty sure we have the keys now (not 100% sure, so don't quote) but yeah, as long as we actually do (we being the community) then 9.5+ emuNAND is possible

That's great, thanks for the speedy reply

 

[Myria]

Sha1(C) = 90EE1FF29FD7032176AD6D2222FA01C84BA6BF88

Thanks @Reisyukaku for helping me out.

That matches what I have. MD5(C) = 9AA86E174347ED880997FCCC9D8A4A59

 

[Dazzozo]

if all the cool kids are doing it, SHA256(C) = 05D6564396705F79890A12CD05DD914B0ADC01CCAA4D5158A90BB32553025997