here some tool and what they can do :

DiscU From Crediar : Can extract a WUD and decrypt all the game files. Since v4.1b it can also extract the encrypted content file without decrypting them. Requires the Disc key to read the disc data. the key is usually provided by release groups. Common key included in 4.1b.
CDecrypt From Crediar : Decrypt encrypted content files to extracted game files. Requires the encrypted Title key located in a ticket (tik, title.tik). WiiU Common key required in v0.1, included in v0.2.
NUSGrabber From Crediar : Download encrypted content files from Nintendo Update Server. Requires a TitleID
JNUSTool From Maschell : NUSgrabber+Cdecrypt combined written in Java (multi platform), it downloads encrypted content from NUS and can also decrypts the files at the same time. It can also decrypt single files without downloading all the encrypted contents. it gets only the data where the file you want is located. Requires Common key and the encrypted title key if no ticket is provided with the download.
VGMToolbox : Game Music extraction tool, added WUD extraction features, same as DiscU. probably require disc key and common key.


All other released tools are mostly GUI over these program, or program doing the same thing.


I'm not sure about this, I haven't read any info about WUD format, but to me it's something like that :

note:
Encrypted content = .app, .h3, etc.
decrypted content = the game files (the one used by loadiine)

The full Disc is encrypted with a disc key. the key is released at the same time than the WUD by dumper groups.
When decrypting the disc with the disc key, you get different partitions, or maybe folders. (maybe each partition is encrypted individually with the disc key, instead of the full disc. I don't know)
Each partition contains encrypted content files (.app, .h3, tmd, certk, tik, etc.). this step used to be in memory only on first DiscU version. it's now possible to save these files.
Each encrypted content pack is then decrypted using the encrypted title key located in the ticket. I guess the encrypted title key is decrypted with the wiiu common key?

Wud > disc key > encrypted content > ticket > encrypted title key > Common key > decrypted title key > decrypted content.

I don't know how the disc key is found or where it's extracted from. It's probably somewhere on the disc, or the console wouldn't be able to read it.

I'm not sure how much the WiiU common key is used, maybe in more steps?
I should learn more about cryptology.



The only way to re-encrypt is to use official SDK tools, until a legal open source method is released. (work in progress to convert homebrew to encrypted content format)
It would also require the Private key (only Nintendo has it) to sign all files, like the ticket. But now that there's a signature check patch applied to CFW, the private key is not required to make false ticket.
But user made encrypted files will only work on CFW.

I don't know if there's a way to convert encrypted content into partition/wud.
On Wii, the disc format was known and we could do it, maybe it will be possible with wiiu disc format too.

 

if you want to keep only one format, WUD (or compressed wud into wux) is the best choice as it can provides all 3 format : full iso, encrypted and decrypted.
It's also "correctly signed".

If you keep only loadiine format because in the future it will be possible to encrypt the content, it will be "bad signed".
At least, between both encrypted and decrypted format, keep the encrypted one from NUS, it's always better to get clean files instead of user's edited or repacked ones.

so, keep in order :
WUX : compressed WUD. can be decompressed without altering WUD data. (lossless compression)
WUD : best to get all possible format from it. Issue is that it's big !, but when converting to Wux it's lossless compression and will compress better than winrar.
Encrypted content from NUS or extracted from WUD : original and good signed files. can be used as is to install, or can be extracted to get internal files.
Decrypted content : for loadiine, cafiine, hacks, mods, translation, music/model/texture extraction, etc. that's the least best method for archival purpose. it's good that it's ready to use for any mods or loadiine, but can't be repacked officially with good signature. repacked files will be installable only on CFW (unless there's a signature patch release later at boot time for sysNAND).

 

I never took wud files (too big for bad internet connection). NUS files are easy to get, but wud will always be available later (even if hard to find), while NUS version will be discontinued at any given time in the future.
well, if you want to archive, for the moment choose the one you like or based on its size if it's an issue.

 

yes, that's what lot of users are doing for months to use with loadiine.
as long as you have the title key, you can decrypt them.

few titles didn't have a title key due to no WUD dumped, but now that we can extract ticket (and title key) from NAND we can extract the eshops with no WUD dumps.