Hector Martin

well, if it's DES (and with 64 bit it's probably either that or some self-cooked vigenere cipher or something like that) then it's likely one of the five traditional encryption modes. if you have the key you can try them all.

So I'm now trying to replay the capture and turns out they do seem to use something more clever than I expected. Even if I send the same 64 bit from a capture, the device sends over a different message, with what looks like two separate 64 bit values that are different.

CBC mode, a random IV and one block? That would be pretty common.

If you know it's DES and the exact mode and don't have the key, you can crack the key for $30 at http://crack.sh . might get a bit pricy if you're guessing the format/parameters though.

Unfortunately I can only _guess_ it's DES. What I have is (at least) 64-bit sent Host→Device and at least 2×64-bit sent Device→Host right now. I was trying to set up a second VM just to see if the parts I see constants are really constant, or generated at install.

Securekeybox, the WhiteCryption nonsense? Because I can pull keys out of those. Whitebox crypto is snake oil.

Isn’t that like saying obfuscation in general is snake oil? Its trivial to renew and high effort to reverse.