I would like to decode a Kamstrup 402 WMBUS telegram.
The raw telegram looks like this:
5C442C2D61604992190C8D2004E0CDD82237C23A81477B49CCE745E9F119753BEB27981646CEFD332717BD1B34C55A0A6532FFEFD0BECFB1562808CD462C6403977AC6F79955666D1CB50FE00975E36F51E9204DEE58A0FD27F437DEB0
I received the following AES key from the manufacturer: ABF8ED78C0B24285831E84CBF79F334D
The algorithm I use for decryption works with other manufacturers in T1 mode.
AES128, CBC mode, 5.
Kamstrup uses C1 mode, long data frame. Analyzing the telegram, I found:
2C2D – manufacturer
8D20 – the number after is the access number (0x04)
I set up the IV vector like this (based on T1 mode):
MAN Address access number x 8
2C2D 61604992 190C 0404040404040404
I am not sure from which byte position I should take the part I want to decrypt.
I took it from this position:
2004E0CDD82237C23A81477B49CCE745E9F119753BEB27981646CEFD332717BD1B34C55A0A6532FFEFD0BECFB1562808CD462C6403977AC6F79955666D1CB50FE00975E36F51E9204DEE58A0FD27F437DEB0
The result is not correct; it does not contain 0x2F.
If anyone has experience with C1-mode WMBUS telegram decryption, please help.
Sandor
The result is not correct; it does not contain 0x2F.
Sandor Sandor is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.