forums.ps2dev.org

agentbob · Joined: 10 May 2005 Posts: 8

The other day I got an idea for discovering the AES key used by the PSP for saving games. Basically the machine applies the function AES(DATA,KEY) = ENCRYPTED_DATA. Typically all we know is ENCRYPTED_DATA and it's pretty much useless to us. But what if we knew what DATA was in the first place? If we knew both DATA and ENCRYPTED_DATA, it would be an almost trivial matter of figuring out which key was used.

How can we get DATA? Well, my theory is, some of the games that are (or will be) released are just simple ports of other systems. If the data formatting were exactly the same, a save game from a PC or PS2 could match perfectly. Also, now that UMDs are starting to get dumped, maybe there is a common header in some of these files.

Anyway, that's my idea. What do you all think? Possible? Idiotic?

cheriff · Regular Joined: 23 Jun 2004 Posts: 262 Location: Sydney.au

Another thread (http://forums.ps2dev.org/viewtopic.php?t=1635) suggested doing this on BOOT and EBOOT, given that EBOOT is just encrypted version of BOOT with some header info.
Unfortunately it seems that for all practical purposes plaintext attacks on the encryption used is infeasible.

edits: typos
_________________
Damn, I need a decent signature!

Krevnik · Joined: 09 Mar 2005 Posts: 71

Getting the key is not as trivial as you think. See the post cheriff linked to and I explain exactly why it isn't trivial.