Skip to main content
added 23 characters in body
Source Link
poncho
  • 150.6k
  • 11
  • 230
  • 369

How can I understand how the two last bytes are built?

The first obvious question to answer is "are the last two bytes a linear [1] function of the rest of the data?". A CRC-16 would be linear; however those aren't the only linear functions (and in any case, as you'll see, we won't care about the distinction).

The easiest way to spot check this would be to get the message for 0001 seconds; if the function creating the last two bytes is linear, then the result will be BB 83 $\oplus$ 7B F3 $\oplus$ BA 33 = 7A 43. If you see that, then the mapping is most likely linear; if not, then we know that it isn't. Note that the three tags that I xor'ed are the tags for 0000, FFFE and FFFF.

If it is indeed linear, then it's easy; just find the messages for 0002, 0004, 0008, 0010, 0020, 0040, 0080, 0100, 0200, 0400, 0800, 1000, 2000, 4000, 8000 seconds; once you have all those, then you can compute the tag for any value by xoring together the correct known tags; to compute the tag for 0120, you'd xor in the tag for 0000 (which is always included if the number of bits is even), for 0100, and for 0020.

If this does correspond to a CRC, it'd actually be fairly easy to deduce the polynomial and initial state from this - however, you don't need it.

[1]: or affine; the distinction doesn't matter in this case

How can I understand how the two last bytes are built?

The first obvious question to answer is "are the last two bytes a linear [1] function of the rest of the data?". A CRC-16 would be linear; however those aren't the only linear functions (and in any case, as you'll see, we won't care about the distinction).

The easiest way to spot check this would be to get the message for 0001 seconds; if the function creating the last two bytes is linear, then the result will be BB 83 $\oplus$ 7B F3 $\oplus$ BA 33 = 7A 43. If you see that, then the mapping is most likely linear; if not, then we know that it isn't. Note that the three tags that I xor'ed are the tags for 0000, FFFE and FFFF.

If it is indeed linear, then it's easy; just find the messages for 0002, 0004, 0008, 0010, 0020, 0040, 0080, 0100, 0200, 0400, 0800, 1000, 2000, 4000, 8000 seconds; once you have all those, then you can compute the tag for any value by xoring together the correct known tags; to compute the tag for 0120, you'd xor in the tag for 0000 (which is always included), for 0100, and for 0020.

If this does correspond to a CRC, it'd actually be fairly easy to deduce the polynomial and initial state from this - however, you don't need it.

[1]: or affine; the distinction doesn't matter in this case

How can I understand how the two last bytes are built?

The first obvious question to answer is "are the last two bytes a linear [1] function of the rest of the data?". A CRC-16 would be linear; however those aren't the only linear functions (and in any case, as you'll see, we won't care about the distinction).

The easiest way to spot check this would be to get the message for 0001 seconds; if the function creating the last two bytes is linear, then the result will be BB 83 $\oplus$ 7B F3 $\oplus$ BA 33 = 7A 43. If you see that, then the mapping is most likely linear; if not, then we know that it isn't. Note that the three tags that I xor'ed are the tags for 0000, FFFE and FFFF.

If it is indeed linear, then it's easy; just find the messages for 0002, 0004, 0008, 0010, 0020, 0040, 0080, 0100, 0200, 0400, 0800, 1000, 2000, 4000, 8000 seconds; once you have all those, then you can compute the tag for any value by xoring together the correct known tags; to compute the tag for 0120, you'd xor in the tag for 0000 (which is included if the number of bits is even), for 0100, and for 0020.

If this does correspond to a CRC, it'd actually be fairly easy to deduce the polynomial and initial state from this - however, you don't need it.

[1]: or affine; the distinction doesn't matter in this case

Source Link
poncho
  • 150.6k
  • 11
  • 230
  • 369

How can I understand how the two last bytes are built?

The first obvious question to answer is "are the last two bytes a linear [1] function of the rest of the data?". A CRC-16 would be linear; however those aren't the only linear functions (and in any case, as you'll see, we won't care about the distinction).

The easiest way to spot check this would be to get the message for 0001 seconds; if the function creating the last two bytes is linear, then the result will be BB 83 $\oplus$ 7B F3 $\oplus$ BA 33 = 7A 43. If you see that, then the mapping is most likely linear; if not, then we know that it isn't. Note that the three tags that I xor'ed are the tags for 0000, FFFE and FFFF.

If it is indeed linear, then it's easy; just find the messages for 0002, 0004, 0008, 0010, 0020, 0040, 0080, 0100, 0200, 0400, 0800, 1000, 2000, 4000, 8000 seconds; once you have all those, then you can compute the tag for any value by xoring together the correct known tags; to compute the tag for 0120, you'd xor in the tag for 0000 (which is always included), for 0100, and for 0020.

If this does correspond to a CRC, it'd actually be fairly easy to deduce the polynomial and initial state from this - however, you don't need it.

[1]: or affine; the distinction doesn't matter in this case