05/05/2015
CONAX
Conax uses same basic principles to encrypt channels as do other encryption systems.
Basically speaking a encrypted "Control Word" or ECW for short is sent to every card in a message called an Entitlement Control Message or ECM.
A new ECW is sent to every card simultaneously every 5 or 10 seconds or so.
The Card uses the current Operational Key (Key 20, Key21) to decode this ECW into a decoded Control Word or DCW.
The algorithm used to do this decoding of the ECW into DCW is called RSA (a little more about how this works later)
The DCW is then returned by the Smart Card to the CAM, where it is used to decode the incoming video signal. This is done within the CAM using a system called CSA (Common Scrambling Algorithm) to decode the incoming video into a veiwable picture.
From the above we can understand that all cards have the same Operational Key values, because they all have to decode the same ECW to clear a channel. Got that? Good....
Now where do those Operational keys come from and how do they get into the card. Well in the old days they would be preloaded into all the cards when they were manufactured. The problem with this (for the providers, not for us!) is that when hackers opened any one card and got the keys, the only way the provider could stop pirate veiwing would be to replace all the cards. Expensive to do!
So with current systems (like Conax) we have a further step up the ladder.
The Operational keys are sent to all the subscriber cards over the air in a message called an EMM (Entitlement Management Message).
This EMM contains the new Operation Keys to be used next.
Obviously hackers are not allowed to log these new Operation Keys being sent, so again these operational keys in the EMM are encrypted using RSA.
However there is an important difference between EMM and ECM. Where ECM are sent simultaneously to all cards, EMM are sent separately to every card in turn.
An EMM contains an Address of a specific card (known as UA or SA), and an encrypted operational key. The operational key is encrypted in RSA using a Master Key.
This Master Key in conax is key10, and every single card has it's own unique Master Key 10, so a card can only decrypt the EMM addressed specifically to that card.
In other words every EMM contains different encrypted data that can only be decoded by the card it is meant for.
This means that Conax can choose which cards it want's to update with the new key 20 or 21, and which cards it no longer wants to update - like when the subscription expires for example, or a card is reported stolen or lost.
The idea behind all this is that if hackers extract the MK10 from a card, and then publish that key and UA, all Conax needs to do is find the compromised key and address, then stop updating that card and all peoples copies that use the same key.
This is the reason why Master Keys are kept secret amongst small groups of hackers.
What was not considered at the time these systems were invented, is tha tpeople would have such a thing as the internet, where the current Operational keys can be published to many people very quickly, even if the change every day or more often (anyone remember good ol' sexview - 3 updates per day! )
Now a little about RSA itself
This is how it works:
* Find 2 very large primes, p and q.
* Find n=pq (the public modulous).
* Choose e, such that eCARD----->CAM)
--------------------------------------------
Right lets see. There are TWO distinct processes going on in Conax (and just about all other encryptions)
1. Process for Decoding the actual picture/sound
-----------------------------------------------
For this the Conax card contains Operational Keys Key20 and 21, but only one of these is used at a time(see below for more about this) - marked (*)
The Process is:
a. CAM sends Encrypted CW to CARD in a message called an ECM
b. CARD uses key 20 or 21 to decode Encrypted CW into Decrypted CW (which is done using the RSA algorithm)
c. Decrypted CW is returned from CARD to CAM
d. CAM uses decrypted CW to decode the video
This process repeats every few seconds when a new ECW is sent to be decoded by the card. Every new ECW (encrypted Control WOrd) arrives in an ECM (Entitlement Control Message) All cards receive the SAME ECM at the SAME time.
If you have a valid key 20 or 21 then you can watch Conax until the key20 or 21 changes - once every day, week, month, whatever they decide it will last for.
2. Process for updating the Operational Keys Key20/21
---------------------------------------------------------------------
a. CAM sends new Encrypted Key 20 or 21 to CARD in a message called an EMM.
b. CARD decrypts the key 20 or 21 using its own UNIQUE master key 10 (to ensure the card decodes the correct EMM they attach a unique address to each EMM so the card knows which EMM to decrypt)
c. The decrypted key 20 or 21 is NOT sent back to the cam. It STAYS IN THE CARD for use in the above process 1.
Every EMM is unique to the card it was meant for.
Every EMM has a different encoded key 20 or 21, EVERY CARD HAS A UNIQUE KEY 10
However when the EMM is decoded with the correct key 10, every card produces the SAME decoded key20 or 21
Like this:
Encrypted Key 20 123456789 + MK10 (card a) = key 20 12AB4356
Encrypted Key 20 342575357 + MK10 (card b) = Key 20 12AB4356
Encrypted Key 20 12AB4EC21 + MK10 (card c) = Key 20 12AB4356
If you have a valid Master Key (Key10) and UA (Unique Address) then you can make an auto update file which will update the new key 20 or 21 when it is sent.
Now does THAT make more sense?? If not I'm happy to go through this and clarify things as long as you folks have a wish to understand more about what this hobby is really about.
Oh couple other things to mention (otherwise others here will tell me the above is wrong)
First thing.
In reality as many providers have millions of subscribers, they don't have time to send new operqational keys to every single card, one by one, using the UA (Unique Address)
So what they do in reality is update whole groups of cards at the same time (say 4096 cards per group) using the SA (Shared Address). If you understood post above you will realise that all cards from the same SA must have the same MK10!
Second thing (*)
There is some rumours/talk that since Conax changed cards in some SA groups, they have modified thier system to use BOTH key 20/21 to process the ECW. I have seen no evidence that this is true, but rumours persist.
