The VIACCESS Frequently Asked Questions by OpenTV (v.1.1)
20/10/2000

Content:

1. Introduction
2. About VIACCESS
3. The protocol format
4. Contacts

1. Introduction:

This document is provided as is and is for educational purposes only. I do not intend to break this encryption algo neither encourage anybody to do that. My intentions are just to help the digital television maniacs understand the basics of this algo. I will not use in this neither in next editions of the document a live keys as examples. At the moment this document is very incomplete, but in future I will include detailed information about instructions.

2. About VIACCESS:

VIACCESS is an European encryption algo used in MPEG-2 (DVB and non DVB compliant) Pay-TV and Pay-Per-View services. VIACCESS is a trademark of France Telecom and a web site with detailed information about it might be located at: http://www.viaccess.fr/. At the moment there are several bouquets using VIACCESS:

- BBC PRIME - UK
- Viasat Digital - Sverige
- Telia Kabel - Sverige
- SVT - Sverige
- Canal Setellite Numerique - France (in simulcrypt with Mediaguard)
- ABSAT - France on Astra and Hot Bird (in simulcrypt with Mediaguard on Astra)
- TPS - France
- SSR SRG - Schweiz
- HRT - Hrvatska
- Satisfaction Channel Television & Rainbow Channel Television - Italia (in simulcrypt wit Irdeto)
- ART - Arabic on Hot Bird
- HTB+ World and Russia

Receiver supporting VIACCESS are available in stores across Europe. Corporations offering such receivers are:

- NOKIA
- Sagem
- XCom
- Humax
- Aston
- Technisat
- Thomson

However I recommend NOKIA MEDIAMASTER 9800 S multimedia terminal which has CI slot too. I tested it and here are the results:

VIACCESS embedded CAM is communicating fine with Season and goldcard cards
VIACCESS embedded working fine with official TPS, ABSAT, ART, SCT smart cards
CI VIACCESS CAM the same as with the embedded VIACCESS CAM
CI Irdeto CAM with NEC I chipset and SE 4.7 software working well with official and goldcards as well as with Season
CI Aston Mediaguard CAM v1.03 working well with official and goldcards as well as with Season
CI Conax CAM working well with official and unofficial smart cards
CI Cryptoworks CAM you have to wait some 15 minutes for stability of the communications between card and CAM

The first opinions about VIACCESS were that it is using algo similar to Eurocrypt-M used by Viasat analogue broadcasts.
An official VIACCESS smart card has:
Channel ID 3 bytes long - 00 70 00
Shared Address 4 bytes long - 00 00 12 30
Issuer Key for SA 7 bytes long - BA 07 F3 64 AA C9 F5 (this issuer key has been killed 3 months ago)
Unique Address 5 bytes long - 12 3X XX XX XX
Issuer Key for UA 7 bytes long - XX XX XX XX XX XX XX
Session Keys using index 00-0F
The CHID identifies the bouquet supported by the smart card. The Issuer Key in combination with its UA decrypts the uploaded by provider new Issuer Key which in combination with its SA updates the correct Session Key.

A few months ago a guy which name is Tony published dummy VIACCESS HEX files which are actually VianiX files with fake CH IDs and correct Viasat analogue index=08 session keys for Viasat Silver (TV3) and Viasat Gold (TV1000) packages. However this guy proved a thing which I tested at the beginning of the month of March this year. I used:
NOKIA MEDIAMASTER 9800 S multimedia terminal (comes with VIACCESS embedded CAM),
MultiMAC 2 goldcard equipped with PIC16F84 and 24LC16B,
Ludipipo programmer,
PicProg software
PIC24C13 software
MM2AU HEX files

I connected the Ludipipo programmer to COM2 of my PC. I used PicProg and uploaded the PIC HEX file to the PIC16F84. I used PIC24C13 and uploaded the EEPROM HEX files to the 24LC16B. I did not change the CH IDs in EEPROM file. When the smart card was programmed I inserted it in the VIACCESS embedded CAM slot. The message was "The channel is not handled by your smart card". Well. I used th Menu-9 command and checked the subscriptions info. The CAM reads my Viasat analogue subscription details as the D2-MAC Eurocrypt decoder does (Philips CTU 900/00). It proves that an Eurocrypt-M smart card is readable by VIACCESS CAM. If you change the CH ID with the right one you will see the same message on screen as the Issuer Key is wrong.

3. The protocol format:

CLA INS P1 P2 LEN
Communications between decoder and smart card use these standards:

- CLA: VIACCESS encryption algo is using CA and 87 just as Eurocrypt-M
- INS: Set of instructions that allow the decoder to ask the card for anything.
- P1
- P2: These parameter are used for example to specify a key or other information.
- LEN: Data transfer length: the length of bytes to be send and received for one instruction

CLASS 87 INSTRUCTION

02: Direction: CAM to card
Info: General purpose data
Intended to: Read LEN byte

04: Direction: Card to CAM
Info: Return the requested data from General purpose
Intended to: Send to the decoder:

00 00 00 09 00 00 00 ; 90 00

06: Direction: Card to CAM
Info: Return a requested data
Special: The length of byte sent from the card is equal to the

4th byte sent in instruction 04.
Intended to: Send to the decoder:

10 02 CA 20 11 03 54 50 53; 90 00

CLASS CA INSTRUCTION

A4: Direction: CAM to card
Info: Select a specific card information depending of the
P1 content:
00: Select Issuer
02: Select next Issuer

Special: The requested information is send back with the instruction C0.
Intended to: Send to the decoder:

90 00

C0: Direction: Card to CAM
Info: Return the requested information selected with the instruction A4.
Intended to: depend from preview A4 instruction:
00: send to the decoder:

FF F4 00 20 00 00 1F 74 1A 20 00 01
FF FF 04 05 FF 28; 90 00

02: send to the decoder:

00 7C 08 20 00 BF 1F 1C 1A 20 00 01
FF FF FF 08 FF FF FF FF FF FF FF; 90 00

AC: Direction: CAM to card
Info: Select an information into the card depending of P1 content:
A4: Select UA
A5: Select SA
A9: List Subscribe
Special: The requested information is send back with the instruction B8. Each issuer has is own SA and UA.
Intended to: Send to the decoder:

90 00 for any P1 except for A9.

For A9 read LEN byte.

B8: Direction: Card to CAM
Info: Return the requested information selected with the instruction AC.
Intended to: depend from preview AC instruction:

A4: send to the decoder:

A4 05 xx xx xx xx xx; 90 08 (xx is card?s serial number)

A5: send to the decoder:

A5 04 xx xx xx xx; 90 08 (xx is the card SA)

The number after A4 and A5 is the number of byte to send.

A9: when it is LEN = 6, send this string:

A9 07 xx xx xx xx; 90 00 (xx is subscription date)

When it is LEN = 3, send this string:
x xx xx ; 90 00 (xx is the subscription by class)

The class is a field of bit starting at the right for CLA 0 is:

100000000000000000000111

CLA 23
CLA 0
CLA 1
CLA 2


4. Contacts:

You could always upgrade to the latest version of this FAQ by clicking here
It could also be found at the VIACCESS web site of Pyramid and Magsat
The Home of OpenTV is still under construction.
There is a VIACCESS Forum located at OpenTV Bulletin Board
To contact the author of this document you might e-mail to OpenTV@gmx.net
If the links click won?t work put the mouse over the link and look at the URL showed in yellow. After that visit it by typing this URL in browser. Very Important! Never ask me for live keys or I will block your mail address. Note that some public free e-mail domains are blocked from my mail options, so use your e-mail address given by your ISP!

All credits go to Cerber for the initialisation of this work!