Below is a concise GitHub issue drafted in English to seek help with generating the encrypted challenge:
Title: Need help generating full 56-byte Encrypted Challenge in S7CommPlus session setup
Context
I'm implementing the S7CommPlus protocol (based on your German project) to connect to Siemens S7-1200/1500 PLCs without TLS. The session setup requires generating a 56-byte encrypted challenge in SetSessionSetupData.
Current Progress
- First 16 bytes of
encryptedChallenge are correctly computed by XORing the PLC's challenge (bytes 2-17) with a fixed parameter 5f cb e9 73 01 70 f3 37 c9 fb 55 1a 34 32 14 ea.
- Problem: The remaining 40 bytes (positions 16-55) remain unresolved. Currently, 24 bytes are hardcoded (
3e c8 d4 a9 ... cb 57) and the final 16 bytes (82 6a ... 28 87) appear to be a checksum.
Code Snippet
// Relevant portion of SetSessionSetupData
byte[] encryptedChallenge = new byte[56];
byte[] para = new byte[] { 0x5f, 0xcb, 0xe9, 0x73, ... , 0xea };
byte[] plainText = new List<byte>(challenge).GetRange(2, 16).ToArray();
// Correctly computes first 16 bytes:
for (int i = 0; i < plainText.Length; i++)
{
bytes[i] = (byte)(plainText[i] ^ para[i]);
}
Buffer.BlockCopy(bytes, 0, encryptedChallenge, 0, 16);
// Remaining 40 bytes UNKNOWN (currently hardcoded):
Buffer.BlockCopy(new byte[] { 0x3e, 0xc8, ... , 0x57 }, 0, encryptedChallenge, 16, 24);
Buffer.BlockCopy(new byte[] { 0x82, 0x6a, ... , 0x87 }, 0, encryptedChallenge, 40, 16); Request
Could you clarify:
- What algorithm or keys derive the 24 middle bytes (positions 16-39)?
- How is the final 16-byte checksum (positions 40-55) computed?
- Is there a cryptographic primitive (e.g., AES-CBC, custom cipher) involved?
Any insights, pseudocode, or references would be invaluable. Thank you!
Key Points
- Clearly states what works (first 16 bytes).
- Explicitly identifies the unknown parts (40 bytes).
- Asks specific technical questions about the algorithm.
- Maintains a respectful tone while acknowledging the original work ("based on your German project").
Below is a concise GitHub issue drafted in English to seek help with generating the encrypted challenge:
Title: Need help generating full 56-byte Encrypted Challenge in S7CommPlus session setup
Context
I'm implementing the S7CommPlus protocol (based on your German project) to connect to Siemens S7-1200/1500 PLCs without TLS. The session setup requires generating a 56-byte encrypted challenge in
SetSessionSetupData.Current Progress
encryptedChallengeare correctly computed by XORing the PLC'schallenge(bytes 2-17) with a fixed parameter5f cb e9 73 01 70 f3 37 c9 fb 55 1a 34 32 14 ea.3e c8 d4 a9 ... cb 57) and the final 16 bytes (82 6a ... 28 87) appear to be a checksum.Code Snippet
Request
Could you clarify:
Any insights, pseudocode, or references would be invaluable. Thank you!
Key Points