Need help generating full 56-byte Encrypted Challenge in S7CommPlus session setup #61
Description
Below is a concise GitHub issue drafted in English to seek help with generating the encrypted challenge:
Title: Need help generating full 56-byte Encrypted Challenge in S7CommPlus session setup
Context
I'm implementing the S7CommPlus protocol (based on your German project) to connect to Siemens S7-1200/1500 PLCs without TLS. The session setup requires generating a 56-byte encrypted challenge in SetSessionSetupData.
Current Progress
- First 16 bytes of
encryptedChallengeare correctly computed by XORing the PLC'schallenge(bytes 2-17) with a fixed parameter5f cb e9 73 01 70 f3 37 c9 fb 55 1a 34 32 14 ea. - Problem: The remaining 40 bytes (positions 16-55) remain unresolved. Currently, 24 bytes are hardcoded (
3e c8 d4 a9 ... cb 57) and the final 16 bytes (82 6a ... 28 87) appear to be a checksum.
Code Snippet
// Relevant portion of SetSessionSetupData
byte[] encryptedChallenge = new byte[56];
byte[] para = new byte[] { 0x5f, 0xcb, 0xe9, 0x73, ... , 0xea };
byte[] plainText = new List<byte>(challenge).GetRange(2, 16).ToArray();
// Correctly computes first 16 bytes:
for (int i = 0; i < plainText.Length; i++)
{
bytes[i] = (byte)(plainText[i] ^ para[i]);
}
Buffer.BlockCopy(bytes, 0, encryptedChallenge, 0, 16);
// Remaining 40 bytes UNKNOWN (currently hardcoded):
Buffer.BlockCopy(new byte[] { 0x3e, 0xc8, ... , 0x57 }, 0, encryptedChallenge, 16, 24);
Buffer.BlockCopy(new byte[] { 0x82, 0x6a, ... , 0x87 }, 0, encryptedChallenge, 40, 16); Request
Could you clarify:
- What algorithm or keys derive the 24 middle bytes (positions 16-39)?
- How is the final 16-byte checksum (positions 40-55) computed?
- Is there a cryptographic primitive (e.g., AES-CBC, custom cipher) involved?
Any insights, pseudocode, or references would be invaluable. Thank you!
Key Points
- Clearly states what works (first 16 bytes).
- Explicitly identifies the unknown parts (40 bytes).
- Asks specific technical questions about the algorithm.
- Maintains a respectful tone while acknowledging the original work ("based on your German project").