Request for the algorithm of ezs223's seedkey

[xiaoze88]

I noticed that someone has decrypted this module. Where can I find the specific algorithms? I've been studying it for a long time but still haven't figured it out. I haven't found the crucial files. You can pay for them.

[xpnglitch]

The algorithm is Ed25519ph over the seed... which works on keypair...
so im guessing you are after the private key
the private keys are different for every security level.

so which security level are you trying to unlock?

[Feezex]

{
"EcuName": "EZS_223",
"Aliases": [],
"AccessLevel": 1,
"SeedLength": 32,
"KeyLength": 64,
"Provider": "EsLibEd25519",
"Origin": "EZS223_2711_Seed32_1",
"Parameters": [
{
"Key": "PrivateKey",
"Value": "D69508C46288121189E1DB24C28CC71C448F1B9811B9FF112B08039148BB9ADE",
"DataType": "ByteArray"
}
]
}
,
{
"EcuName": "EZS_223",
"Aliases": [],
"AccessLevel": 11,
"SeedLength": 32,
"KeyLength": 64,
"Provider": "EsLibEd25519",
"Origin": "EZS223_2711_Seed32_V1",
"Parameters": [
{
"Key": "PrivateKey",
"Value": "EC8668F38D72251F30F21E5E76A5BC869567200E552D5C38108D9DEAF508D447",
"DataType": "ByteArray"
}
]
},
{
"EcuName": "EZS_223",
"Aliases": [],
"AccessLevel": 11,
"SeedLength": 32,
"KeyLength": 64,
"Provider": "EsLibEd25519",
"Origin": "EZS223_2711_Seed32_V2",
"Parameters": [
{
"Key": "PrivateKey",
"Value": "26C76712D89D906E6672DAFA614C42E5CB1CAAC8C6568E4D2493087DB51F0D36",
"DataType": "ByteArray"
}
]
}
,
{
"EcuName": "EZS_223",
"Aliases": [],
"AccessLevel": 61,
"SeedLength": 32,
"KeyLength": 64,
"Provider": "EsLibEd25519",
"Origin": "EZS223_2711_Seed32_61",
"Parameters": [
{
"Key": "PrivateKey",
"Value": "194EE3ABB111E10E1B97898E21EC71E50771CAFB5BD189F98C68FE77C8B1C5B1",
"DataType": "ByteArray"
}
]
}

[DavidIlie]

EZS223 contains the "Security Onboard Commissioning" (SECOC) authentication standard. This protocol is above any seed-key, fancy smrd or flashware that might get discovered.

EZS223, EZS167M, EZS213M contain this protocol.

On first connection via UDS, the firewall is fully locked. Only login with AFTERSALES_STANDARD or AFTERSALES_ENHANCED gets you workshop-level access (actuations, tests, reading DTC, and with enhanced cert do flashing). Coding is not permitted at this stage.

The login happens in accordance to a remote server from Mercedes, called CEBAS. According to the permissions present in your account, the backend grants the appropriate login methods under a certificate.

These certificates have availability periods of around 1 month to two weeks. So the EZS and other ECUs keep track of this time to reject authentication when the date is invalid.

To do variant coding, DTS9 computes the whole variant coding domains and passes it along another certificate, called VARIANT_CODING_USER_CERTIFICATE, if you have permissions for this type, your local Xentry/CEBAS will generate the signature. Otherwise, in Xentry SCN, the signed string is returned from the server.

To do VIN change or perform virginisation of some modules, you need DEVELOPMENT_ENHANCED permissions. Which lets you do whatever you want.

As a reminder, the variant coding and developer certs are restricted to DEVELOPMENT ACCOUNTS, so R&D. Certificates have leaked in the past, but they're locked to dates such as 2022 or at the latest i've seen 2024. So, unless you do the "timeback" method, you cannot authenticate.

However, the timeback method removes the shared vehicle secret from the ECU you're working on, so you will need an online account to perform SECOC commissioning (SECOCIS). The EZS does not support standard "timeback" like HU7 (for example).

The only way to set the time back on EZS is to remove it from the car, put in bench, and start flashing it with the wrong software nonstop til you corrupt it. That's a recipe for disaster and I despise anyone who ruins their customers cars as they're desperate for money. FBS4 gets lost, VIN gets lost, codings get lost, it's awful. 2025+ cars have been recalled to update the EZS to patch this issue.

Mercedes have already deprecated this STAR3 standard, in favor of STAR3.5, which is SECOC but on steroids.

It might truly be the end of an era.

Written by David - creator of MBRetrofit Tools