Barcoded Ticketing Standards - Freedom of Information

[theenbyperor]

Hey all,

As I'm sure you're aware, the RDG like to keep the spec for their bacoded tickets rather secretive.
However, after a 15 month (ish) Freedom of Information Act fight, I've managed recently to settle a court case against the Department for Transport giving me the specs under the FoIA.
They're available here for your reading enjoyment: https://magicalcodewit.ch/rsp-specs/

 

[JimmyCrystal]

For what reason?

 

[blimmo]

Hey all,

As I'm sure you're aware, the RDG like to keep the spec for their bacoded tickets rather secretive.
However, after a 15 month (ish) Freedom of Information Act fight, I've managed recently to settle a court case against the Department for Transport giving me the specs under the FoIA.
They're available here for your reading enjoyment: https://magicalcodewit.ch/rsp-specs/

Thanks! I might see if I can make anything cool, but I really just appreciate RDG having to publish something that should have been public from the beginning!

 

[Bletchleyite]

For what reason?

Education for education's sake is a laudable thing in its own right.

 

[ainsworth74]

Hey all,

As I'm sure you're aware, the RDG like to keep the spec for their bacoded tickets rather secretive.
However, after a 15 month (ish) Freedom of Information Act fight, I've managed recently to settle a court case against the Department for Transport giving me the specs under the FoIA.
They're available here for your reading enjoyment: https://magicalcodewit.ch/rsp-specs/

Excellent work! And I thought my battle with the HSE to get the Gerrards Cross investigation information out of them was tough, they lost at the ICO stage so never had to touch the Tribunal system

I would be fascinated to see the Tribunal Decision notice if you're in a position to share it?

Edit: Ah did they cave in before the Tribunal got to reach a decision?

 

[Edvid]

For anyone wondering why this case went as far as the Tribunal stage, here's the ICO's decision notice:

London North Eastern Railway Limited (LNER)

ico.org.uk

The complainant has requested London North Eastern Railway (LNER) to disclose information relating to the Rail Settlement Plan ticket specifications and public keys. LNER refused to disclose the requested information citing section 31(1)(a) of FOIA (prevention of crime). The Commissioner’s decision is that LNER is entitled to withhold the requested information under section 31(1)(a) of FOIA. The Commissioner does not require further steps. Information Tribunal FT/EA/2025/0275 under appeal.

 

[CarrotPie]

Hey all,

As I'm sure you're aware, the RDG like to keep the spec for their bacoded tickets rather secretive.
However, after a 15 month (ish) Freedom of Information Act fight, I've managed recently to settle a court case against the Department for Transport giving me the specs under the FoIA.
They're available here for your reading enjoyment: https://magicalcodewit.ch/rsp-specs/

Great news!

Does this mean a talk about the structure of UK train tickets at Chaos Communication Congress this year?

 

[theenbyperor]

Edit: Ah did they cave in before the Tribunal got to reach a decision?

They did. Probably saw the writing on the wall, but still dragged it out until a few days before the trial was due to start.

 

[styles]

For what reason?

Public interest.

The way in which something is encrypted or encoded isn't particularly secretive, or it shouldn't be, as it should be the keys which matter.

 

[CarrotPie]

Public interest.

The way in which something is encrypted or encoded isn't particularly secretive, or it shouldn't be, as it should be the private keys which matter.

Perhaps they heard about someone's private keys going walkies in Germany and decided they didn't want to risk it in case they lost control of their private keys as well!

 

[styles]

Perhaps they heard about someone's private keys going walkies in Germany and decided they didn't want to risk it in case they lost control of their private keys as well!

If someone manages to access your private keys for an encryption system, they probably have gained access to the algorithm as well!

 

[35B]

Perhaps they heard about someone's private keys going walkies in Germany and decided they didn't want to risk it in case they lost control of their private keys as well!

They specifically cite a German example, and the criminal activity resulting from reverse engineering that led to the creation of "valid but fraudulent tickets."

 

[theenbyperor]

They specifically cite a German example

One of the arguments I used for the release of these standards is that it was me who discovered this fraud in Germany, and it was precisely because the specs were open that I could do that. See here: All my Deutschlandtickets gone: Fraud at an industrial scale.

 

[sot]

Excellent work on this, I presume you are considering a dive into the UK system to see if there are any issues also?

It is worrying that the people who deal with these requests seem to not have any idea, and rather than making a concerted effort to delve deeper and find someone with a better understanding it is replied to with pure nonsense.

I did enjoy the conference, I believe Mr Jeeves passed on my regards.

 

[theenbyperor]

I presume you are considering a dive into the UK system to see if there are any issues also?

I've written a paper on it, currently waiting for peer-review on that.

 

[redreni]

Great work!

How long did it take the ICO to arrive at its (incorrect) decision?

Am I right in thinking there's no way of going to the Tribunal until the ICO makes a decision, no matter how long the ICO sits on it (over 3 months without even allocating to a case officer in my case)?

 

[theenbyperor]

It took them about half a year to come to their decision, then another just over half a year in the courts themselves on appeal. If the ICO don't do anything (i.e. provide a status report, allocate a case officer) for 3 months, you can apply to the tribunal to force them to move your case along.

 

[horsewalrus]

Great work!

It looks like they didn't get around to releasing the public keys though - or have you chosen to not publish them? Will you be pushing back on this? (The internal review reply declining to "engage in a speculative technical debate regarding RSA cryptography" did make me laugh!)

 

[theenbyperor]

Unfortunately, it was decided that the keys are “held” by the RDG not the TOCs, and so aren’t even in scope of the FoIA.

 

[blimmo]

Unfortunately, it was decided that the keys are “held” by the RDG not the TOCs, and so aren’t even in scope of the FoIA.

What is possible without the public keys? Is it just the header information? I haven't looked at the spec in detail yet so apologies if this should be obvious, I'm worried that the best possible applications will be prevented without the public keys.

 

[plugwash]

My understanding is they went for a scheme where the "message" is passed to the RSA algorithm directrly and is not transmitted seperately. So without the public key you can't extract the ticket data.

 

[saismee]

I find this quite interesting

An eTicket may be freely duplicated to multiple customer devices, screenshotted, or printed multiple times. This is an accepted feature of eTicket which is desired by customers but makes visual inspection unsuitable. Therefore, eTicket fulfilment should be considered only for flows where barcode scanning is common practice and there is frequent communication across validation equipment.

I've heard a lot of staff say that screenshotted tickets "aren't accepted" or "aren't valid" and I have always questioned that. It looks like they are valid (and I can't see why they wouldn't be, unlike railcards).

 

[AlterEgo]

It's always been a myth that screenshots aren't valid so I'm pleased to see this come up as the hardest possible evidence that yes, of course they are valid.

 

[theenbyperor]

My understanding is they went for a scheme where the "message" is passed to the RSA algorithm directrly and is not transmitted seperately. So without the public key you can't extract the ticket data.

This is indeed correct. Thankfully, the public keys have been leaked: https://git.eta.st/eta/rsp6-decoder/-/blob/master/keys.json?ref_type=heads

 

[styles]

This is indeed correct. Thankfully, the public keys have been leaked: https://git.eta.st/eta/rsp6-decoder/-/blob/master/keys.json?ref_type=heads

Looks like the Avanti one has expired with no currently valid key in that list.

 

[theenbyperor]

Believe it or not, the TOCs’ ticketing system operators are awful at actually updating keys. I’m pretty sure the Avanti key is still used, in spite of being ostensibly expired.

 

[styles]

Believe it or not, the TOCs’ ticketing system operators are awful at actually updating keys. I’m pretty sure the Avanti key is still used, in spite of being ostensibly expired.

Ok yeah that would make 'sense', and is not surprising in the slightest.

 

[AlterEgo]

Believe it or not, the TOCs’ ticketing system operators are awful at actually updating keys. I’m pretty sure the Avanti key is still used, in spite of being ostensibly expired.

They are awful at most things, so this is entirely believable.

 

[CarrotPie]

Believe it or not, the TOCs’ ticketing system operators are awful at actually updating keys. I’m pretty sure the Avanti key is still used, in spite of being ostensibly expired.

As you said in your D-ticket talk, it's the same in Germany as well...is there any country that actually updates their keys regularly?

 

[theenbyperor]

is there any country that actually updates their keys regularly?

The International Union of Railways members (so those operating cross-border services) do actually stick to a hard 1-year limit on key length. Although the Dutch railways have recently (as in, two days ago) failed to copy Interrail's new key into their system, so Dutch fare gates broke for Interrail on the 1st.