Barcoded Ticketing Standards - Freedom of Information

[saismee]

The International Union of Railways members (so those operating cross-border services) do actually stick to a hard 1-year limit on key length. Although the Dutch railways have recently (as in, two days ago) failed to copy Interrail's new key into their system, so Dutch fare gates broke for Interrail on the 1st.

Do any gates in the UK actually accept interrail tickets? I think they either fail to scan or show 93 (decryption error) on Cubic barriers.

 

[Mike395]

The International Union of Railways members (so those operating cross-border services) do actually stick to a hard 1-year limit on key length. Although the Dutch railways have recently (as in, two days ago) failed to copy Interrail's new key into their system, so Dutch fare gates broke for Interrail on the 1st.

Quite the irony considering NS and Eurail share a head office!

 

[MrJeeves]

Do any gates in the UK actually accept interrail tickets?

If a gateline is set to accept any tickets using the gateline control totem thing, then they'll work the gates. Otherwise, I'm not convinced.

I've tried Vix, S&B and Cubic gates all with no success.

I think they either fail to scan or show 93 (decryption error) on Cubic barriers.

They will show as 42, which is passback, for some inexplicable reason. 93 is an error only used for smartcards.

 

[Mike395]

Do any gates in the UK actually accept interrail tickets? I think they either fail to scan or show 93 (decryption error) on Cubic barriers.

You occasionally get one that does, but I wonder if these are in some sort of 'accept everything' mode rather than successfully knowing what the pass is.

 

[saismee]

If a gateline is set to accept any tickets using the gateline control totem thing, then they'll work the gates.

I was under the impression that "Accept All" only affected CCST as I see 57 with eTickets even when it's set to accept all.

They will show as 42, which is passback, for some inexplicable reason. 93 is an error only used for smartcards.

That is a strange and seemingly unrelated error. 93 is not only used for smartcards (which display 92 and 94 more commonly), a lot of the eTicket/smartcard codes are duplicated and mean similar things. I've seen valid tickets scan as 93 although other scanning tools accept it fine. Try scan the Aztec code from a railcard on the eTicket reader

 

[theenbyperor]

There's some extremely funny business going on with Interrail in the UK.

Presently, Interrail is issued in a way that the pass cover number is always at the same byte offset within a barcode. Thus, when a UK inspection devices sees a barcode that starts #UT (the prefix for any European barcode), it will blindly copy some bytes out and send it to the Interrail API to check if that pass is valid today. Nothing in the UK actually verifies the signatures over Interrail passes.

Soon (it was going to be from 3 days ago, but it got pushed back), Interrail will move to the newer spec for European barcodes, and the pass number won't be so easily readable. The UK's inspection devices will then have to actually bother to parse the barcode and check the signature over it properly. In spite of this change being given about 2 years' notice, its caught everyone in the UK off guard and we're having a wonderful time over here in the European standards bodies dealing with the fallout!

 

[ainsworth74]

I find this quite interesting

I've heard a lot of staff say that screenshotted tickets "aren't accepted" or "aren't valid" and I have always questioned that. It looks like they are valid (and I can't see why they wouldn't be, unlike railcards).

It's always been a myth that screenshots aren't valid so I'm pleased to see this come up as the hardest possible evidence that yes, of course they are valid.

I've always assumed it's a hangover from the ludicrous m-ticket system where screenshots were indeed not valid. Of course with proper training this impression should not have taken hold for the long term that it has but...

The International Union of Railways members (so those operating cross-border services) do actually stick to a hard 1-year limit on key length. Although the Dutch railways have recently (as in, two days ago) failed to copy Interrail's new key into their system, so Dutch fare gates broke for Interrail on the 1st.

Aha! I was wondering why I struggled to get through the barrier at Enschede station yesterday using my Interrail! Thankfully the ticket office was open and the helpful lady gave me a "KeyCard" (seemingly just a barcode that works the barriers) to allow me to enter and exit the system. She told me to destroy it once I was done to make sure no-one could abuse it to try and circumvent the barriers as apparently it works for half a dozen times or so. But it was very strange not being able to open the barriers as my previous use of an Interrail had been flawless in the Netherlands.

 

[CyrusWuff]

My understanding is that Cubic gates (I can't speak for other manufacturers as I have no experience of them) won't accept either Eurail or Interrail passes as they use UIC format barcodes.

They can be configured to accept BritRail passes, however, as those are a GB Rail product using normal GB Rail Type 06 Aztec codes.

 

[MrJeeves]

it will blindly copy some bytes out and send it to the Interrail API to check if that pass is valid today. Nothing in the UK actually verifies the signatures over Interrail passes.

In spite of this change being given about 2 years' notice, its caught everyone in the UK off guard and we're having a wonderful time over here in the European standards bodies dealing with the fallout!

Given the need to check the Interrail API anyway, I don't see a real need for TTK to also validate the signature given the details of barcode will be verified as part of the call to Interrail, and TTK will only show relevant data from the response of that API request.

The far bigger issue is really the use of fixed offsets instead of actually decoding the barcode.

 

[Wallsendmag]

My understanding is that Cubic gates (I can't speak for other manufacturers as I have no experience of them) won't accept either Eurail or Interrail passes as they use UIC format barcodes.

They can be configured to accept BritRail passes, however, as those are a GB Rail product using normal GB Rail Type 06 Aztec codes.

S&B won't either although TTK kit can scan it and out gateline staff have the TTK app

 

[OscarH]

Presently, Interrail is issued in a way that the pass cover number is always at the same byte offset within a barcode. Thus, when a UK inspection devices sees a barcode that starts #UT (the prefix for any European barcode), it will blindly copy some bytes out and send it to the Interrail API to check if that pass is valid today. Nothing in the UK actually verifies the signatures over Interrail passes.

Soon (it was going to be from 3 days ago, but it got pushed back), Interrail will move to the newer spec for European barcodes, and the pass number won't be so easily readable. The UK's inspection devices will then have to actually bother to parse the barcode and check the signature over it properly. In spite of this change being given about 2 years' notice, its caught everyone in the UK off guard and we're having a wonderful time over here in the European standards bodies dealing with the fallout!

Now now, don't tarnish us all with the same brush. Some people have written scanning apps that properly decode UIC barcodes instead of making absolutely batsh*** assumptions

 

[MrJeeves]

although TTK kit can scan it and out gateline staff have the TTK app

Until the barcode change, as Q just explained.

They should be grateful that some European operators caused it to be pushed back, or I can imagine the frontline conflict that would have started from 1 March.

 

[redreni]

It took them about half a year to come to their decision, then another just over half a year in the courts themselves on appeal. If the ICO don't do anything (i.e. provide a status report, allocate a case officer) for 3 months, you can apply to the tribunal to force them to move your case along.

I can't find any way of doing that for an FOIA complaint. Only for a DPA complaint.

 

[kkong]

For what reason?

First post. Based in York. Which TOC do you represent?

 

[Mike395]

I've always assumed it's a hangover from the ludicrous m-ticket system where screenshots were indeed not valid. Of course with proper training this impression should not have taken hold for the long term that it has but...



Aha! I was wondering why I struggled to get through the barrier at Enschede station yesterday using my Interrail! Thankfully the ticket office was open and the helpful lady gave me a "KeyCard" (seemingly just a barcode that works the barriers) to allow me to enter and exit the system. She told me to destroy it once I was done to make sure no-one could abuse it to try and circumvent the barriers as apparently it works for half a dozen times or so. But it was very strange not being able to open the barriers as my previous use of an Interrail had been flawless in the Netherlands.

Still not fixed as of about 10 minutes ago - had to check in with a bank card then immediately cancel it, as no staff nor response from the info point.

 

[theenbyperor]

I can't find any way of doing that for an FOIA complaint. Only for a DPA complaint.

Oh, indeed you are right. I thought form GRC3 applied to the FoIA as well as the GDPR. Turns out it does not!

 

[JimmyCrystal]

First post. Based in York. Which TOC do you represent?

None I'm public sector though.

 

[jpl]

Now now, don't tarnish us all with the same brush. Some people have written scanning apps that properly decode UIC barcodes instead of making absolutely batsh*** assumptions

Well actually, "UIC barcodes" are open EU standards nowadays. So it is quite easy to write scanning apps when you have full access to the technical specifications! I've written my own app to decode barcodes used on Finnish train tickets and it was quite simple. Just plug in a library that handles all that barcode scanning stuff for you and then you add your own code to decode the raw data.

For any programmer or tech savvy interested in this, take a look at my github repo: https://github.com/pirttju/python-vr-ticket/tree/main

No encryption keys were harmed during development. This just processes the binary fields.

== Doublepost prevention - post automatically merged: 21 Mar 2026 ==

However, after a 15 month (ish) Freedom of Information Act fight, I've managed recently to settle a court case against the Department for Transport giving me the specs under the FoIA.

This is brilliant work, thank you!