decoding VDV ticket

[lewinpauli]

Hi,

at first of all thank you for the improved readme and python wrapper!!

it was much easier for me to install than 2 years ago

the ticket-decoder output only includes the following attributes, last time I tried it with a UIC ticket it was possible for me to see much more information

I would like to see if my ticket is valid

what type of ticket it is

and if possible first letter of first and lastname

{
"origin": "XXX",
"raw": "XXX",
"records": {
"VDV": {
"certificateAuthority": "4445564456110421",
"signatureIdent": "VDV",
"signatureVersion": "1400"
}
},
"validated": "false"
}

did i missed something? i did all the steps mentioned in the readme for arm macos with setup all

do i have to download the vdv certificated manually? do you maybe know a easy way to do this?

thank you a lot

edit: the cert/VDV_Certificates.ldif has no data

[lewinpauli]

after using this script for downloading the vdv certificate from public ldap the decoding worked

cert/install-vdv-certificates.sh

#!/usr/bin/env bash
# Download VDV certificates from the public LDAP server
source venv/bin/activate

python -c "
import ldap3
server = ldap3.Server('ldaps://ldap-vdv-ion.telesec.de:636', connect_timeout=10)
conn = ldap3.Connection(server, authentication=ldap3.ANONYMOUS, auto_bind=True)
conn.search('o=VDV Kernapplikations GmbH,c=DE', '(objectClass=*)', attributes=['*'])
with open('cert/VDV_Certificates.ldif', 'w') as f:
    for entry in conn.entries:
        f.write(str(entry.entry_to_ldif()) + '\n')
print(f'Done - {len(conn.entries)} entries exported')
"

[user4223]

hi, thanks for the script for certificate download, nice to see. I was looking for a command line tool when I implemented the VDV decoding and could not find one. I only documented some steps partially taken from https://magicalcodewit.ch/38c3-slides/#/32 in source/lib/interpreter/detail/vdv/include/LDIFFileCertificateProvider.h as basic hint. very good idea using a python library and fortunately it is supporting that ldif format as well.

when you want, feel free to create a PR to create this script as you suggested as cert/install-vdv-certificates.sh in parallel to the uic one. otherwise, I would do that and would integrate it into the pipelines as well next I have time for this.

VDV interpreter is not supporting that much fields from the aztec code, because there are not that much sample tickets around for good understanding and the documentation is distributed, partially old and partially confusing to me. anyway, some basic information is there and it was more important to me to have the decryption working than having all fields available in the first step.

thank for finding that out.

[lewinpauli]

Hi,

thanks for the fast response, I can contribute the shell script to the repo, sadly I dont have a lot of C++ knowledge so I would like to leave that part to you.

also I have another question regarding the output of the VDV Ticket and its meaning

{
   "origin": "tickets/SemesterTicket_SS26.pdf_0",
   "raw": "X",
   "records": {
      "VDV": {
         "certificateAuthority": "4445564456110421",
         "dateOfBirth": "2006-00-00T00:40:17",
         "gender": 0,
         "messageIdent": "VDV",
         "messageRaw": "X",
         "messageVersion": "1400",
         "name": "L3n@P3i",
         "price": 0,
         "productNumber": "9996",
         "productOrganisationId": "3000",
         "signatureIdent": "VDV",
         "signatureVersion": "1400",
         "ticketId": "X",
         "ticketOrganisationId": "104",
         "validFrom": "2026-03-01T00:00:01",
         "validTo": "2026-09-01T03:00:00"
      }
   },
   "validated": "true"
}

Just a quick note: the date of birth appears to be incorrect, but I'm not sure if this issue stems from the ticket creator or the ticket decoder.

Do you know how to find out what productNumber, productOrganisationId, ticketId, and possibly ticketOrganisationId mean? Also, is there a list where I can view these IDs and their definitions?

Ultimately, I want to verify whether these tickets are valid 'DeutschlandTickets'.

[lewinpauli]

just created the pull request #44

[lewinpauli]

looks like productOrganisationId 3000 is for the Deutschland Ticket Organisation (do you know if they only do Deutschlandticket?)

and productNumber 9999 is for the regular "Deutschlandticket", 9998 "Jobticket", 9995 schoolkids, 9996 seems to be for university students

I got this info from here:

https://documentation.tapconnect.io/public/specs/vdv-barcode-field-mappings.html#vdv-barcode-field-mappings

"prodProdukt_ID"

if you have further information let me know :)

[user4223]

will check that soon and will check the documents i have from the internet (also at some point in the past) if those number are matching somewhere....
but just in advance, VDV tickets are quite confusing to me, it looks like a zoo of different organizations have tried to make their own stuff and to force it into the same envelope. that was also the reason i stopped to implement further fields, because with my current knowledge, the implementation would become very dirty in the sense of software design or it would explode in complexity.

[user4223]

broken birth date: this looks like a bug in the ticket decoder for this very specific field. I'm decoding from date-time-compact of length of 4 bytes, but Technische_Anforderung_Deutschlandticket_V1.6.pdf (last page) states, the field is 4 bytes for just the date (make absolutely sense to not having a time here). so I will fix that. unfortunately, I have no sample ticket to verify that properly.
would be very happy when you could provide me the 4 bytes at the position for verification, my tickets just have this field filled with 0x00000000.
(you could set a breakpoint at VDVInterpreter.cpp in line 47 and grab 4 bytes with offset 1 from context.data from variable watch view. skip the first byte since it's used for gender field)

productOrganisationId: the document Technische_Anforderung_Deutschlandticket_V1.6.pdf (page 6) states, VDV Deutschlandticket can have the ids 3000 and 35768 and means VDV-ETS.

productNumber: you are right, Technische_Anforderung_Deutschlandticket_V1.6.pdf (page 5 and 6).

(Technische_Anforderung_Deutschlandticket_V1.6.pdf is just the document referenced by page you linked above. you can find it on the internet)

[user4223]

Abbildung_und_Kontrolle_in_NRW_1_5_5.pdf at page 34 states, the date of birth is 4 bytes BCD encoded. So I think I know what to do....

(Abbildung_und_Kontrolle_in_NRW_1_5_5.pdf is also searchable on the internet)

[user4223]

@lewinpauli would be happy when you could check if the changes on branch 43-decoding-vdv-ticket are solving the issue with date of birth decoding for your tickets. thanks in advance

[lewinpauli]

Thanks for the fast fix! I just tested it with 2 valid tickets on branch 43-decoding-vdv-ticket and date of birth decoding looks good date format YYYY-MM-DD