[kalosbg]

Hello, 

I would like to share the process of decryption of the ISN from CAS3+ dump when we have a working key.

• Read the working key ID with Hitag2 compatible reader (1)
  
• Find the key number in the CAS3+ dump (2)
  
• Find the Crypto/ISK Low and High (3)
  
• Enter the Crypto/ISK Low and High to the Hitag2 compatible reader and read all key data (4)
  
• Copy PSW string (5) to some HEX calculator (6)
  
• Copy the "Pass" (7) from the CAS3+ dump to the HEX calculator (8)
  
• Calculate the XOR value (9)
  
• Do a "byte flip" (e.g. AA BB CC > CC BB AA) of the XOR value
  
• In a HEX calculator paste 6 times the byte flipped XOR value and remove the last 4 characters (10)
  
• Copy the encrypted ISN from the CAS3+ dump (11 )and paste it the HEX calc (12).
  
• The result of the XOR is the decrypted ISN.