Slides

.extrapad {
    margin-bottom:12px !important;
}
    
.footnotes {
    font-size: 3rem;
    text-align: left
}
    
.footnote-item::marker {
    content: "[" counter(list-item) "] - ";
}

.make-it-pop section.present .raw {
  filter: drop-shadow(.3rem .3rem 3rem black);
}
    
.columns {
  display: grid;
  grid-auto-flow: column;
    }
    
.teeny {
    font-size:.8em
}

</style>

## EUTicket when
### An update on train (and other) ticket shenanigans
#### 551724/maya, CraftByte
##### MRMCD 2026

---

# Who are we?

## 551724/maya
    
- formerly employed in cybersecurity 
- now does ✨ *technology* ✨ 
- one of those goshdarned train nerds
- frequently observable at these events
    
</div>

<div>

## CraftByte
    
- IT consulting by day
- (cyber)security research by night
- seems to always have an active Interrail
    
</div>
</div>

---

# First, a few updates

---

## The UK Barcodes FoI case

- Q and the railways settled, gaining access to the specification
- The court agreed with the railways that public keys are not FoI-able
- https://magicalcodewit.ch/rsp-specs/ for all your spec needs
- Since then, a new version came out
    - unlobito successfully got the new version via a normal FoI process, Excel sheets pending ([link](https://www.whatdotheyknow.com/request/rsps3001_version_03_00_ticket_sp))

---

## The Slovenian FoI case

- Expert witness used ChatGPT...
- Had an oral hearing in January
- Ordered SŽ to deliver more documents to the expert
- Final expert report in August 2026, saying there is no risk in releasing the specification
- Waiting on ICO decision letter and (hopefully) the specs and lookup tables

---

![](chatgpt.png)

---

## DTVG Updates

- All UIC format Deutschlandtickets now have to be issued centrally by the DTVG UIC Security Portal
- There will soon be a allowlist instead of blocklist for ticket IDs
- Central scan checking API with logs is planned to be made, also allowing detecting barcode sharing (and as such allowing tracking people 😞)

---

![](vetter.png)

---

## DOSIPAS implementation updates

- Interrail started using the DOSIPAS envelope on May 5 2026 (original plan March 1 2026)
- This caused problems at some railways that even after multiple warnings weren't prepared
- Currently the barcodes are still static and don't include Level 2 signing by the phone
- They also implemented screenshot prevention as a bonus...

---

## Digital BC100

- Since July 2026, all BC100 are issued as digital only
- Plan to use dynamic DOSIPAS for the on-phone version
- Currently, it's a static barcode
- Getting it as a PDF with a static barcode makes it impossible to get the digital version
    - but the PDF being shown on a screen is valid ¯\\\_(ツ)_/¯
- We made a public library: [TheEnbyperor/uic-dosipas-lib](https://github.com/TheEnbyperor/uic-dosipas-lib)

---

# Solidly in our sidequest era

---

## From Feb. 2025 to Oct. 2025: UIC FCB-UG

- Presented Zügli in January 2025 after being introduced by Clemens from DB
- Really joined after FOSDEM 2025, when we met Kurt in person  
- The main objective was to design and roll out FCB (more on that later) 
- The UG isn't dead, just dormant  <br/><br/>
- We've also been regular guests at the UIC Ticket Security Group meetings 
    - Presented projects like UIC-CA (currently in development), UIC-STAR (TVM certificates)

<aside class="notes">
STAR: Short-Term; Automatically Renewed
TVM: Ticket vending machines.
</aside>

---

## From Oct. 2025 to Dec. 2025: UIC RTDv4/MMTD

- RTDv4 was an already existing project, started in 2024 
- Until now, all ASN.1 was just representations of rail documents 
    - NRT, IRT, RPT, GRT, BOA, ... 
- MMTD: 
    - was a natural progression from RTD 
    - had the internal codename of RTDv4 
    - completely redid the data structure 
    - now included travel segments + conditions

---

## And since Jan. 2026: BT4PT

- Project under CEN/CENELEC TC 278/WG 3 
- Paid by the EISMEA 
- Objective is to design a multi-modal public transport ticket functioning across Europe 
- EU-Ticket then! (At least the barcode part)

<aside class="notes">
  EISMEA: European Innovation Council and SMEs Executive Agency
</aside>

---

# Iterative design principles are being followed

---

## So WTF is an FCB?
### Surprise history lesson

---

## It all started at the UIC

- UIC standard 918-2 prescribed ticket layout
- Standardized international ticket format

![](rtd2.png)

---

## SSBv1
- First barcodes were based on the magstripe format
- Didn't even use a hash but CRC32
- Still used today by the Finnish VR (sans-CRC32)
- See ERA TAP TSI TD B.6 Appendix C.1 for a wild ride

---

## SSBv2 and v3

- Implemented all the basic ticket types (NRT, IRT, GRT and RPT)
- Allowed custom formats by issuers (type 21-30)
- Used DSA for signatures
- Used today by several railways (SNCB, SNCF TER TVMs, SŽ, NS Keycards, Thalys/Eurostar Red)
    - NS Keycards and SŽ are the only known cases of custom type use

---

## The era of the TLB

- Apparently the SSB was not flexible enough
- "What if we just copy what we print on the ticket?"
- Introduced a container + data structure (`#UT` header anyone?)
- Still only DSA
- Allowed custom extensions (like `0080VU`, `1186MR`, `118199`, `1154UT`, ...)

---

---

## The French ELB

- SNCF had airport-style PECTAB printers
- They couldn't do binary data or Aztec
- They made their own fixed-width standard
- No signature (Just like real airlines!)
- Also adopted by Eurostar Chunnel services (but with signing in a cursed hex encoding)

---

## The FCB arrives

- TLBs made automatic parsing of validity hard
    - 0 or 1-indexed fields
    - adding headers
    - lots of operators made non-interoperable machine readable extensions
- "What if we just make the fields machine readable in a normal structure?"
- FCB v1 is born
- It digitizes the various ticket types (NRT, IRT, ...) as ASN.1 structures and uses UPER encoding (make it as small as possible)
- Still stuck in railway world (no non-standard ticket types)

---

## DOSIPAS is born

- DSA was starting to become old
- We are also using this fancy new UPER encoding
- What if we made the entire envelope just ASN.1 all the way down
- What if we also allowed dynamic barcodes
- And as a bonus, allow specifying the signature algorithm with an OID

---

![](types.png)

---

![](doctypes.png)

---

## How was the MMTD any different?

- Well... multimodality!
    - This means trains, trams and busses...
    - ... and who knows, maybe an e-scooter???
- Tickets can:  
    - contain multiple travelers
    - contain multiple forms of transport
    - contain multiple transport segments by understanding zones better

---

## How was the MMTD any different?

- The bigger changes?
    - Certificate constrained authority 
    - Extension governance
- But also other fun shenanigans: 
    - We abolished gender! 
    - Bicycles and pets are now passengers! 
    - An e-scooter has to explicitly be declared as not being a convertible.

---

## And what has BT4PT brought to the table?

- Standardized barcode format
- But really it is just a small part of the big picture:
    - There are other CEN/CENELEC groups working on retail APIs, data exchange formats, etc.

---

### Project description & scope

- Develop a European Standard (EN) for barcode ticketing that enables
  seamless multimodal and multi-operator travel across Europe
    - Somewhat intended to replace ERA specs on the rail side 
    - Must be a modular, secure barcode structure usable on smartphones and printed tickets 
    - Must support various transport modes 
    - Must be fully backwards compatible with existing systems.

---

### Stakeholders

- CEN/TC 278
- The European Commission 
- Subsequently: all PT operators in the EU 
- Therefore: all users of PT in the EU

---

### Deliverables

- CEN/TS: a multimodal barcode specification
    - Description of elements supporting door to door travel 
    - Description of related security mechanisms 
- CEN/TR: governance and maintenance guidelines 
    - Technical Artifacts 
    - Process definitions for e.g. registration and key management

---

### Timeline (suspected but undated)

<ul>
  <li>Step 0: Assemble a team of experts</li>
  <li class="fragment" data-fragment-index="1">Step 1: Define and publish a CEN Technical Specification (CEN/TS)</li>
  <li class="fragment" data-fragment-index="2">Step 2: Develop and publish a CEN Technical Report (CEN/TR)</li>
  <li class="fragment" data-fragment-index="3">Step 3: ???</li>
  <li class="fragment" data-fragment-index="4">Step 4: <em>screeching EU noises</em></li>
  <li class="fragment" data-fragment-index="5">Step 5: Adopt the CEN/TS (or not)</li>
  <li class="fragment" data-fragment-index="6">Step 6: Set a deadline for all member states to implement the TS</li>
  <li class="fragment" data-fragment-index="7">Step 7: Probably extend the deadline a few times for <em>reasons</em></li>
  <li class="fragment" data-fragment-index="8">Step 8: EUTicket then! (well, theoretically)</li>
</ul>

---

### Timeline (unsuspected but dated)

- T-2M: Call for experts
- T+4M: Definition of deliverable scope
- T+11M: Working draft!
- T+12M: Interim report to EC
- T+16M: Review of comments of from CEN/TC 278 review and EC consultation
- T+21M: Finalization of CEN/TR + CEN/TS
- T+23M: Publication of CEN/TR + CEN/TS
- T+24M: Final report the EC + Dissemination
- T+(24+n)M: EUTicket then! (once more, theoretically)

---

### Participants

- A team of experts! including:
    - A portion of the UIC MMTD group
    - Representatives of national and regional public transport undertakings
    - The usual suspects

---

### Internal workstream split

- We broke this down into smaller "expertise" teams:
    - Team 1: Multimodal Ticketing in Public Transport
    - Team 2: Multimodal Ticketing in Rail
    - Team 3: ASN.1 Data Encoding
    - Team 4: Security
- Each team had around 7 members at inception (with overlap)
- Members of PT operators interested in participating were/are warmly welcomed

---

### Post-delivery

- Review process by 2028
- If accepted, this would begin roll-out in 2030 and full adoption sometime between 2031-2035 
- EUTicket then! (for real, probably!)

---

### Sneak peak time

</div>
<div>
<img src="sample2.png" style="width: 95%; height: auto;" />
</div>
</div>

---

## Learn more about BT4PT

https://bt4pt.eu/

https://github.com/bt4pt

---

## Acknowledgements

### Many thanks to all that helped along the way

Q Misell

The BT4PT team

Kurt (UIC/Flemish Parliament)

Our friends in ÖV;<br/>
Daniel Strobel-Folk (ÖBB), Eric Burgstahler (SNCF) and Manuel Beck (DB)

---

## Thank you! Questions?

## 551724/maya
    
Email: maya@atomicmaya.me

Fedi: [@maya@catgirl.global](https://catgirl.global/@maya)

Blog: [atomicmaya.me](https://atomicmaya.me)
    
</div>

<div>

## CraftByte
    
Email: hello@craftbyte.net

Fedi: [@anze@treehouse.systems](https://social.treehouse.systems/@anze)

Blog: [craftbyte.blog](https://craftbyte.blog)
    
</div>
</div>