Re: [81attendees] What is it at the bottom of restaurant receipts?

The tax guy's worst nightmare - a bunch of techies in town for a conference trying to reverse engineer his enforcement tools. 

bvs

-----Original Message-----
From: 81attendees-bounces@ietf.org [mailto:81attendees-bounces@ietf.org] On Behalf Of Richard Barnes
Sent: Tuesday, August 09, 2011 3:12 PM
To: John R. Levine
Cc: 81attendees@ietf.org
Subject: Re: [81attendees] What is it at the bottom of restaurant receipts?

Not addressing the dingbats, but as far as the barcodes:

The barcodes are apparently in the ISO-standard PDF417 format:
<http://en.wikipedia.org/wiki/PDF417>

It appears you get meaningful data if you do the following:
1. Decode PDF417 as text
2. Base64-decode

Using that technique, I was able to match several fields from
different receipts:
-- MEV ID number (binary)
-- Transaction number ("FACTURE#"/"ADDITION#") (ASCII)
-- Table number (ASCII)
-- Server name (ASCII)
-- TPS amount (binary)
-- TVQ amount (binary)
-- Total amount (binary)

In all of the three cases I looked at, the first intelligible field
(the MEV ID) appears at position 0x40 in the binary.  This would be
consistent with the overall code having the form (digest, data), if
the digest were 512 bits long, say SHA512.  Chopping of the first 0x40
octets and hashing the remainder with SHA-512 did not give the right
hash values.   But then again, you wouldn't expect that if the hash
were an HMAC instead of just a digest; it would make a lot of sense
for the machine to compute the HMAC with a secret key that the tax
department knows.

FWIW,
--Richard

On Tue, Aug 9, 2011 at 1:35 PM, John R. Levine <johnl@iecc.com> wrote:
>> I asked a couple of waiters about them, and they had no idea what the
>> dingbats were for. That tells me that they don't use them for anything. They
>> use the barcodes for everything. That makes me wonder if the dingbats were
>> put there for restaurants that didn't invest in the bar-code system, as some
>> sort of alternative verification. Or maybe they're only used by auditors. Or
>> in expense reimbursement.
>
> I like the hash for audit theory.  It makes it harder to fake a receipt,
> which otherwise would be pretty easy if you're sending in scans of receipts,
> just load up gimp and cut and paste a few digits to adjust the amount.
>
> Regards,
> John Levine, johnl@iecc.com, Primary Perpetrator of "The Internet for
> Dummies",
> Please consider the environment before reading this e-mail. http://jl.ly
> _______________________________________________
> 81attendees mailing list
> 81attendees@ietf.org
> https://www.ietf.org/mailman/listinfo/81attendees
>
_______________________________________________
81attendees mailing list
81attendees@ietf.org
https://www.ietf.org/mailman/listinfo/81attendees