Nptitle.dat

nptitle.dat is a file stored in some (every?) PKG files. It is always ? bytes. It is related to the NP Title Secret, for NpScore (scoreRanking), NpTss (tss), NpTus (tus), each one having its own passphrase. The NP Title Secret and nptitle.dat file are secret information for verifying an NP Title ID owner.

Cryptography

nptitle.dat is usually encrypted in PKG files with keyset 3. This seems to imply that in this case nptitle.dat can always be decrypted because the PKG RSA-2048 private keyset 3 is known.

Structure

• 0, 4 bytes, "NPTD", Magic. Probably standing for NP Title Data
• 4, 4 bytes, 00 00 00 80, Data Size. Size of data after the 0x20-byte header.
• 8, 8 bytes, zeroed, Reserved. Padding.
• 0x10, 0xC bytes, "CUSA03206_00", NP Title ID
• 0x1C, 4 bytes, zeroed, Reserved. Padding.
• 0x20, 0x20 bytes, AES-256 key to decrypt the NP passphrase
• 0x40, 0x20 bytes, ?AES-256 key to decrypt another NP passphrase?
• 0x60, 0x20 bytes, ?AES-256 key to decrypt another NP passphrase?
• 0x80, 0x20 bytes, ?AES-256 key to decrypt another NP passphrase?

Usage

"The NP Title Secret and nptitle.dat file are secret information for verifying an NP Title ID owner. Take sufficient precautions so that they are not leaked to third parties. For example, ensure that these are removed when disclosing the source code/application package for support purposes on the PlayStation®4 Developer Network."

For NP Title communication, Sony API returns an encrypted passphrase and IV. There is an AES-256 256-bit key in nptitle.bat at offset 32 (0x20). It is used to decrypt this passphrase. The result is a 128-byte HMAC-SHA1 key used to sign data.

One can get this passphrase for any game whose package file is available, since nptitle.dat can be unpacked and decrypted with the known private keyset 3. The only hard part is communicating to Sony API to get the encrypted passphrase, but idc found a (still secret?) workaround in March 2020.