In short we have: S/N -> hash -> default SSID and encryption keya hashed version of the router’s serial number is generated which is then used to derive both, the default SSID and the default encryption key. This is just a high-level overview of the algorithm. More specifically we have (quoted from Kevin’s stkeys tool source code comments): which can be read as:
Take as example: “CP0615JT109 (53)”
Remove the CC and PP values: CP0615109
Convert the “XXX” values to hexadecimal: CP0615313039
Process with SHA-1: 742da831d2b657fa53d347301ec610e1ebf8a3d0
The last 3 bytes are converted to 6 byte string, and appended to the word “SpeedTouch” which becomes the default SSID: SpeedTouchF8A3D0
The first 5 bytes are converted to a 10 byte string which becomes the default WEP/WPA key: 742DA831D2