Train ticket barcodes in Spain

General Observation

There is a Renfe-specific code (older and smaller), which is also found embedded in the newer common code. It has basic trip data and no security features.
There is a newer, bigger code consisting of a common header, a vendor specific part (which contains the above for Renfe), and a signature.

QR format, 516 bytes.

Bytes	Format	Meaning	Notes
0-13	string	ticket number
13-18	string	UIC issuer code	0-prefixed to 5 digits
18-23	string	train number	for single leg trips, unclear for multi-leg trips
23-38	dd/MM/yyyyhh:mm	departure time
38-45	UIC station code	departure station	using '00' as the country prefix, which fails for international tickets...
45-52	UIC station code	arrival station
52-55	string	coach number	for singe leg trips, for multi-leg seems to be the last leg
55-58	string	seat number
58-416		vendor specific	'0' for every unused byte
416-480	base64	ASN.1 PER RSA signature
480-516	string	constant '~' in all characters

Vendor specific parts:

not entirely decoded
for Renfe: 100-156 uses the below format from older/smaller Renfe barcodes
for Ouigo ES: 102-314 uses the high-entropy base64 content also seen in French Ouigo tickets on its own
there are minor other bits of non-0 data in those section as well

DataMatrix or QR in newer tickets, 56 bytes (sometimes slightly shorter, sometimes with extra spaces at the end).

Bytes	Format	Meaning	Notes
0-13	string	ticket number
13-18	UIC station code	departure station	without the '71' country code
18-23	UIC station code	arrival station
23-29	ddMMyy	departure date
29-34	string	train number	unclear for multi-leg trips
34-37	string	coach number	for singe leg trips, for multi-leg seems to be the last leg?
37-40	string	seat number
40-43	number	?
43-49	alpha-numeric	"Localizador"
49-51	fixed	constant ".."	optional (present when CombinadoCercanias is set)
51-56	alpha-numeric	"CombinadoCercanias"	optional