Tickets are found in many encrypted files used by the Wii (e.g. WAD Files or Wiidiscs). They contain the encrypted AES key, the Title ID of the data and are followed by a certificate chain. So far I have only seen tickets with RSA-2048 signatures. (Discs will only work with those signatures because the size of partition ticket is always 0x2a4)
|0x000||4||Signature type (always 0x10001 for RSA-2048 (to be confirmed))|
|0x005||256||Signature by a certificate's key (everything after this field is covered by this signature)|
|0x1bf||16||Encrypted Title key|
|0x1dc||8||Title ID / Initialization Vector (IV) used for AES-CBC encryption|
|0x222||32||Always 0xFF (?)|
To get the title key decrypt the 16 bytes at offset 0x1dc using the master key and the Title ID as IV.