Author Topic: Identifying encryption algorithm  (Read 475 times)

0 Members and 1 Guest are viewing this topic.

Offline jap@n4

  • /dev/null
  • *
  • Posts: 6
  • Cookies: 0
    • View Profile
Identifying encryption algorithm
« on: December 01, 2014, 10:42:51 pm »
Hi, is there a way to know the format of a encrypted string?
I tried Hash ID, wich is a python script that found on the internet but it didn't recognize the script, i think it's an AES from mysql but not sure the string "Lg81W5t5TDd61jPx8N8" will have to match "10" | "12" | "19"
Any tip to know?
« Last Edit: December 02, 2014, 06:29:00 am by ande »

Offline d4rkcat

  • Knight
  • **
  • Posts: 287
  • Cookies: 115
  • He who controls the past controls the future. He who controls the present controls the past.
    • View Profile
    • Scripts
Re: How to know encryption format?
« Reply #1 on: December 02, 2014, 02:56:19 am »
First off, there should be no way to differentiate well encrypted ciphertext from random.
Secondly, this is not a question about scripting languages and you have posted this in the wrong section.
HashIdentifier.py is a tool to identify the type of cryptographic hash function used to make a hash, not ciphertext.
 
Jabber (OTR required): thed4rkcat@einfachjabber.de    Email (PGP required): thed4rkcat@yandex.com    PGP Key: here and here     Blog

<sofldan> not asking for anyone to hold my hand uber space shuttle door gunner guy.


Offline madf0x

  • Knight
  • **
  • Posts: 172
  • Cookies: 50
    • View Profile
Re: How to know encryption format?
« Reply #2 on: December 02, 2014, 03:33:07 am »
Your best bet is to look for clues elsewhere. Remember with encryption, the weakest link is rarely the algorithm, but rather the implementation.

Likely theres some sort of giveaway elsewhere, if you can generate more encrypted strings, and more so know the plaintext, can give you clues. If its always the same string for the same input, then likely its either a hash, or an unsalted/no-iv form of encryption(though even so it may simply use something like gtime() or equiv and can be guessed). Hashes can often be broken up into hexadecimal portions. Your string is mixed ascii so likely not a typical hash(unless encoded, but unlikely).

If you can control the input and it doesn't change, then try slight variations of the input. if only small portions of the ciphertext change then theres the chance its using a weak key based block encryption, or worse. Attacking this angle is typically called a 'known plaintext attack'  and has cropped up in tons of implementations.

Overall it's hard to say without knowing more about the situation.

Offline ande

  • Owner
  • Titan
  • *
  • Posts: 2664
  • Cookies: 256
    • View Profile
Re: How to know encryption format?
« Reply #3 on: December 02, 2014, 06:28:11 am »
Question has pretty much been covered by d4rkcat and madf0x but ill post my two cents as well.

I suggest you get your terms right. Cipher, ciphertext, plaintext, hash, encoding and so on. I changed your thread subject from "How to know encryption format?" to "Identifying encryption algorithm". Another good one would be "identifying cipher from ciphertext" or something similar. A good subject is of number one importance if you want your questions answered on a forum.
« Last Edit: December 02, 2014, 06:29:19 am by ande »
if($statement) { unless(!$statement) { // Very sure } }
https://evilzone.org/?hack=true

Offline Psycho_Coder

  • Knight
  • **
  • Posts: 166
  • Cookies: 84
  • Programmer, Forensic Analyst
    • View Profile
    • Code Hackers Blog
Re: Identifying encryption algorithm
« Reply #4 on: December 02, 2014, 01:38:30 pm »
Tutorial thread :-

http://www.rawcoders.com/Thread-Learning-Cryptography-Identify-Different-types-of-Hashes

Here's a tool I wrote to identify hashes (Project Hosted on Github):-

http://www.rawcoders.com/Thread-rC-Official-Hash-Algorithm-Identifier

or

https://evilzone.org/scripting-languages/%28python%29-hash-algorithm-identifier-v3-3/msg77217/#msg77217

Normally hashes formats can be identified but for encryptions nothing can be said for sure since they might have been encrypted to any level and with different algorithms multiple times and so its a complete uncertainty what encryption you have. 
"Don't do anything by half. If you love someone, love them with all your soul. When you hate someone, hate them until it hurts."--- Henry Rollins