1

I have an encrypted hex string:

AA969CF9657F77C597C8EAFF1594D59374E4977F

which I know corresponds to the plaintext:

http://jogos.meo.pt/

I want to know if it is possible to find out what encryption algorithm might have been used? Anybody could help me please?

  • 2
    As I suggested on crypto.SE, if you want anyone to be able to solve this, you should try to give more samples than just one. It looks like this might be a very simple byte-wise additive Vigenère-type cipher, but it's hard to tell for sure from just a single short sample. – Ilmari Karonen Dec 27 '13 at 14:29
  • 1
    40 characters? SHA1 perhaps? It's not a plain one (tried echo -n 'http://jogos.meo.pt/'|sha1sum - and echo 'http://jogos.meo.pt/'|sha1sum -) but could be salted. Too little info to tell. And aside from that probably off-topic in the sense that without associating this to a piece of software this is hardly reverse (code) engineering. – 0xC0000022L Dec 27 '13 at 14:31
  • i have more samples like "93AA94" correspond to "nao". – user36384 Dec 27 '13 at 14:33
  • "9AA696" correspond to "sim" – user36384 Dec 27 '13 at 14:34
  • "92A094CE94A397F674FAE2" correspond to "meojogos.pt" – user36384 Dec 27 '13 at 14:48
4

You'll likely need to reverse engineer the code that does the decryption. Tools such as FindCrypt and the Krypto Analyzer ("KANAL") plugin for PEiD may help you with a starting point.

3

Partly repeating what I already wrote in my comment at crypto.SE

The one thing you can learn from that data is that the known ciphertext (20 bytes in hex-representation)

AA969CF9657F77C597C8EAFF1594D59374E4977F

can be XORed with the (let's just call it) OTP

C2E2E8895F5058AFF8AF858C3BF9B0FC5A94E350

to get the hex-encoded version of the known plaintext http://jogos.meo.pt/ which is

687474703A2F2F6A6F676F732E6D656F2E70742F

As you don't know anything else, it's already hard to tell if an algorithm or an OTP was used. Is C2E2E8895F5058AFF8AF858C3BF9B0FC5A94E350 an OTP or the result of a PRNG, a hash, or something else? You can't tell by simply looking at this rather minimal piece of information.

Therefore, the only chance you have is to collect enough samples that will allow you to recognize a specific pattern. Yet, chances are that that pattern boils down to being a random OTP string of who-knows-what length. Personally, I can't “feel” any patterns by just looking at it… but you could check the obvious ones: keyed Vignere over a 256 byte base, etc.

  • @user36384: apologies. I think the markdown used on this site removes the prefix. Use backticks `xxx` to indicate literal text. – usr2564301 Dec 27 '13 at 22:41
  • ok i´m sorry. I´m gonna correct "AA969CF9657F77FEA9F4D3F5CA96E17099E27F" correspond to "xxxxxxxmeojogos.pt/" xxxxxxx correspond to http:// – user36384 Dec 27 '13 at 22:52
1

Your ciphertext consists of 40 hexadecimal digits, which encode 20 bytes. Your plaintext is 20 ASCII characters long. The obvious assumption, therefore, is that the ciphertext has been calculated by taking the ASCII code of each plaintext character and either adding (modulo 256) or XORing a corresponding key byte with it.

Furthermore, the bytes in your ciphertext are not uniformly distributed over the range from 0 to 255, suggesting that what you have is not a secure stream cipher but something weaker.

Indeed, taking each byte of the ciphertext and subtracting the corresponding byte of plaintext yields:

42 22 28 89 2b 50 48 5b 28 61 7b 8c e7 27 70 24 46 74 23 50

or, in ASCII (using \xHH for characters outside the valid ASCII range):

B"(\x89+PH[(a{\x8C\xE7'p$Ft#P

Those extra characters might belong to some 8-bit extension of ASCII, such as Windows-1252, which would make the "keystream" look like this:

B"(‰+PH[(a{Œç'p$Ft#P

This looks plausibly like something someone might produce simply by mashing "random" keys on a non-English keyboard, so it's at least plausible that the "encryption" mightsimply consist of adding this key string to the plaintext byte by byte. However, without more samples, there's no real way to confirm this.

  • "526FB829999FABF1A3F6DEFFDA4CD39BA93CA79F9A98B82D92A794F6BB2AFCC0F2AED9BF4DE2AB929890A0CBAA95BB2297F9E2C1F2BA319BA3E7977CAA9696F3" correspond to "C:\Programas\SiteKiosk\Skins\Public\Startpages\Portal\Start.html" – user36384 Dec 27 '13 at 14:54
  • My objective is to find out what is this "7E6E7E1D63". – user36384 Dec 27 '13 at 16:21
  • Are you sure about the "Startpages"? I can't decode the cipher entirely (yet), but just looking at the message length and the high two bits of each byte suggests that it should be replaced by something 13 characters long (rather than 10), and possibly with something other than lowercase letters in the middle. – Ilmari Karonen Dec 27 '13 at 19:26
  • i´m sorry, but you can explain to me how you conclude that? – user36384 Dec 27 '13 at 20:31
  • another sample "AA969CF9657F77FEA9F4D3F5CA96E17099E27FA690A294FD779DA9FC74FAE215CE95DBAD8509A597929A" correspond to "xxxxxxxmeojogos.pt/jogos.meo.pt/index.html" xxxxxxx equal to http:// – user36384 Dec 27 '13 at 22:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.