Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have access to a system which I have been asked to create a data export routine for. However, the address details are encrypted and the original sourcecode/password are lost.

However, I am able to view through the application the decrypted text and via the database view the encrypted text. How can I work out the method of encryption/decryption and find out the password used?

examples of encrypted and plain text:

  • 0"FCDT$&G => CF40 2BA
  • 0"FCDW"#G => CF40 1DD
  • 0"FCDFFGG => CF40

I believe the decrypted strings contain space padding but cannot be sure.

share|improve this question
    
Do you mean "reverse engineering"? –  Shurmajee Jun 18 '13 at 10:48
    
What type of encryption are we talking about? Are you sure its encryption and not a hashing function? If the password is long enough it would take hundreds of years to determine the password of a properly encrypted piece of data. If its hashed its not possible because there are an infinite number of character combinations that can generate the same hash. –  Ramhound Jun 18 '13 at 11:01
    
Mayank - Yes reverse engineer the password... –  user27362 Jun 18 '13 at 11:25
    
Ramhound - It isn't a hash as the data can be decrypted and displayed through the application interface. I have had a look at charactor replacement but failed to find an answer –  user27362 Jun 18 '13 at 11:26
    
"the original source code is lost" - have you tried decompiling the application? Or running it through something like truss? (truss will show you system calls like md5()) –  atk Jun 18 '13 at 12:38

1 Answer 1

up vote 26 down vote accepted

The generic term for "Working out how to decrypt encrypted string when knowing the plain text" is "known plaintext attack," if you'd like to research the topic more.

Luckily for you, these examples are not exactly encrypted. They're too short for block encryption; and a good stream cipher wouldn't start with the same characters each time. After a bit of examination, it looks like they're xor'ed with a static string which starts with "sdrsdffg"

A bitwise xor with a static string is a cheap and common way to obfuscate a plaintext; but as you can see, it's not the most secure thing in the world.

There's algorithmic ways to figure out the rest of the static string if you have longer ciphertext samples.

share|improve this answer
1  
Thank you very much for your help - I have now managed to work out the complete (ish) key. I am still having a small issue with fileds that seem to have chars that cause the OLEDB driver to truncate.... If you are interested the key is (so far) sdrsdffgg5dfhejkiyERWWVf37896hh78hui4nf8 –  user27362 Jun 18 '13 at 19:59
2  
Have you noticed how the key looks like "random" keystrokes on qwerty layout? –  domen Jun 19 '13 at 8:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.