Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do you tell encryption algorithm used by reading its output? Here is the one I am trying to figure out

Åbd$ý H5ù//°t¬Û)LbÒö©ÂO�…9#x<2L#š÷EaK§èìk¼ïö«��bu]÷ÌL~ž“s�O3¬ø2œ&@é(bÜ„À𶂢‘ÙÙÿ{@ÀÖÃ6æß*=Ž;i<Ò‹aôê-.[0lk
share|improve this question

closed as off-topic by NULLZ, Terry Chia, dr jimbob, Adi, Xander Sep 22 '13 at 14:53

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – NULLZ, Terry Chia, dr jimbob, Adi, Xander
If this question can be reworded to fit the rules in the help center, please edit the question.

Assuming it is a quality encryption, the cipher text should be indistinguishable from random. Any predictable deviation from random is a weakness that can be analyzed.

Therefore it should be impossible to determine what algorithm created a given cipher text with no other information. All the candidates should be producing apparently random output.

share|improve this answer

You can use certain properties of the ciphertext to, with a reasonable degree of confidence, rule out certain algorithms.

For example, if the ciphertext is an odd number of 8-byte (64-bit) blocks, then it is unlikely to be encrypted with an algorithm that processes data in 128-bit blocks such as AES. There is, however, no way to tell e.g. 16 bytes of DES-encrypted data from 16 bytes of AES-encrypted data given only the ciphertext using this method, as the number of ciphertext bytes could fit the block size of either algorithm. If the ciphertext is an unusual number of bytes long (no commonly used multiplier), it's likely encrypted using a stream cipher, but you still have no idea which one. And so on.

However, as pointed out by SecsAndCyber, properly encrypted data is supposed to look like random noise, so that's probably about as close as you can get.

Also, what you have posted in your question isn't really the ciphertext; it is one possible display of the ciphertext binary data. The same binary data will display very differently when interpreted as for example UTF-8, UTF-16, Windows-1252, ISO-8859-6, and so on. Consider the so-called "Bush hid the facts" bug in Notepad (also on Raymond Chen's blog The Old New Thing with some more technical details).

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.