-3

I have intercepted some data for which i don't know which algorithm has been used to encrypt this data, this data has been for sure encrypted before transmitting, to decrypt the data i should certainly must find the algorithm being used as well key if required.

Example of data;

6E190A5AA10FCB1558433669884F9B07040EFC06 > 20 bytes encrypted

156785AF544E7D33C14B8F7AA5EBC714D97065C80122BB15BB522A2F18AA60303DAF1303A38CBAA9D0EB829720CD131699 > 49 bytes encrypted

If I use common algorithm 3DES/AES/RSA, then block size of data is not enough to fulfill the condition for these common algorithms, because these common algorithm requires data to be at least 16 bytes or multiple of 16 bytes. Except RSA, which, I am not sure but, in RSA case 20 bytes data encrypt and decrypt will also require a 20 bytes RSA key, which makes no sense.

I study hash algorithms keyless but its one way encrypt so its not possible, possibility is keyed algorithm has been used to encrypt and decrypt the data on both side, it is also possible that if data encrypted 2 times/rounds using same algo the size becomes 49, most of time it appears 20 bytes blocks.

More ever the data comes random in consecutive pockets which also proves the if common algorithm in use then CBC mode has been used to randomize the repeated plain text encrypted packets, (the plain text transmission often repeats)

I will repeat my question: which algorithm can possibly encrypt and decrypt data of block size 20 bytes and 49 bytes, or may be any size?

  • The simplest explanation would be that your interception is incomplete... – Matthew Feb 21 '16 at 18:11
  • well this encrypted data has some bytes as header and in tail which are plain and always comes same not encrypted ... i have captured a lot of packets for comparison these are the only encrypted data blocks of size 20 bytes and some time size 49. – OScam Feb 21 '16 at 18:31
3

Any stream cipher would seem to fit the description - by definition, they work on variable length streams of data, which can be any length. In this case, it could be that there are two distinct types of value being transmitted, one of 20 bytes long, and one of 49 bytes long.

It's not really possible to be sure of a specific algorithm though. Most algorithms aim for random looking data, as a basic security principle, and random data always looks, well, random!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.