0

I have written a packet sniffer which succesfully intercepts all the packets sent from a server to my computer. The problem is that the packets are encrypted(of course) and i need to decrypt them. An example of a packet captured by my packet sniffer is this:

28-A0-D0-D3-00-23-3F-B5-00-16-79-1C-4F-CB-28-29-61-CC-DF-CF-05-57-43-BF-09-B2-E9-EA-CD-3C-85-FD-9C-41-07.

Where I know that 28-A0 is the source port, D0-D3 is the destination port, 00-23 is the lenght and 3F-B5 is the checksum. So I believe the actual data begins after the 00.

There exists another packet sniffer for this purpose, which not only records the packets but also decodes it in to a readable format, which is what i want. An example of that is:

00 01 10 00 0B 50 64 DA B7 86 00 00 17 80 00 00 80 64 FF 64 00 00

Where the start, 00 01 is the id, and 0B 50, 64-DA and B7 86 are coordinates. And this string is equivalent to the first example i posted, it is recorded from the same place and in the same way, only thing that isnt the same is the time it was recorded, which I do not believe is an issue here.

And i have many other recordings by the already working packet sniffer and my own packet sniffer which are equivalent.

Now here comes the question, is there anyway i can figure out the decrytion key by comparing the strings i have from both parsers?

Or is it only possible by trying to brute force the key?

Or is there some other way that this can be done?

Heres a list of more recordings from my sniffer and the already working one(You can tell them apart by the - between each hexadecimal, where my recordings have the -):

00 01 07 80 64 80 04 00 64 04 64 64

28-A0-D0-D3-00-19-CA-BE-00-0C-51-E9-B6-5E-6F-6A-D5-A1-5F-2A-F8-5B-67-15-CF

00 01 10 00 0B 50 64 DA B7 86 00 00 17 80 00 00 80 64 FF 64 00 00

28-A0-D0-D3-00-23-AA-E8-00-16-79-1E-4D-EC-D7-A0-AE-1B-8C-2A-F3-DE-43-BF-09-B2-E9-EA-CD-3C-85-FD-9C-41-07

00 01 07 80 64 80 04 00 64 04 64 64

28-A0-D0-D3-00-19-F9-F5-00-0C-51-EB-35-37-B3-58-E3-A1-5F-2A-F8-5B-67-15-CF

00 01 10 00 0B 50 64 DA B7 86 00 00 17 80 00 00 80 64 FF 64 00 00

28-A0-D0-D3-00-23-0F-96-00-16-79-10-52-19-30-28-34-9D-70-AA-C7-89-43-BF-09-B2-E9-EA-CD-3C-85-FD-9C-41-07

  • Modern encryption algorithms are not vulnerable to "plaintext attacks" (that's the term, Google it). – Neil Smithline Feb 28 '16 at 18:10
1

What you are describing is called a known plaintext attack, and, from the Wikipedia:

Modern ciphers such as Advanced Encryption Standard are not currently known to be susceptible to known-plaintext attacks.

So no, having many plaintext and ciphertext pairs won't help you decrypt unknown ciphertexts (unless an old algorithm was used to encrypt the text).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.