Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have a requirement to identify if the data is encrypted or not. The data is a field that will be in Json format. I found another question hear at
How to identify Encryption algorithm for data coming in field/attribute values of an xml
But this for identifying the kind of encryption technique and its from 2014 don't know if that is still valid.
Another thing I just want make sure that the field is encrypted don't want to identify the encryption technique.
Depending on what types of data you're expecting, you could try looking at the entropy (randomness) of the data. Properly encrypted data should be pretty much indistinguishable from random noise, and will have a much higher entropy than any kind of structured data.
Shannon entropy is a common way of determining the level of "randomness" of strings - you can find plenty of example code in various languages.
There are some other kinds of data that will also have very high entropy (images, compressed data, etc), but you can probably check for these looking at the signatures/magic bytes.
Not foolproof, but might give you a good starting point.
Unless you are in the business of performing penetration test/Security auditing, then you will run a set of hash decoding tools to see whether the data is encoded. Dictionary check is the first phase, which secondary phase is running hash decoder to decode popular hash such as Base64, ROT, 7bit encoding ; or using simple XOR/NOR bit(from +1 bits and up) switching obfuscation.
Then you need to run a filter to check the data format and hope it will match some sort of file pattern.
However, it is impossible to check what the exact encryption mechanism for file that encrypt using strong PKI.
You could perfom some tests with different data to check for example if the string obtained has always the same length or not. If it is always the same that data is probably being hashed and not encrypted (i.e.: AES). Another possibility is that is just encoded for example in Base64, Hex, etc (here the length will not be fixed either). For these encoding checks I like this web that provides several encoders at the same time so it eases testing: http://www.asciitohex.com/
Even though you are not interested in the type of encryption, there is a useful tool that may help you to identify the hash algorithm (if this applies!) used and thus determine that it is encrpyted (hashed in this case): http://psypanda.github.io/hashID/
Simply run it against your code and it will check for patterns, lenght, special characters and other marks that may give a hint about the type of hash algorith used.
