Lets take an example. Plain text: HJOU UT Cipher text: IKPV VU

Above one just a simple substitution technique. Data is random text. If attackers substitute -1 then they will get GINT TS. Otherwise if attackers do +1 then they will get HJOU UT which is the actual data.

Now, how will they decide with one is the actual data? It is just example. In real life, how data being extracted using brute force?

2 Answers 2


Entropy of the properly decrypted file is lower than the entropy of the improperly decoded file.

For example, properly decoded JPG file contains header information which may contain string ABCDEF which is low entropy. Also decoded email will contain header with strings (7 bit data is also low entropy).

Entropy can be measured by compressing result. Only header would be sufficient. So compressed header should be smaller than the result, which means the brute-force was successful, otherwise, the compressed result is bigger than original, which means bruteforce was unsuccessful.

Improperly decrypted file is completely random stream of bytes. Compression of it makes it bigger, but if it's correctly decrypted, should be smaller.

To make brute force faster, one can devise some quick entropy level check, however it's not feasible as of now. Currently the minimum encryption standard is AES-128 which is not bruteforcable, and AES-256 is going mainstream which has number of possibilities close to the number of atoms is observable universe. Something like some magnitudes lower than that, but very close.

  • Thanks Aria. If possible please share some book name/stuff regarding this. I want learn about this. Thanks for you time.
    – again
    Jan 29, 2018 at 4:13

Now, how will they decide with one is the actual data?

The one which matches the attackers expectation. For example, if the attacker expects a text message as result then any garbage will be thrown away and only the result will be kept which looks like readable text. And if the attacker expects some office document, image, video ... he can do similar checks since these file formats have a typical structure.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.