I am trying to find what encryption algorithm has been used in this code

original text: 11011698
encrypted text/cipher:  uIC4hZFECIAYMi%20FWxamjQ==

original text:11008569
encrypted text/cipher:  ct2bHNmgahZYKTbh/8LQRw==

Can anybody help?

closed as too localized by dr jimbob, AviD Apr 21 '13 at 10:18

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Hi toukir, welcome to Information Security. Please take a look at the FAQ, and How to Ask - This question is not really a good fit for our site. If you haven't been on any SE sites before, I would recommend checking out the About page, it explains how the site works. – AviD Apr 21 '13 at 10:19

The encoding of the ciphertext seems to be base64. Base64 encoding often ends with a double equal sign for padding and uses characters from [A-Za-z0-9] as well as two extra character, typically + and /, though variants exist. Both appear to be 16 bytes (from the padding); but there seems to be a problem with the first one; as it has a % character which is not commonly used in base64. Possibly it is a URL-encoded space as %20 is a space. I'm guessing the 62nd symbol (commonly a +) may have been converted to a %20. Then it would base64-decode to the bytes: b8 80 b8 85 91 44 08 80 18 32 2f 85 5b 16 a6 8d

The second one base64-decodes to 16 bytes (128 bits):

72 dd 9b 1c d9 a0 6a 16 58 29 36 e1 ff c2 d0 47

There's very little extra info to go from, without knowing the secret key; but its likely a 128-bit cipher like AES-128.

A secure cryptographic function should be indistinguishable to any attacker in polynomial time from a purely random function from the perspective of someone who does not have the key. Knowing the plaintext and ciphertext for a handful of values gives no information about the cipher used (other than the length of the ciphertext) or key, unless the underlying cipher is very flawed.

Also, if you are mistaken, they may have used a 128-bit hash function instead of encryption; e.g., md5. However, this doesn't seem to be the case. (E.g., 72dd9b1cd9a06a16582936e1ffc2d047 doesn't seem to be in any md5 reverse lookups and a few forward tests of your string doesn't seem to work either.


The first encoded character uIC4hZFECIAYMi%20FWxamjQ== is the concatenation of two words separated by a space. The space is indicated by %20 in the base64 encoded text. Hex of the first word is: b8 80 b8 85 91 44 08 80 18 32 (in plaintext it is two non ASCII characters followed by D2). The second part of the encoded text FWxamjQ== is the base64 encoding of the ASCII word lZ4.

Not the answer you're looking for? Browse other questions tagged or ask your own question.