7

I have access to a system which I have been asked to create a data export routine for. However, the address details are encrypted and the original sourcecode/password are lost.

However, I am able to view through the application the decrypted text and via the database view the encrypted text. How can I work out the method of encryption/decryption and find out the password used?

examples of encrypted and plain text:

  • 0"FCDT$&G => CF40 2BA
  • 0"FCDW"#G => CF40 1DD
  • 0"FCDFFGG => CF40

I believe the decrypted strings contain space padding but cannot be sure.

Improve this question
5
  • Do you mean "reverse engineering"?
    – Shurmajee
    Jun 18, 2013 at 10:48
  • What type of encryption are we talking about? Are you sure its encryption and not a hashing function? If the password is long enough it would take hundreds of years to determine the password of a properly encrypted piece of data. If its hashed its not possible because there are an infinite number of character combinations that can generate the same hash.
    – Ramhound
    Jun 18, 2013 at 11:01
  • Mayank - Yes reverse engineer the password...
    – user27362
    Jun 18, 2013 at 11:25
  • Ramhound - It isn't a hash as the data can be decrypted and displayed through the application interface. I have had a look at charactor replacement but failed to find an answer
    – user27362
    Jun 18, 2013 at 11:26
  • "the original source code is lost" - have you tried decompiling the application? Or running it through something like truss? (truss will show you system calls like md5())
    – atk
    Jun 18, 2013 at 12:38

1 Answer 1

Reset to default
27

The generic term for "Working out how to decrypt encrypted string when knowing the plain text" is "known plaintext attack," if you'd like to research the topic more.

Luckily for you, these examples are not exactly encrypted. They're too short for block encryption; and a good stream cipher wouldn't start with the same characters each time. After a bit of examination, it looks like they're xor'ed with a static string which starts with "sdrsdffg"

A bitwise xor with a static string is a cheap and common way to obfuscate a plaintext; but as you can see, it's not the most secure thing in the world.

There's algorithmic ways to figure out the rest of the static string if you have longer ciphertext samples.

Improve this answer
2
  • 1
    Thank you very much for your help - I have now managed to work out the complete (ish) key. I am still having a small issue with fileds that seem to have chars that cause the OLEDB driver to truncate.... If you are interested the key is (so far) sdrsdffgg5dfhejkiyERWWVf37896hh78hui4nf8
    – user27362
    Jun 18, 2013 at 19:59
  • 3
    Have you noticed how the key looks like "random" keystrokes on qwerty layout?
    – domen
    Jun 19, 2013 at 8:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .