-3

I have a little problem with encryption. I have this cipher text "AA969CF9657F77C597C8EAFF1594D59374E4977F" and i know that correspond to "http://jogos.meo.pt/". I have another samples, but i can´t find any analogy or logic, with the intuit to discover the algorithm of encryption. Can anybody help me??I really need this...!

  • another sample: cipher-text "AA969CF9657F77FEA9F4D3F5CA96E17099E27F" plan-text "xxxx://meojogos.pt/" xxxx equal to http – user36384 Dec 31 '13 at 0:16
  • another one: cipher-text "93AA94" plan-text "nao" – user36384 Dec 31 '13 at 0:21
  • Smells like a SHA-1 hash to me. – gowenfawr Dec 31 '13 at 1:19
  • why you conclude that? – user36384 Dec 31 '13 at 8:34
  • Definitely not SHA-1, or any other proper hash. The 3rd one is not the right length, and the first two are not different enough. I would guess that this is NOT hard encryption, but some simple substitution / rotation. Probably easy enough to crack with basic cryptanalysis. – AviD Dec 31 '13 at 9:01
1

From the samples you gave, it doesn't look like very sophisticated encryption. What you're trying to do is a Known-plaintext attack on this system.

The known-plaintext attack (KPA) is an attack model for cryptanalysis where the attacker has samples of both the plaintext (called a crib), and its encrypted version (ciphertext). These can be used to reveal further secret information such as secret keys and code books. Wikipedia entry on Known-plaintext Attacks

For example, the first h appears to be consistently encrypted to AA. The last example two letters n and o have sequential encryptions: 93 and 94. You may be able to find other commonalities.

The odd part of this is that you have access to a lot of plain-text and cipher-text. This seems to indicate that you can encrypt what you want, or a chosen-plaintext attack. These are usually more informative than known-plaintext.

  • Thanks for your reply. I don´t understand why 'AA' in the first position correspond to 'h' always, but in second position correspond to 'a'. I need to understand the algorithm, because i want to decrypt this hex '7E6E7E1D63' and i do not have enough samples to make analogy. – user36384 Dec 31 '13 at 8:30
  • i can had other sample like this one '92A094CE94A397F674FAE2' correspond to 'meojogos.pt' – user36384 Dec 31 '13 at 8:31
1

Look at the ciphertexts you have, and look for similarities. If you can find similarities, it may be a weak cipher. For example,

  • your ciphertext is always twice as long as your plaintext.
  • look at the characters in the ciphertext. They're hexadecimal (0-F). Two hexadecimal characters can represent one byte - one character in a computer. This matches with my previous point very nicely - each character is being encoded as a hexidecimal value
  • wherever there's an 'h' in your plaintext, there's an 'AA' in your ciphertext (well, at twice the distance into the ciphertext - if 'h' is at index 5, 'AA' is at index 10).
  • the '/' character always seems to encode as 7F, regardless of index in the string

This implies a simple substitution cipher with output hex encoded.

  • Thanks for your reply. I don´t understand why 'AA' in the first position correspond to 'h' always, but in second position correspond to 'a'. I need to understand the algorithm, because i want to decrypt this hex '7E6E7E1D63' and i do not have enough samples to make analogy. – user36384 Dec 31 '13 at 8:24
  • i can had other sample like this one '92A094CE94A397F674FAE2' correspond to 'meojogos.pt'. – user36384 Dec 31 '13 at 8:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.