Is it possible to identify the algorithm used for the stream cipher based upon analysis of an encrypted stream?


As usual: if the encryption is any good, then its output is indistinguishable from randomness (indeed, a cryptographically secure PRNG is really the same thing as a stream cipher using the "initial seed" as key, and encrypting a long sequence of zeros). In particular, a specific algorithm cannot be identified.

For identification, look for context. The used algorithm, in any system, is not usually a secret; Auguste Kerckhoffs has famously explained that indeed a "secret algorithm" is not a sane foundation for secrecy, and the algorithm can and even should be made public. Therefore, many communication protocols include fields which make explicit the used algorithm; this makes such protocol potentially upgradable to new algorithms in a backward-compatible way (this is called algorithm agility). For instance, in SSL/TLS, the set of algorithms is stated plainly, unencrypted, in the ServerHello message, so everybody (including any eavesdropper) perfectly knows what encryption algorithm is used.

Similarly, if encryption is applied, then it is done in two places (the sender and the receiver), both involving a tangible incarnation of the algorithm. In shorter words, there is some software that does the encryption and the decryption. Software is highly susceptible to reverse engineering and the algorithm can thus be identified.

The RC4 stream cipher is widely used as a stream cipher (it is the stream cipher supported by SSL, for instance), and it has biases. Cryptographically speaking, it is "broken", albeit not sufficiently to turn the bias into actual attacks in most practical situations. You may be able to exploit such biases into an algorithm identification, especially if you can make it so that the unknown encryption system processes a lot of bytes that you know (you need to be able to make the system encrypt or decrypt bytes that you know, and observe the result). See the Wikipedia page for pointers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.