find out the algorithm based on some examples?

Question

I have an OTP generator that receive two numbers less than 99 as input and return an 8 digit number as its output. I know it has a simple algorithm. because its processor is just an ATMEGA8 micro controller!

I tried different numbers as its input and find out that the output is dependent to the multiply of inputs! I mean different pairs that has equal multiply, will return equal output! for example, 2,5 and 5,2 and 1,10 and 10,1 have equal 8 digit output! (as they have equal multiply value). So I create a table of different multiply values as input and their related output as below :

 Output  | Multiply Of Inputs | Example Of Inputs

35057738    0                      0,x or x,0
05863266    1              
35049586    2
06122346    3
71382386    4
69282170    5
06385526    6
05860214    7
05057910    8                      1,8 or 2,4 or 4,2 or 8,1
06106462    9
34009178    10
06911858    11
34000994    12
06122474    13
71382514    14
69282298    15
06385654    16
05860342    17
05058038    18
06106590    19
34009306    20
06911986    21
34001122    22
06097786    23
71357794    24
69257578    25
06360934    26
05835622    27
05033318    28
06081870    29
33968202    30
06887266    31
33976434    32
14482282    33
79742322    34
77650298    35
14745462    36
14220150    37
13417846    38
14466398    39
42352730    40
15271794    41
42360930    42
05069786    43
70329794    44
72432074    45
05332934    46
04807622    47
04005318    48
02956782    49
37150954    50
03762114    51
37142738    52
06101930    53
71361970    54
69269946    55
06365110    56
05839798    57
05037494    58
06086046    59
33988762    60
06891442    61
33980578    62
46145226    63
11405266    64
09313242    65
46408406    66
45883094    67
45080790    68
46129406    69
10886650    70
46934738    71
10894786    72
44023546    73
09283554    74
11385834    75
44286694    76
43761382    77
42959078    78
44007630    79
12975562    80
44813026    81
12967410    82
49274538    83
14534578    84
16636858    85
49537718    86
49012406    87
48210102    88
47161502    89
18210202    90
47966898    91
18218402    92
15608698    93
80868706    94
78768490    95
15871846    96
15346534    97
14544230    98
13495630    99
43495498    100
14301026    101
43487346    102
14560106    103
79820146    104
77719930    105
14823286    106
14297974    107
13495670    108
14544222    109
42446938    110
  ????       x

Now I want to know,does this algorithm looks safe enough? Is there any way to find out the algorithm?

Answer 1

Is this algorithm safe enough? Depends. What's your threat model. That question literally cannot be answered without creating a model of how determined and how resourceful your threat is.

That being said, I would generally say, "no, not safe enough." If you have found that the inputs are multiplied together in the first step, that automatically starts to create attacks. You don't have 100*100 = 10,000 possible inputs, you only have 2,870 possible inputs.

Given that you don't have a threat model, that, on its own, is not enough to automatically make it fail to be safe enough. However, it does show that the implementer did not understand security when developing the algorithm. This suggests there are other flaws which have not been seen yet, and thus I instinctively distrust the implementation.