What are the "standard procedures in cryptanalysis" to analyze unknown ciphertext?
In other words: Are there any protocols, officially acknowledged checklists or something like that which represent a "standard" approach in cryptanalysis to analyze unidentified ciphertext? If yes, which ones would that be and what would be the path to follow?
Since some don't seem to understand what I am asking...
I am well aware of cryptanalytic procedures like detecting algorythms etc. My question was: is there any “officially acknowledged protocol” in cryptography to follow when doing cryptanalysis?
To get one point very clear before anyone else goes down the wrong road: this has nothing to do with "only a bad guy would ask something like this..." since the situation is actually the other way around. That's why I asked for "officially acknowledged protocols" as in "legally accepted by authorities as evidence and/or proof". Think "whitepaper", not "reverse engineering".
The goal is the "capturing and identification of digital evidence coming from communication streams" to pass on that information to authorities in a way they will accept it. I know how to gain the rough information I want to pass on (like the identification of the crypto-algorithm used), but I want to follow the correct path/order/procedures which authorities accept as "correctly collected digital evidence".
There has to be some protocol that governments, (security) companies, and institutions follow. When it comes to "evidence", there's always a "specific way to do it"... question is: which one would that be when it comes to analyzing unknown ciphertext?
To be sure you understand me correctly: I'm not asking how to analyze unidentified ciphertext, I'm asking what protocol to follow when doing so because I need to pass on the collected evidence later on!
I think my comment-reply to @mikeazo wraps up my question rather perfectly:
Collected evidence was captured in internal company network. We secured full access logs and identified source and target of transmission. Currently, source denies it's anything else but random text. Doing a quick analysis of copies of the captured data shows different encryption algorithms. As proof it's not random text I would like to add my findings to the other evidence collected. Do do so, I want to be sure they accept the way I identify the algorithms etc. That's why I would like to know if there's an "official protocol" to follow that's "officially accepted" (by authorities).
Addendum to the answer I accepted…
After getting a tip via twitter, it turns out that there are several pointers in publications from the National Institute of Justice (NIJ):
- Electronic Crime Scene Investigation: A Guide for First Responders, Second Edition (April 2008, NCJ 219941)
- Forensic Examination of Digital Evidence: A Guide for Law Enforcement (April 2004, NCJ 199408)
- Digital Evidence in the Courtroom: A Guide for Law Enforcement and Prosecutors (January 2007, NCJ 211314)
Those provide initial hints, but even those don't really handle the details of standard procedures to follow in cryptanalysis.
Like the answer I accepted already implied, cryptanalysis obviously isn't enjoying any standard protocols yet that are known to the general public around here. That is, unless a cryptanalytic professional from some governmental institution raises his voice and enlightens everyone (me included).