0
$\begingroup$

I captured some plain TCP packets (not HTTP) which are not using HTTPS.

I am wondering whether these packets are using AES 256 (or 128) or not.

Is there a way to do that?

Thanks

$\endgroup$
5
  • 1
    $\begingroup$ Are you familiar with the 7 layer OSI comms model? If so, at which level do you believe that encryption might have taken place? $\endgroup$
    – Paul Uszak
    May 30, 2017 at 11:55
  • $\begingroup$ You may try to measure "entropy" of your data, with binwalk -E for example, but this won't tell you the encryption scheme, and will also be triggered by other things like compressed data, so it's not perfect... $\endgroup$
    – Lery
    May 30, 2017 at 13:13
  • $\begingroup$ @Lery The word you're looking for is useless. binwalk can't usefully differentiate between a JPEG or a ZIP file. And the entropy of 1500 byte long packets of pure randomness will also vary somewhat due to normal stochastic fluctuations. $\endgroup$
    – Paul Uszak
    May 30, 2017 at 13:59
  • $\begingroup$ @Paul, I must say that even if I find it a bit of a strong word, I agree. It may somehow help determine something is not encrypted with high probability, but still... However, I wanted to link that other question since I find them related. $\endgroup$
    – Lery
    May 30, 2017 at 14:05
  • $\begingroup$ @PaulUszak what i want to know is application layer encryption, thanks $\endgroup$
    – takita
    May 31, 2017 at 7:59

1 Answer 1

3
$\begingroup$

Without knowing anything about the application layer protocol on top of TCP, it's very hard to answer this question.

A good symmetric cipher (like AES) will produce uniformly random bytes. So if the data in the packet looks uniform, there's a very good chance it's been encrypted. You won't be able to distinguish between different algorithms, though, and you probably won't be able to distinguish between different modes of operation.

Your best bet is to figure out the application protocol being used, and look at the corresponding messages establishing the connection.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.