2
$\begingroup$

I come across lots of tokens which might be simply encoded and not random, but I don't know any way to identity if they are encoded or random, how to find is there any cheatsheet for the same.

For example, I know about base64 encoding, I can tell just by looking if its base64 or not. Identification for base64 is it would be in pair of 3 so total count of the characters would be in multiple for 3, if for some reason say there are 19 characters then to make it multiple of 3 two "=" (without quotes) would be added at the end.

Like this are you aware about identification of other encoding/encryption?

Improve this question
$\endgroup$
3
  • 1
    $\begingroup$ They could have used any permutation of the base64 alphabet. I've seen cases where the order was random, so even base64 can have a secret key element... $\endgroup$
    – Henno Brandsma
    Commented Apr 16, 2019 at 6:11
  • $\begingroup$ Is there any identification chart or kind of a cheatsheet to identify most common enconding/encryption ? $\endgroup$
    – user67494
    Commented Apr 16, 2019 at 7:27
  • $\begingroup$ Traditional base64 (PEM or MIME including S/'MIME and some XML and also PGP) is padded with equals to a multiple of 4 chars (corresponding to 3 octets binary), but uuencode uses either space or grave/backtick as well as a length prefix and there are variations of base64 that are not padded at all. $\endgroup$
    – dave_thompson_085
    Commented Apr 28, 2019 at 4:43

1 Answer 1

Reset to default
2
$\begingroup$

I'm not aware of any scheme. Of course, an encrypted value is often indistinguishable from random (or close to indistinguishable for most asymmetric algorithms).

You can use heuristics to determine the type of encoding, but even then you cannot always tell e.g. base 64 from encrypted base 64, or even base 64 from hex (ABCD is both valid in base 64 and hex, to name just one example). It is also generic text. Even if you determined that something is base 64 encoded then you'd be not much further. You can decode the binary value inside, but now you'd have to test what kind of value it represents.

If we suspect hashes then commonly 16 bytes is used for MD5, 20 bytes for SHA-1 and 32 for SHA-256 and so on. However, even then RIPEMD-128, RIPEMD-160 and SHA-512/256 (or SHA3-256) would have the same size, and it is possible to simply use, say, 128 bits off a larger hash function as well.

There are of course encodings that explicitly tell you what they are, such as PEM or XML encoded keys. ASN.1 / BER encoding is used a lot so testing if it complies with that is always a good idea. EC public keys (also used for ECIES encryption) commonly start with a byte valued 02, 03 or 04 and so on and so forth. PGP container format is usually easy to distinguish as well.

The type of ciphertext can usually best be determined by a human being. I'd expect the NSA to have some kind of application to guess encodings or test against classical ciphers, but commonly you need info on the protocol used to do anything useful with it.

A lot of times the used scheme is not kept as a secret if just because of the Kerckhoff principle. In that case guessing is not required.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.