0
$\begingroup$

I have an AES encrypted data and the key, but I am not able to tell the block cipher mode [ECB|CBC|CTR] used in encryption or know the key length.

Below is the encrypted data output in java.

{"encrypt_data":"GorwlI4cdifSjaKM0Uu4v24DewQqsaN3VTkZMmtDZkttVdoUEV23mBYlYhbcB/oN","encrypt_aes_key":"VRkSYqtGUBr4Zzt7ET8kMw2dvrQkOBH2cGWYwKhNRUU5fCVP+UhZSDKDpQSwx5aHQNIGApRq9INRzLTlB9uJjUXgbl0yEL0Ztyk5OpBU4pIk1imRF2djXD0R0p9sal4QSEXAvL2AvTEDSp4Rw5z23xRX26WGiFUxm8yMQPlwMFUARwakqRc3MSR3mLgqh/nJrCphHveLgHkmnoiJVVDbg8lL5XD1wO2cF4MQVjL+tOjtSPhmgz8BW54RVCwIMhVYVMNoOHWOY/CVkqjng7ds7vbyUq13kOzWOIlHJjkGV2MwfaOF45Da3PgRVlTZ9qDplLjyfq/nIhWXFLFhfY+ALA=="}

Need help identifying the mode and key length used in the encryption.

Improve this question
$\endgroup$
1
  • $\begingroup$ Not telling the context (software used, standard..) does not help. $\endgroup$
    – fgrieu ♦
    Commented Mar 23, 2023 at 13:07

1 Answer 1

Reset to default
1
$\begingroup$

No, we cannot. The reason is that the AES key is encrypted (or "wrapped"), probably using RSA as it is now 2048 bits in size rather than 128, 192 or 256 bits - the key size of AES. So basically you - or at least we - don't have the key.

It could be another mode, but CBC is really the only padded mode that is CPA secure and used regularly. So it is probably CBC because the output is a multiple of 16 bytes. CTR doesn't pad, so for a random message size there is only a 1/16 chance of it being a multiple of 16 bytes. ECB is insecure, so it is unlikely to be used for generic encryption.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Perhaps worth adding that if we know the size of the input we can probably distinguish the modes: input of 33-48 bytes would have to be ECB, input of 16-31 bytes would be CBC , input of 32 bytes would be CTR. $\endgroup$
    – Daniel S
    Commented Mar 23, 2023 at 11:17
  • $\begingroup$ Not 100% sure if CBC is used with a prefixed IV, but otherwise, yes, that would give a good hint. There is PCBC, CFB, OFB or even authenticated modes that could also fit though. The question is about ECB/CBC or CTR, but I'm not sure that Aviril knows that there are other modes as well. $\endgroup$
    – Maarten Bodewes ♦
    Commented Mar 23, 2023 at 11:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.