4
$\begingroup$

I've been keen on IT Security for a long time now and I've learned a lot about networking & security. However trying a "decryption challenge" I'm lacking what I think is basic encryption/decryption knowledge.

So I've got a ciphertext without knowing about the algorithm or key used encrypting the plaintext. I assume that this cipher is not "too hard" (no AES e.g.) to crack, because it would be an overkill for a simple challenge.

I want to mention that I would like to crack it on my own, but I need advice in which direction I should go - what's most likely to be used, how I can verify if some encryption algorithm is used or not, etc.

About the cipher: The Cipher contains [cghijklmnopqrsuvwxyzABCDEFGIJKLMNOPQRSTUVWYZ0-6+] without whitespaces, while some patterns are recurring (same characters are repeating in the same order a few times in the cipher). I'm also quite sure the ciphertext isn't hashed as I'm supposed to read what the result is. Cracking a 1000+ characters cipher won't be the "challenge".

What I've already done:

  • I tried a frequency analysis to see if it's just substituted monoalphabetically sign for sign - without success (many results staying at ~8%, no one above 10%)

  • I had a look at classic transpositioning and substitution methods which lead me to encryptions like Vigenére, Autokey, Beaufort and so on. However, those are designed to work with non-numeric alphabets as far as my understanding goes.

  • I calculated the "Index of Coincidence" being about 0.06, which should tell me that problably a substitution is used (I haven't yet figured out completely how this works in detail)

  • I already tried to separate the cipher at points where suspicious, recurring "words" are, just to find something that seems like separator-signs. However it's not much clearer afterwards and I'm not sure how to go on.

  • I did already base64 decode as suggested, but the result was even less helpful. Looks more unrelated than before, just many special characters mixed up with periods and numbers here and there.

What I need would be a good advice on how to find out which cipher may be used as I'm currently running out of ideas what to try.

I hope somebody can help me out here as I'm really interested in the topic, but somehow stuck.

Thanks in advance!

Improve this question
$\endgroup$
5
  • 2
    $\begingroup$ Related: crypto.stackexchange.com/questions/3826/… $\endgroup$
    – otus
    Commented Oct 15, 2015 at 11:46
  • $\begingroup$ By the way, you can delete your old question or flag your own question for migration by a moderator. Nobody has has the powers to migrate except mods. $\endgroup$
    – Maarten Bodewes ♦
    Commented Oct 15, 2015 at 15:45
  • $\begingroup$ @MaartenBodewes Thanks for the info about flagging questions. I'm part of the community since yesterday, so I'll have to get used to the handling. I'm sure as I've counted every character and 7-9 and / don't show up. However, I think this doesn't necessary mean the used alphabet does not contain them - maybe the characters needed to translate to 7-9 or / (or some single characters like 't', which I've also seen to be missing) just aren't used. However I'm quite sure that it's not base64 encoded as I've already decoded it - afterwards the "cipher" isn't useful at all (as already written). $\endgroup$
    – UsuallyNot
    Commented Oct 15, 2015 at 17:45
  • $\begingroup$ @otus Thanks to you too, but the question you linked describes what to use instead of why as far as I've seen. Anyway the resource is appreciated, thanks. $\endgroup$
    – UsuallyNot
    Commented Oct 15, 2015 at 17:48
  • $\begingroup$ The text I supposed to be a Vigenére cipher actually wasn't one, it was a base64 encoded archive file. However, the most likely answer to my question is to look at first if it's a base64 encoded file. If that's not the case I'd follow the advices from crypto.stackexchange.com/questions/3826/…, as mentioned by otus. The post of Ilmari Karonen is a very good guideline for beginners. $\endgroup$
    – UsuallyNot
    Commented Oct 22, 2015 at 13:09

1 Answer 1

Reset to default
4
$\begingroup$

I had a look at classic transpositioning and substitution methods which lead me to encryptions like Vigenére, Autokey, Beaufort and so on. However, those are designed to work with non-numeric alphabets as far as my understanding goes.

While most classical ciphers are applied to the usual alphabet (without different cases), they are not limited to that. It's perfectly fine to have exactly that alphabet you mentioned. In your cryptanalysis you will most likely use number representations of characters anyway (to use addition and modulo), then it just comes down to ordering the alphabet.

About the cipher: The Cipher contains [a-zA-Z0123456+] without whitespaces, while some patterns are recurring (same characters are repeating in the same order a few times in the cipher).

If there is structure like this, it's very likely to be Vigenere or something similar, operating in fixed "blocks". The distances from the repeating patterns will indicate the block size, as they are multiples of the blocksize.

I tried a frequency analysis to see if it's just substituted monoalphabetically sign for sign - without success (many results staying at ~8%, no one above 10%)

If you have the symbols a - z, A - Z, 0 - 6, how can 58 symbols have "many at 8%"? Still, it looks like Vigenere fits.

A few things to consider:

  • Having different cases can imply, they have an alphabet of 2 * 26 (and then add the numbers), or they just use the case of the plaintext, but that should be quite obvious (the distribution is more even in the first case). Alternatively they could just have used a single alphabet and randomly used upper or lower case.
  • Focus on finding out the block size first. You mentioned index of coincidence, but I guess you meant the "Friedman test". And you have to keep in mind, that your alphabet might be different than the standard one. Use the actual index of coincidence to find out the block size. As an algorithm, you can also calculate the autocorrelation directly (for shift $i=1,2,\dots$, count the positions where the text and the shifted text have the same symbol). The correct block size (and its multiples) will be a outlier(s) from what you would get from a uniform distributed alphabet (for all the wrong block sizes).

From there on, it's just frequency analysis for each position in the block.

Improve this answer
$\endgroup$
8
  • $\begingroup$ Thanks a lot, tylo! I'll have a deeper look into your suggestions after work. I've tried some "Vigenére breakers" before because I haven't had the time to go trough it manually. Will do that asap and update you here. $\endgroup$
    – UsuallyNot
    Commented Oct 15, 2015 at 12:06
  • $\begingroup$ I'm unsure about having the right alphabet for this cipher and asked another, independent question: crypto.stackexchange.com/questions/29870/…. Once I've got that faulty reasoning of mine solved, I'm able to go on. Also, I corrected the alphabet seen in my cipher. $\endgroup$
    – UsuallyNot
    Commented Oct 16, 2015 at 7:09
  • $\begingroup$ I'd suggest trying to figure out the block size first. With the aurocorrelation method you can figure that out without knowing anything about the alphabet, as long as it is not uniform distributed. $\endgroup$
    – tylo
    Commented Oct 16, 2015 at 14:32
  • $\begingroup$ I've coded a java program in the meantime which calculates the IC values. However the only flashy value in the statistic has been with period 81. As this only means the maximum period will likely be 81, 27 and 9 could also fit (factors of 81). Is my assumption right? In the meantime I'm heading towards chi-squared statistic to figure out the key letters. $\endgroup$
    – UsuallyNot
    Commented Oct 18, 2015 at 17:54
  • $\begingroup$ I've computed & tested the chi-squared values for Key length 9 and 27 so far (81 is in the do). For length 9 I couldn't decrypt a meaningful plaintext. I also altered some values in the Key which had similar chi-square values. However I can't even recognize parts of words yet. Any Ideas? $\endgroup$
    – UsuallyNot
    Commented Oct 19, 2015 at 11:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.