# Crypto algorithm identification (reverse engineering)

I'm trying to identify a certain cryptographic algorithm used in a program. From examining the executable, it appears it

• Has 16 rounds (plus 2 "rounds" for pre/post processing)
• Pads the input plaintext to 256 bytes with the results of a linear congruence generator (with a fixed seed). This might be a preprocessing step and not part of the actual crypto algorithm
• Each round operates on the entire plaintext (updates all 256 bytes of the output). At the end of each round a 256-byte array is subtracted from the output
• Uses a (random) initialization vector, ie the same input produces different outputs

I suspect it's a variant of DES, but the block size listed for DES is only 64 bits. Is there a 2048-bit variant that is commonly used, or some kind of optimization that allows the next round for each block to be computed in parallel while still using an initialization vector? Alternatively, given a plaintext and the intermediate values produced each round is there an easy way to determine the type of cipher?

• I haven't looked into the details, but note that there are other block ciphers that use 16 rounds, for instance blowfish (8 byte block size) or twofish (16 byte block size). There is of course also 3DES but possibly the entire bitslice implementation is simply repeated for that. – Maarten Bodewes Nov 14 '17 at 13:30
• turns out it is rsa (e=2^16+1, 16 rounds required for exponentiation). an iv was not used, just some kind of counter/timestamp was added to the plaintext in a preprocessing step. in hindsight the use of imul operands / block subtraction instead of xor is a dead giveaway – s n Nov 19 '17 at 8:53

Bit slicing is an optimization technique that consists in calculating $b$ instances of a function (e.g. $n$ block decryptions/encryptions) in parallel on a machine with $b$ bits. An apparent 2048-bit block size is consistent with a 64-bit cipher and a 32-bit bitslice. Bitslicing can only be done when the data for block operation $n+1$ doesn't depend on the output of block operation $n$, so it's useless for e.g. CBC mode but can be used for e.g. CTR mode.