1
$\begingroup$

Let's suppose I have two strings

One string is plaintext

The other is the result of running the plaintext through an unknown cipher.

Does there exist a tool where I can enter the pre and post-cipher text and have the tool spit out which cipher or hash may have been used?

I understand that such a tool isn't guaranteed to be accurate, but if it exists, it would be very useful to me right now.

|improve this question
$\endgroup$
  • $\begingroup$ Err, what about the key? The typical definition of cipher requires three parts, one being a key. $\endgroup$ – Paul Uszak Sep 21 '18 at 22:12
  • $\begingroup$ @PaulUszak Not necessarily. A stream cipher may only need the key (e.g. RC4). $\endgroup$ – forest Sep 22 '18 at 6:44
  • 2
    $\begingroup$ @forest A strange cipher indeed without plain or cipher texts... $\endgroup$ – Paul Uszak Sep 22 '18 at 11:57
  • $\begingroup$ @PaulUszak RC4 is a stream cipher; it generates a keystream. You may XOR it with plaintext, but the cipher itself only generates output given a single key. $\endgroup$ – forest Sep 23 '18 at 2:21
4
$\begingroup$

No, such a tool does not exist and could not exist for any modern, secure cipher. If you do not have access to the key, you cannot correlate plaintext with ciphertext. For a hash algorithm, you can heuristically guess what the algorithm may be based on the length of the output, but that would only allow you to classify the digest as being from one of any number of possible hash algorithms. For example, a 160-bit output could be SHA-1, or maybe RIPEMD160, but not MD5.

If you have the input to the hash algorithm as well as the digest, then you can determine with certainty which hash algorithm was used to create it simply by running the input through all candidate hash algorithms and seeing which one results in a matching digest for that input.

|improve this answer
$\endgroup$
  • 2
    $\begingroup$ Addendum: You can also use the (leftmost) bytes of any hash as shorter hash value. So just getting 160 bits may also be SHA-256 shortened to 160 bits. Sometimes length info can also help: 24 bytes is likely to be 3DES in CBC mode and rules out AES in CBC mode when looking at ciphertext. $\endgroup$ – Maarten Bodewes♦ Sep 22 '18 at 12:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.