0
$\begingroup$

It's given that a string, encoded in hex format, is obtained by XOR encryption of a plain text and a key. The key is unknown (not even the length). What are the steps that I should follow to get the plain text? Since I am new to this, I am unaware of the tools to be used.

Example: Crack the following hex encoded string, obtained by XOR cipher:
000000003f2537257777312725266c24207062777027307574706672217a67747374642577263077777a3725762067747173377326716371272165722122677522746327743e

PS: I know that by applying XOR on the cipher text with the key will give me back the plain text. How should I proceed, if I don't know the key?

|improve this question
$\endgroup$
  • 2
    $\begingroup$ please see, one-time pad $\endgroup$ – kelalaka Sep 28 '18 at 9:24
  • $\begingroup$ Note that - specific to this question - the key and plaintext start with the same byte values: that's the only way that the first bytes can be zero after all. The key is most likely binary, not hexadecimal. Hexadecimals can be used to represent binary values. $\endgroup$ – Maarten Bodewes♦ Oct 1 '18 at 15:02
2
$\begingroup$

I would suggest frequency analysis combined with a guess about the most frequently occurring symbol in the plaintext (for example the whitespace character).

This is less straightforward for key lengths longer than a single symbol. To attack a longer key, arrange the ciphertext into columns, where each column corresponds to one symbol of the key, then apply the frequency analysis to columns individually.

This process produces one key estimate for each key length, and from these you might make the final selection to maximize the number of printable symbols in the decrypted message, or look at higher order statistics such as matching bigram statistics of written English text.

I had no luck attacking your particular ciphertext using this technique though. Ideally you'd have a much longer ciphertext sample to properly capture the message statistics.

In addition to having a short ciphertext, I'm not convinced the provided message represents a simple XOR cipher because the first few bytes of the string are all zero which means the message was prefixed with the key itself.

|improve this answer
$\endgroup$
  • $\begingroup$ Generally you try and find the right key size first: if there is a ciphertext that has a good frequency table for a given key size for all columns then you're likely on the right track (although it may be tricky to distinguish between a key and a key twice the size). $\endgroup$ – Maarten Bodewes♦ Oct 1 '18 at 14:59
  • $\begingroup$ if i can get you a list of xor encrypted text with what they are, can they be cracked to show the key? $\endgroup$ – DeerSpotter Dec 21 '18 at 16:18

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.