-1
$\begingroup$

I find some plaintext, cipher and iv, which len(cipher) == len(plaintext)+len(iv), the length of iv is 16, does anyone know which crypto it is?

$\endgroup$
  • 1
    $\begingroup$ Any 128-bit block cipher (but AES is most likely), almost any non-authenticated mode except ECB or CBC. (Depending on where the IV comes from, could in principle also be AES-SIV.) If I had to guess, I'd go with AES-CTR because that's probably the most common. With the information you've given, that's about as much as anyone can say. $\endgroup$ – Ilmari Karonen Mar 29 '19 at 9:13
4
$\begingroup$

Your description matches a block cipher with 128-bit block size (such as AES) used in CTR, OFB or CFB mode. CBC mode with ciphertext stealing is also a possibility.

The presence of an IV rules out ECB mode, and the lack of padding rules out normal CBC mode (or its variants, such as PCBC). The lack of an authentication tag suggest that we're probably not dealing with an authenticated encryption mode, although in principle your description could also match (nonceless) AES-SIV, where the IV is computed from the plaintext and serves double duty as an authentication tag.

With the information you've given, that's about as much as anyone can say. If I had to guess, I'd probably pick AES-CTR, because that's probably the most common cipher and mode out of the possible matches. But for all I know, it could be Camellia-CFB8 or something else equally weird.

If you have access to a decryption oracle (or an encryption oracle that lets you specify the IV), you might be able the determine the mode of operation by decrypting or encrypting different messages with the same IV, as described e.g. in this answer. But just a single ciphertext / plaintext pair doesn't really tell you anything.

As for determining the block cipher and key size used, you can't really do that without seeing either the key (in which case you can just test common ciphers until you find a match) or the code that does the encryption. From the outside, all secure block ciphers just look like pseudorandom permutations. (If the cipher is subject to related-key attacks, and you have a way of manipulating the key without seeing it, that could in principle also let you identify the cipher. But that's a very long shot.)

| improve this answer | |
$\endgroup$
  • 1
    $\begingroup$ Keep in mind that it can be another stream cipher than just AES-CTR including for example ChaCha20, or if the system is old then maybe RC4 or similar. $\endgroup$ – Natanael Mar 30 '19 at 1:22
  • $\begingroup$ @Natanael: Good point. I was assuming a block cipher due to the OP's use of the term "IV", but could just as well be a stream cipher nonce as well. For that matter, it could even be an authenticated cipher with, say, a 64-bit nonce and a 64-bit authentication tag. $\endgroup$ – Ilmari Karonen Mar 30 '19 at 12:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.