# The Probability to Detect or Identify an Unknown Ciphertext

Let $$\it C$$ be a ciphertext such that we have no information about the type of symmetric encryption algorithm used to generate $$\it C$$.

Let $$\bf S$$ be the source bank of most block and stream ciphers such as AES,DES,RC4 and so on. Let $$s \in {\bf S}$$.

Question:
Is there an algorithm, software, or method (especially based on deep learning or machine learning) that receives $$\it C$$ and $$s$$ as input and the output is the probability that $$\it C$$ is encrypted by $$s$$?

Thanks for any help such as paper or thesis.

Is there an algorithm [...] that receives $$\it C$$ and $$s$$ as input and the output is the probability that $$\it C$$ is encrypted by $$s$$?

No. Not unless the system $$s$$ in question is horribly broken.

The reason is simple: Most modern symmetric encryption schemes are built from primitives which are designed to heuristically achieve one of three security models: PRG, PRF or PRP.1

The fundamental property all three of these models have in common is the fact that when given a random input (in the appropriate input slot) then the output will be indistinguishable from a random string.

If you can break this security property for any of these primitives while knowing which you target this is usually worth a peer-reviewed academic paper. Example for Gimli.

Now the output of all non-horribly-broken schemes is indistinguishable from random which means they're also indistinguishable from each other and thus you can't deduce to which a ciphertext belongs. Except of course for horribly broken schemes where you can more clear say whether or not a ciphertext belongs to a scheme. Of course you wouldn't want to actually use any of those schemes but rather use them as examples of how not to design heuristically secure primitives.

Note that the above definitions still leave some wiggle-room as outlined in this Q&A. However this would mostly be length-based (e.g. a direct AES ciphertext is always 16 byte) or based on oracle access to the encryption scheme. Depending on the concrete setup in question this may or may not be applicable (e.g. if outputs are always truncated to 8 byte).

1: For encryption schemes the relevant security property is called IND\$-CPA but these three are the building blocks from which IND\$-CPA security is usually proven.

• Your answer is so useful and clear and because of this I like it. You know, when one search, you may find lots of results about identify an unknown ciphertext by artificial methods such as machine learning. But your remark is so obvious: "Most modern symmetric encryption schemes are designed to heuristically achieve one of three security models: PRG, PRF or PRP". Thanks again. Dec 9 '20 at 11:58
• @user0410 thinking about it, there's some wiggle-room for identification using the length of strings (encryption doesn't hide that) for which the exploitability would depend on the concrete setup.
– SEJPM
Dec 9 '20 at 12:16