What are the standard procedures in cryptanalysis to analyze unknown ciphertext?

Question

What are the "standard procedures in cryptanalysis" to analyze unknown ciphertext?

In other words: Are there any protocols, officially acknowledged checklists or something like that which represent a "standard" approach in cryptanalysis to analyze unidentified ciphertext? If yes, which ones would that be and what would be the path to follow?

Clarification

I am well aware of cryptanalytic procedures like detecting algorythms etc. My question was: is there any “officially acknowledged protocol” in cryptography to follow when doing cryptanalysis?

To get one point very clear before anyone goes down the wrong road: this has nothing to do with "only a bad guy would ask something like this…." since the situation is actually the other way around. That's why I asked for "officially acknowledged protocols" as in "legally accepted by authorities as evidence and/or proof". Think "whitepaper", not "reverse engineering".

The goal is the "capturing and identification of digital evidence coming from communication streams" to then forward that information to authorities in a way they will accept it. I know how to gain the rough information I want to pass on (like the identification of the crypto-algorithm used), but I want to follow the correct path/order/procedures which authorities accept as "correctly collected digital evidence".

There has to be some protocol that governments, (security) companies, and institutions follow. When it comes to "evidence", there's always a "specific way to do it". Question is: which one would that be when it comes to analyzing unknown ciphertext?

So, to wrap it up: I'm not asking how to analyze unidentified ciphertext, I'm asking what protocol to follow when doing so because I need to pass on the collected evidence later on!

I think my comment-reply to @mikeazo wraps up my question rather perfectly:

Collected evidence was captured in internal company network. We secured full access logs and identified source and target of transmission. Currently, source denies it's anything else but random text. Doing a quick analysis of copies of the captured data shows different encryption algorithms. As proof it's not random text I would like to add my findings to the other evidence collected. Do do so, I want to be sure they accept the way I identify the algorithms etc. That's why I would like to know if there's an "official protocol" to follow that's "officially accepted" (by authorities).

Addendum to the accepted answer

After getting a tip via twitter, it turns out that there are several pointers in publications from the National Institute of Justice (NIJ):

1. Electronic Crime Scene Investigation: A Guide for First Responders, Second Edition (April 2008, NCJ 219941)
2. Forensic Examination of Digital Evidence: A Guide for Law Enforcement (April 2004, NCJ 199408)
3. Digital Evidence in the Courtroom: A Guide for Law Enforcement and Prosecutors (January 2007, NCJ 211314)

Those provide some hints, but even those don't really handle the details of standard procedures to follow in cryptanalysis. Like the accepted answer already implied, cryptanalysis obviously isn't enjoying any standard protocols (yet).

Answer 1

Unfortunately Crypto.SE probably has very few lawyers, law enforcement officers, public policy experts, etc. Furthermore, Legal.SE doesn't exist yet. To further complicate the situation (at least in the US) the answer will probably vary from state to state.

So, I'm going to do the best I can, but you are probably best off either calling police or a lawyer in your jurisdiction.

Here is the deal, it is hard to prove a negative. Thus, I don't feel sufficiently knowledgeable to say no such protocol/procedure exists. That said, I don't know of one. I did find this flowchart for collecting digital evidence if you are in the US. Step one seems to imply that some knowledge of local/agency policies must be followed. But this deals more with evidence collection and not analysis.

My guess is that (at least in US), once you have the relevant network traffic and logs, your job is done. This is especially true if you have any motive/interest in seeing the offending party get in trouble.

So, assuming evidence is collected properly (since that is beyond the scope of your question) my guess is that the prosecuting attorney will hire an expert witness to examine the evidence and give testimony at a trial. They would probably also call you up to testify as to the collection procedures, etc.

Some added thoughts
The answer probably also depends on the exact protocols/software used. For example, if after an expert analyzes the ciphertext, they can determine that PGP or some other piece of software was used in which a long-term secret is used for encryption, a judge could order the defendant to disclose the encryption password or long-term secrets. At this point, no additional cryptanalysis would be needed. This would become more difficult if say TLS is used as the client often has no long-term secrets. I suppose a judge could force the party owning the server to reveal long-term secrets so decryption could take place (assuming the initial handshake was captured). If TLS, or whatever protocol used, is used in such a way that ephemeral keys are used, then even this would not work.

Answer 2

No there is not.

The reason is simple: If you do not know anything about the scheme used to create the ciphertext, you can not find out anything more than the maximum length of the message. The ciphertext could be created with a one time pad. The only information you would have is that that the message can be at most the size of the ciphertext.

In historical ciphers you could use certain assumptions of the plaintext (e.g. distribution of letters and bigrams in language) and statistical tools to identify the cipher. For example Caesar only shifts the distribution by a certain amount, while Vigenere also also flattens it.

Today's encryption schemes are designed differently, where statistical analysis doesn't help much any more. If you just have a bit-representation of a single ciphertext, you don't even know how many numbers/symbols you got.

However, not knowing the encryption scheme is no realistic scenario today. Cryptography abandoned "security by obscurity" decades ago (even if some laymen still think it would be a good idea). Unless you are the "bad guy", this entire question is pointless, as security should not be based on the obscurity of the cryptosystem.