Forgive the very novice question, but...

Given an algorithm which, upon inputting an unchanging 4-character string, generates a variable 6-character string, but having no idea what the algorithm is other than it is at least partially based on the date, is it possible/practical to discover the algorithm based on 15 or 20 previous results? I guess this would be "known-plaintext"?

How would you go about experimenting with this? Are there programs or calculators out there that would attempt to "crack the code" given a list of right answers?

Given the small number of input characters and output characters, each limited to the letters of the alphabet, it doesn't seem to me that it would be a terribly complex or unbreakable algorithm. Still, I'm a novice, I don't know where to start.

Is it doable or am I wasting my time?

Additional info: The four-character code is constant per machine; on another machine the four-character code would be different, but each machine would have an unchanging four-character code. The six-character code, generated using the four-character code, allows a machine access to the device for a variable length of time, after which point another six-character code is required.

The four-character code is always four characters; the output code always six characters. All alphabet, no numbers or symbols. I don't think it's case-sensitive. I do not know if the codes expire if not used immediately.

So give it up, huh? So even if I had a thousand previous results, still not doable?

Are there additional clues I could try to find out that would turn it from not doable to maybe doable?

  • $\begingroup$ Does it take a variable-length input and always output six characters? Or does the length of the output vary with the input? Also, if you try the same string back-to-back, are the results different, or do you wait a few seconds before they change? $\endgroup$
    – Reid
    Jun 30, 2013 at 3:44
  • 1
    $\begingroup$ This isn't a known plaintext attack. It's not really cryptography at all. What you're trying to do is reverse engineering, and would likely be better off in a different forum. $\endgroup$
    – Antimony
    Jul 3, 2013 at 6:31
  • 1
    $\begingroup$ Whatever it is you are talking about, it's not a secure measure. The bit count is too low for security. Is it just a CRC or MAC address mapping of some sort? Can you be more specific? $\endgroup$ Aug 23, 2014 at 3:49
  • $\begingroup$ Although this question is possibly about breaking cryptography, there is too little information to answer it from a cryptographic perspective. It could be a valid question about reverse engineering in general, for which a potential venue would be Reverse Engineering. $\endgroup$ Aug 23, 2014 at 9:59
  • $\begingroup$ I'm no cryptographer, so I'll comment rather than try to answer. If you can generate two codes in relatively quick succession, you can find out the granularity of the time/date component. Given that, if you can force generation of the code and force the input, a brute force attack seems entirely feasible. (This assumes you have access to the mechanism for generating the codes, even though you don't know what the algorithm is. Do you?) $\endgroup$
    – Bob Brown
    Aug 23, 2014 at 16:02

1 Answer 1


If I interpret your question correctly, your unchanging 4-character input is probably just a PIN code that unlocks the use of the device. In this case, the sequence of 6-character strings is a series of one-time password to unlock access to a remote device.

Under this assumption, they is no simple way to predict the rest of the sequence. Indeed, it is easy to design secure device of this type. A simple solution is to output a hash of some inner state and then update the state using a secret key algorithm keyed with a key shared by the device and its remote partner. The most difficult issue is to solve desynchronization problems (e.g. what happens if you advance your local device 1000 times without transmitting anything, will the 1001-th code work ?)

Of course, it is also possible to construct insecure devices of this type. So if you have luck your exact device might be attackable.

However, the short answer is: no, in general, this is not doable.

  • $\begingroup$ password $\mapsto$ passwords $\:$ $\endgroup$
    – user991
    Jun 30, 2013 at 10:41
  • $\begingroup$ Could be time based as well, if both devices have access to a clock. $\endgroup$
    – Maarten Bodewes
    Aug 22, 2014 at 22:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.