Finding encrytion algorithm

[Sandy Harris]

Mike Rosing wrote:
> 
> On Thu, 11 Jul 2002, gfgs pedo wrote:
> 
> > suppose a cryptanalysis only has encrypted data-how is
> > going 2 know which is the encrytion algorithm used 2
> > encrypt the data ,so that he can effeciently
> > cryptanalyse if
> >
> > 1:>he has large amount of cipher text only
> > 2:>has large amount of plain text and corresponding
> > cipher text.
> >
> > There r so many encryption algorithms,how does he know
> > which algorithm was used?
> 
> Depends on how they got the source.  They may know it's one of 5
> possible choices because of the person who sent (or received) it.

It may not matter much. Suppose it could be one of a hundred
algorithms, a dozen of which you know how to break. If it is
important and you have the resources, you just try all twelve
breaks. If one works, then you know the algorithm. If not, you
don't care; you know it's one you cannot break, so details are
not important.

Doing this is only at worst 12 times harder than breaking a
single known cipher. If some of your 12 breaks are easy, then
total effort is much less than 12 times the hardest cipher.
When we're talking about 2^40 steps to break a laughably weak
cipher and > 2^100 for a good one, making it 12, or 1000,
times harder is not a very interesting difference.

> If it's just found on a disk in a garbage dump with no connections
> to anyone, it's a bit tougher.

Then you've no reason to think it is important enough to be
worth breaking. You can still try.  

> But every algorithm has some statistical signature

No. Any good algorithm should produce output that looks /exactly/
like random noise, hence they should all look like each other.

This may not be precisely true, but all decent algorithms will
look random enough to make distinguishing quite difficult.

> and if you've got enough cipher text you can compare that
> signature with known algorithms to home in on fewer choices.
> 
> I'm not sure having the plaintext helps much more, but you could
> use random keys to create several ciphertexts with known algorithms and
> compare the statistics just to see if they compare better.
> 
> It's definitly challenging :-)