Re: discover encryption method

[Alexander Klimov <alserkli () inbox ru>]

On Mon, 7 Jan 2008 richard () tortoise demon co uk wrote:
> The application I'm dealing with can somehow present the passwords
> in cleartext in it's user interface, and so is somehow
> reconstructing the text from the encrypted value. I'm supposing it
> to be encrypted using some secret key held within the application,
> but I know neither the key or the method.

If it uses real encryption (say, AES) and you don't know the key, you
will not be able to find it by investigating password-ciphertext pair
(you will have to RE the software), but the chances are high that the
method is something very trivial, like ROT13 or base64 or xor with
some fixed value. Post some examples of `encryption' of, say, `a'
repeated different number of times and same for `b': if the method is
weak you will see repetitions in the ciphertext or constant difference
between results for `a' and `b'.

-- 
Regards,
ASK