Working out the encryption algorithm

Question

I'm trying to figure something out. I have a legacy system in place and I'm not using all of it. There are business reasons why we use things this way.

Some fields in the system get encrypted by a piece of middleware that I ultimately would like to replace. I can't replace this part of the system because I can't decrypt the values properly.

For example I have a field that contains the word:

ferret

This is encrypted and becomes:

^ADFJBLFOHLOJFNHHKFJLHFJNPCJFJCPFBAPEKDKM

The words

wellington boot

becomes

^KOKFDEJPAAPFJHPOIGOICOAHKFLNFHMIOJNHAAHF

I can see the unencrypted data and I can see the resulting encrypted data but I am trying to find what algorithm was used to turn the field value into the encrypted versions. The main reason for this is that I have a requirement to massively increase the number of fields that contain the encrypted data but at the moment I can't because I cannot replace the existing encryption mechanism because I don't know what was used to encrypt the data.

There is simply too much data in the system to go through and load up each record and make a note of the unecrypted data so I can make a new encryption mechanism.

If I knew how the existing data was encrypted I could use the same method to encrypt my new fields. The system encrypts certain fields only and my extension to the system needs to encrypt others using the same method.

How can I do this? Is it even possible to find out how the data was encrypted and what method was used?

I'm afraid that in order to find out what encryption was used you'll have to dig in the code... — Nir Alfasi
– Nir Alfasi, Commented Jun 12, 2013 at 17:27
Just a thought - the ^ is used to denote XOR. And the length of both is the same. Maybe it is just a simple xor encryption with a pass phrase... Just a guess... Also, might be helpful: security.stackexchange.com/questions/3989/… — Gray
– Gray, Commented Jun 12, 2013 at 17:27
Is this reversed anywhere? Because the two are equal lengths, I'd suspect a hash. — Kevin
– Kevin, Commented Jun 12, 2013 at 17:29

D Mac · Accepted Answer · 2013-06-12 17:56:16Z

5

It is SHA1, translated into A for 0, B for 1, C for 2, etc. For example, your "wellington boot" example has the SHA1 hash of "aea5349f00f..." which is clearly "KOKFDEJPAAP..."

So you can just use SHA1 and do the same translation to continue the pattern.

To check this, try the phrase "test phrase" - the SHA1 of this is "ab8f37d89b1154ba18c78a7e4b8eef2acdfec1eb", which becomes "KLIPDHNIJL..." in your system.

edited Jun 12, 2013 at 17:56

answered Jun 12, 2013 at 17:40

D Mac

3,8191 gold badge27 silver badges34 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

zindorsky Over a year ago

confirmed. SHA1("ferret") = 03591B... or ADFJBL... in the encoding scheme

eco warrior Over a year ago

This is exactly what I wanted. Now I can recreated the same encryption method. I know SHA1 is not a reversible encryption mechanism and all I needed was to be able to encrypt and compare data once stored.

Collectives™ on Stack Overflow

Working out the encryption algorithm

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related