Welcome Guest [Log In] [Register]
Welcome to Crypto. We hope you enjoy your visit.


You're currently viewing our forum as a guest. This means you are limited to certain areas of the board and there are some features you can't use. If you join our community, you'll be able to access member-only sections, and use many member-only features such as customizing your profile, sending personal messages, and voting in polls. Registration is simple, fast, and completely free.


Join our community!


If you're already a member please log in to your account to access all of our features:

Username:   Password:
Add Reply
Please I Need Help!!! Anyone...; Is this a Stream Chiper??
Topic Started: Apr 14 2007, 06:15 PM (363 Views)
ryan
Just registered
[ * ]
A least 2 weaks ago, i got this chiper, but until now, i can't decode it, my head totally burned. :'( .
I last used pygen, with phyton generator, and others vigenere and kasiski applets, but it's not usable.
I can't find the keyword and the plain text, please help....me... Th'x... -_-

i attach this file too.
Offline Profile Quote Post Goto Top
 
Revelation
Member Avatar
Administrator
[ *  *  *  *  * ]
This does not look like a Vigenere. I think it is an ascii cipher.

Notice how many times this sequence shows up:

‹t‹£‹u‹—šŸkž—‹t‹£‹u‹—šŸkž—‹t‹£‹u‹—šŸkž—‹t‹£‹u‹

!!!
RRRREJMEEEEEPVKLWENFNVJKEEEEEAOLKAFKLXCFZAASDJXZTTTTTTTLSIOWJXMOKLAFJNNKFNXN
RAGRBAQEMHIGDJVDSEOXVIYCELFHWLELJFIENXLRATALSJFSLCYTKLASJDKMHGOVOKAJDNMNUITN
RRRRLJVEEEEECLYVYHNVPFTAEEEEEMWLMEIRNGLARWJAKJDFLWNTIERJMIPQWOTZEOCXKNUBNXCN
RJIRPOWEANFUSNCZVDVZNMSFEKLOEPZLDKDJWSAAAAAAAOERHJCTNCKFRIMVKSOFOMKMANREWNBN
RZUDRGXEEEEENFQIDVLQNCKNEEEEEDGLLLLLLAWIOSNCDARLODMTOEJXMILDFJROTKJSDNLVCZNN
Offline Profile Quote Post Goto Top
 
insecure
Elite member
[ *  *  *  *  * ]
A frequency analysis of all byte values comprising 1% or more of the file (33 all told) reveals that this may well be a straight substitution cipher. Consider setting 129 as space, 141 as 'e', and 107 as 't', and see where it takes you.

Code:
 

Code 129 (!!)   3281 (  6.92%)
Code 141 (!!)   1653 (  3.49%)
Code 107 ( k)   1356 (  2.86%)
Code 213 (!!)   1190 (  2.51%)
Code 198 (!!)    949 (  2.00%)
Code 148 (!!)    914 (  1.93%)
Code 147 (!!)    903 (  1.91%)
Code 144 (!!)    876 (  1.85%)
Code 106 ( j)    871 (  1.84%)
Code 139 (!!)    870 (  1.84%)
Code 153 (!!)    866 (  1.83%)
Code 149 (!!)    820 (  1.73%)
Code  97 ( a)    769 (  1.62%)
Code 212 (!!)    706 (  1.49%)
Code 217 (!!)    698 (  1.47%)
Code 220 (!!)    673 (  1.42%)
Code 208 (!!)    668 (  1.41%)
Code 214 (!!)    664 (  1.40%)
Code 225 (!!)    648 (  1.37%)
Code 202 (!!)    616 (  1.30%)
Code 226 (!!)    606 (  1.28%)
Code 211 (!!)    605 (  1.28%)
Code 218 (!!)    586 (  1.24%)
Code 175 (!!)    557 (  1.18%)
Code 231 (!!)    555 (  1.17%)
Code 207 (!!)    544 (  1.15%)
Code 223 (!!)    542 (  1.14%)
Code 194 (!!)    539 (  1.14%)
Code 216 (!!)    510 (  1.08%)
Code 222 (!!)    508 (  1.07%)
Code 176 (!!)    504 (  1.06%)
Code 232 (!!)    495 (  1.04%)
Code 210 (!!)    488 (  1.03%)

Offline Profile Quote Post Goto Top
 
jdege
Member Avatar
Elite member
[ *  *  *  *  * ]
insecure
Apr 19 2007, 02:59 PM
A frequency analysis of all byte values comprising 1% or more of the file (33 all told) reveals that this may well be a straight substitution cipher. Consider setting 129 as space, 141 as 'e', and 107 as 't', and see where it takes you.

Code:
 

Code 129 (!!)   3281 (  6.92%)
Code 141 (!!)   1653 (  3.49%)

For normal text, space is around 18%, 'e' around 13%.

This is way too skewed to be a very sophisticated cipher, but I don't think it's skewed enough to be a simple substitution.

It does, though, look like the basic operation is addition of ascii values, rather than XOR or addition mod-26, etc. The range of values - 74 to 243 is consistent with the addition of ASCII printable characters.

The CT chars below ASCII 106 are rare, except for a peak at ASCII 97, with 1.62% of the text. 97 is 32 + 65, or <space> + 'A'.

How far apart are the 97's?
Code:
 

 15 2
 11 14
  9 82
  9 114
  8 56
  7 24
  6 84
  6 46
  6 38
  5 80
  5 28
  5 214
  5 194
  5 10
  4 98
  4 74
  4 72
  4 70
  4 7
  4 68
  4 5
  4 32
  4 30
  4 138
  4 124
  4 118
  4 11
  4 108


Meybe it's just me, but I see more multiples of 14 than I'd call random.

Update: These, again, were the distances between the 197s. Oops! The distances between the 97s showed the period of 14 much more clearly:

Code:
 

187 14
117 28
112 56
107 42
 61 70
 37 84
 30 98
 24 112
 20 126
 15 140
 11 154
  6 210
  6 182
  6 168
  5 252
  5 224
  4 196
  3 238
  2 308
  2 294
  2 280
  2 266
  1 560
  1 378
  1 350
  1 322
  1 245
When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.
Offline Profile Quote Post Goto Top
 
jdege
Member Avatar
Elite member
[ *  *  *  *  * ]
Try one more test. Wrap the text at 14 characters per line, and count how many times 197 appears in each column.

Code:
 

Col  Count
0      3
1     78
2     13
3     10
4     16
5      5
6      0
7      0
8     18
9     59
10     0
11    83
12     8
13    98


That convinces me that there's some sort of 14-character periodicity, but I'm not sure it's a simple cyclic keyword. Could the keyword have spaces or 'A's appear four times? Seems unlikely.


When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.
Offline Profile Quote Post Goto Top
 
jdege
Member Avatar
Elite member
[ *  *  *  *  * ]
OK. First, I screwed up entirely the previous post. For some idiot reason, I was counting 197s, instead of 97s. That that still showed such a pattern at 14 characters supports the idea that we have a 14-character key.

But when I search for ASCII 97's, every single one appears in column 6.

Doing frequency counts on the individual columns, These four columns are suspiciously alike:

Code:
 

 Col  1     Col  9    Col 11    Col 13
Cnt ASCII Cnt ASCII CNT ASCII Cnt ASCII
 16 106     15 106    16 106    19 106
 87 107     81 107    83 107   102 107
 74 110     71 110    78 110    93 110
787 129    860 129   801 129   750 129
  7 131      3 131     9 131     2 131
  2 133      3 133     4 133     2 133
  4 136      3 136     4 136     1 136
  6 137      6 137     8 137     9 137
 10 138      6 138     7 138     5 138
222 139    215 139   212 139   212 139


It looks, as odd as it may seem, as if these four columns were encrypted with the same key value.

And lets look at some of the others:

Code:
 

 Col  0     Col  2     Col  4     Col  6
Cnt ASCII Cnt ASCII CNT ASCII Cnt ASCII
 14 084     14 118     14 126     15 074
 93 085     74 119     77 127     81 075
 87 088     94 122     81 130     92 078
787 107    809 141    774 149    769 097
  4 109      3 143      4 151      6 099
  3 111      4 145      3 153      5 101
  1 113      3 148      6 156      1 103
  6 114      6 149     11 157      2 104
 10 115     10 150      2 158      4 105
  6 116    220 151    217 159     10 106
221 117    10 153      10 161    216 107


It really looks as if there's a constant offset between them. The fourth character in ASCII order always shows a high frequency count.

Code:
 

Column ASCII
0          107
1          129
2          141
3          144
4          149
5          147
6          097
7          148
8          141
9          129
10        106
11        129
12        153
13        129


My guess is that if you subtracted 107-97=10 from column 0, 32 from column 1, 44 from column 2, etc., you'd have a monoalphabetic substitution.
When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.
Offline Profile Quote Post Goto Top
 
jdege
Member Avatar
Elite member
[ *  *  *  *  * ]
OK. Try this.

Spoiler:


*********************************************************
* Product: Intel® Chipset Software Installation Utility
* Release: Production Version
* Version: 6.0.1.1002
* Target Chipset#: Intel® E7520 & Intel® 915G/P/GV
* Date: May 07, 2004
*********************************************************

NOTE: For the list of supported chipsets, please refer to
the Release Notes

*********************************************************
* CONTENTS OF THIS DOCUMENT
*********************************************************
This document contains the following sections:


End Spoiler:
When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.
Offline Profile Quote Post Goto Top
 
jdege
Member Avatar
Elite member
[ *  *  *  *  * ]
Keyword is the name of University in Jakarta.
Spoiler KampusAtmaJaya /Spoiler
When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.
Offline Profile Quote Post Goto Top
 
Revelation
Member Avatar
Administrator
[ *  *  *  *  * ]
The asterixes explain the enormous repetition in the cipher!

Great job :D
RRRREJMEEEEEPVKLWENFNVJKEEEEEAOLKAFKLXCFZAASDJXZTTTTTTTLSIOWJXMOKLAFJNNKFNXN
RAGRBAQEMHIGDJVDSEOXVIYCELFHWLELJFIENXLRATALSJFSLCYTKLASJDKMHGOVOKAJDNMNUITN
RRRRLJVEEEEECLYVYHNVPFTAEEEEEMWLMEIRNGLARWJAKJDFLWNTIERJMIPQWOTZEOCXKNUBNXCN
RJIRPOWEANFUSNCZVDVZNMSFEKLOEPZLDKDJWSAAAAAAAOERHJCTNCKFRIMVKSOFOMKMANREWNBN
RZUDRGXEEEEENFQIDVLQNCKNEEEEEDGLLLLLLAWIOSNCDARLODMTOEJXMILDFJROTKJSDNLVCZNN
Offline Profile Quote Post Goto Top
 
jdege
Member Avatar
Elite member
[ *  *  *  *  * ]
Two things I noticed.

The first, is how much an ascii add bleeds about the extreme values of the plaintext and key. Adding mod-26, everything wraps and there are a great many possibilities for everything. Ditto for mod 36, mod 52, mod 62. even mod 128 to a lesser extent. But when your text is 7-bit ascii, adding mod-256 is not mod'ing at all. And like when playing craps the odds of rolling a two or a twelve are a great deal less than rolling a seven, the possibilities for a value of 97 or 243 are almost certainly 'A' + space and 'y' + 'z'.

Second, that the period was so clear even when I was counting the wrong character. 97 really only had one possibility - 'A' in the key matching space' in the plaintext. But there are a lot of combinations that could yield 197: 'K' + 'z' to 'k' + 'Z', 'a' + 'd'. and 'b' + 'c'.

But those combinations are by no means equally likely. And so the pattern shows through.
When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.
Offline Profile Quote Post Goto Top
 
1 user reading this topic (1 Guest and 0 Anonymous)
« Previous Topic · Challenges · Next Topic »
Add Reply