D&C GLug - Home Page

[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]

Re: [LUG] Identifying encrypted files.

 

Martijn is right and also importantly wrong ;)

In general encrypted files will look properly random. At least cryptographers strive desperately for this but fail in subtle ways (and probably always will as perfect encryption is elusive aside from one time pads).

On the other hand the output of most random number generators doesn't look properly random.

There are standard statistical tests that reveal the use of linear congruential pseudo random number generators (I've  run such tests over output of my own code, and marked myself down for using dodgy random numbers before).

Obfuscation is an interesting one, but there is a vast mathematical literature on spotting steganography. Where for example, you hide an encrypted message in the low bits of pixel colour values in a jpeg image files. Again typically image file noise has patterns not found in the encrypted data, meaning cryptographers can do a statistical test on public images and fairly reliably say if someone is trying to sneak something through, even if they can't tell you which bits are image and which are message.

I'm busy telling my son statistics is a really interesting topic. Statistics lets you spot really small effects in timing or deviations from expected behaviour, and it can be really hard to prevent these.
-- 
The Mailing List for the Devon & Cornwall LUG
http://mailman.dclug.org.uk/listinfo/list
FAQ: http://www.dcglug.org.uk/listfaq