2

I am trying to backup some files that have been encrypted by a 3rd party solution we use in work. I would like to back them up in their unencrypted state as our backup solution has robust encryption option. It's also worth noting that the files do not need the 3rd party software to be of use to us.

The 3rd party solution has very little documentation on their encryption process but I have the key which is stored in the database that indexes the encrypted files. I also have access to the files which the databases references.

The only problem is that I don't know what encryption algorithm the 3rd party company used to encrypt the data.

Is there any technique I can use to determining the type of encryption used or is there a software tool that would allow me to easily try a number of different decryption routines and a set password?

5
  • We need the third party solution before we can help...tools to try different encryption algorithms, probably not short of a shell script that tries to mount it over and over. I would look into the software, not the machine. Probably easier. Oct 4, 2010 at 16:09
  • I would worry a great deal about any encryption tool or software which won't tell me what encryption is being used. How can you have any confidence in the security of this data? The best encryption tools would not only tell you the algorithm used so you can check it is a well known and robust solution, but ideally be open source (not necessarily free) so that the code can be peer reviewed to ensure the chosen algorithm has been properly implemented and has not introduced some flaw which weakens it.
    – AdamV
    Oct 4, 2010 at 16:21
  • @aking1012 Appreciate you taking the time to comment. As a last ditch effort I will create a tool to cycle throw the different algorithms but I'm keen to avoid this work if possible. The actual 3rd party solution is niche enough that mentioning it wouldn't add any value (I'd also be keen not to rock the boat with the manufacturer as they seem to have quite a 'we will tell you what is good for you and you will like it' kind of attitude to support). Oct 4, 2010 at 16:22
  • @AdamV I couldn't agree more. I have asked them twice for the details and they have outright refused to give me any specifics, other than, "our system can decrypt it - so use it". anybody smell snake oil? The backup solution we have in place is robust and trustworthy and I would much prefer that it secures this data. Oct 4, 2010 at 16:26
  • Maybe you're asking the wrong question. Is there a switch you can flip in their software to dump the decrypted data?
    – rob
    Nov 26, 2013 at 20:43

1 Answer 1

1

The first thing I'd try is to dump the symbols on the application executable and look for likely words like “encrypt”, “AES”, etc. Given your description, they might have resorted to obfuscation, which by design makes your task a lot harder. Worst comes to worst, they've been stupid enough to design their own cryptographic algorithm!

Note that even if you can determine the algorithm, that may not be enough. Many symmetric encryption algorithm use an initialization vector, and the manner in which the IV is chosen is not standard.

If the simple ways to reverse engineer the application don't work, it may be easier to trick the application into not performing the encryption by hooking into it and bypassing the encryption code. In other words, if you don't find any simpler method than locating the part of the application that performs the encryption, it's likely to be easier to bypass that part than understand it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .