Knowing the plaintext, how to discover the encryption scheme used? [closed]

Question

I have some char() fields in a DBF table that were left encrypted by a past developer in the project.

However, I know the plaintext result of the decryption of several records. How can I determine the function/algorithm/scheme to decrypt the original data? These are some sample fields:

For cryptext:

b5 01 02 c1 e3 0d 0a

plaintext should be:

3543921 or 3.543.921

And for cryptext:

41 c3 c5 07 17 0d 0a

plaintext should be

1851154 or 1.851.154

I believe 0d 0a is just padding. Was from data gathered in win-1252 encoding (dunno if matters)

EDIT: It's for the sake of curiosity and learning. I want to be able to undestand the encryption used(seems a simple one, although is binary data) to recover the value of the fields for the tuples whose plaintext I don't know.

EDIT 2: Added a couple samples.

Answer 1

There is no easy way in general case. This question is too general. Try posting these plain + encrypted strings.

EDIT:

• for the sake of learning you can read this article : Cryptography on Wikipedia

• if you really beleive the encryption is simple - check if it's a byte (or word) level XOR - see the following pseudocode

  for (i in originalString) {
  newString[i] = originalString[i] ^ CRYPT_BYTE;
  }
  

Answer 2

Assuming it's not something as simple as a substitution cipher (try frequency analysis) or a poorly applied XOR (e.g., reusing the key; try XORing two ciphertexts with known plaintexts and then see whether the result is the XOR of the plaintexts; or try XORing the ciphertext with itself shifted by some number of bytes), you should probably assume it's well-known stream/block cipher with an unknown key (which most likely consists of ASCII characters). If you have a big enough sample of ciphertext-plaintext pairs, you could start by checking whether plaintexts with the same first few characters/bytes have ciphertexts with the same first characters/bytes. There you might also see whether it's a block or a stream cipher and whether there is any feedback mechanism involved. Padding, if present, might also suggest that it's a block cipher rather than a stream cipher.