Detect AES in ECB mode


In [ ]:
blocksize = 16 # assume blocksize is 16
maxmaxsimilarity = 0
mostlikelyline = []
allmaxsimilarities = []
for ll in eachline("8.txt")
    cipherbytes = hex2bytes(chomp(ll))
    nbytes = length(cipherbytes)
    nblocks = convert(Int64, nbytes / blocksize)
    maxsimilarity = 0
    for aa in 1:(nblocks-1)
        for bb in (aa+1):nblocks
            similarity = 0
            aablock = cipherbytes[((aa-1)*blocksize+1):(aa*blocksize)]
            bbblock = cipherbytes[((bb-1)*blocksize+1):(bb*blocksize)]
            samebits = ~(aablock $ bbblock)
            for cc in samebits
                ccbits = bits(cc)
                for dd in 1:length(ccbits)
                    if ccbits[dd]=='1'
                        similarity+=1
                    end
                end
            end
            if similarity > maxsimilarity
                maxsimilarity = similarity
            end
        end
    end
    if maxsimilarity > maxmaxsimilarity
        maxmaxsimilarity = maxsimilarity
        mostlikelyline = cipherbytes
    end
    push!(allmaxsimilarities, maxsimilarity)
end

In [ ]:
maxmaxsimilarity

In [ ]:
cipherbase64 = base64encode(mostlikelyline)

In [ ]:
open("candidate8.txt", "w") do x
    write(x, "$cipherbase64")
end;

In [ ]:
function decryptAES128ECBFileWithKey(fname, key)
    decrypt = chomp(readstring(`openssl enc -d -a -aes-128-ecb -K $key -in $fname`))
    return decrypt
end;

In [ ]:
function stringToBytes(X::String)
    return [UInt8(X[ii]) for ii in 1:length(X)]
end;

In [ ]:
decryptAES128ECBFileWithKey("candidate8.txt", bytes2hex(stringToBytes("YELLOW SUBMARINE")))

Guess that wasn't the key here too.


In [ ]:
using DataFrames
using Gadfly

In [ ]:
similaritiesdf = DataFrame(dists=allmaxsimilarities);

In [ ]:
plot(similaritiesdf,x="dists", Geom.histogram)

That 128 point is definitely an anomoly.