NEURAL-NETWORK-BASED IDENTIFICATION OF CRYPTOGRAPHIC ALGORITHM FAMILY BY CIPHERTEXT AS A STAGE OF PRELIMINARY CRYPTANALYSIS

Abstract

In cybersecurity, digital forensics and technical triage one often needs not to immediately recover the key or plaintext, but first to identify the family of the unknown transformation given only its byte output. This formulation is consistent with the classical view of cryptanalysis as a sequential narrowing of hypotheses and has motivated a recent line of work on cryptographic algorithm identification from ciphertext using machine learning.

References

1. Zhao L., Chi Y., Xu Z., Yue Z. Block cipher identification scheme based on Hamming weight distribution. IEEE Access. 2023. Vol. 11. P. 21364–21373. DOI: 10.1109/ACCESS.2023.3249753.
2. Yuan K., Yu D., Feng J., Yang L., Jia C., Huang Y. A block cipher algorithm identification scheme based on hybrid k-nearest neighbor and random forest algorithm. PeerJ Computer Science. 2022. Vol. 8. e1110. DOI: 10.7717/peerj-cs.1110.
3. Zhang W., Zhao Y., Fan S. Cryptosystem identification scheme based on ASCII code statistics. Security and Communication Networks. 2020. Vol. 2020. Article ID 8875864. DOI: 10.1155/2020/8875864.
4. Chen M., Zhu Y., Mei L., Zhang X., Yuan S., Hu B. The cryptographic algorithm identification: using deep learning to empower smart grids. Proceedings of MIDA 2024. Ningbo, China, 2024. DOI: 10.1145/3662739.3663379.
5. Gerlach M., Font-Clos F. A standardized Project Gutenberg corpus for statistical analysis of natural language and quantitative linguistics. Entropy. 2020. Vol. 22, No. 1. Article 126. DOI: 10.3390/e22010126.
6. Goldhahn D., Eckart T., Quasthoff U. Building large monolingual dictionaries at the Leipzig Corpora Collection: from 100 to 200 languages. Proceedings of LREC 2012. Istanbul, Turkey, 2012. P. 759–765.
7. Universal Dependencies. UD_Ukrainian-IU treebank. Licence CC BY-NC-SA 4.0. URL: https://universaldependencies.org/treebanks/uk_iu/index.html.
8. FIPS PUB 197 Update. Advanced Encryption Standard (AES) [reaffirmed]. NIST, 2023. URL: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197-upd1.pdf.
9. Dworkin M. SP 800-38A. Recommendation for block cipher modes of operation: methods and techniques. NIST, 2001. 66 p. DOI: 10.6028/NIST.SP.800-38A.
10. Barker E., Mouha N. SP 800-67 Rev. 2. Recommendation for the Triple Data Encryption Algorithm (TDEA) block cipher. NIST, 2017. 30 p. DOI: 10.6028/NIST.SP.800-67r2.
11. Strombergson J., Josefsson S. Test vectors for the stream cipher RC4. RFC 6229. IETF, 2011. 12 p. DOI: 10.17487/RFC6229.
12. Nir Y., Langley A. ChaCha20 and Poly1305 for IETF protocols. RFC 8439. IETF, 2018. 46 p. DOI: 10.17487/RFC8439.
13. Josefsson S. The Base16, Base32, and Base64 data encodings. RFC 4648. IETF, 2006. 18 p. DOI: 10.17487/RFC4648.