My question is: Is there a reliable way to detect if a hex / base64 string is actually encrypted, or just encoded?
(I did a quick search but I only seem to find whats the difference between encryption and encoding none seems to say how to detect encryption in general…)
I don’t need to know what kind of encryption it is, just detect whether it is encrypted or not and send error if not encrypted, thus enforce encryption.
String size may vary from couple of bytes to kilobytes…
Is there a C/C++ library available for that?
>Solution :
If you think you’re working with encoded/encrypted plaintext, the most obvious thing to do would be to try and decode with various standard encodings, and see if what you get back looks like plain English, or at least what you’re looking for.
Beyond that, there’s a few things you could try:
-
If you had a perfectly encrypted string, it would be indistinguishable from random noise, so if you can see significant correlations in your string, you probably have imperfectly encrypted data, or straight up encoded plaintext.
-
To find this, you can find the "Index of Coincidence" for the string, or look for repeated blocks of code. If you find repeats, it’s either unencrypted, or, if the repeats are multiples of 16 bytes (or another suitable block length) long, then it might be ECB encoded (i.e. with the same 16 bytes key repeated through the data).
I would say your best bet would be to see how random your string is, if it’s really hard to find correlations, then it’s probably well encrypted. If the same bits of encrypted/encoded text keep popping up, it’s probably just encoded.