Re: [PEN-TEST] Tool to find out if file is encrypted

[Crist Clark <crist.clark () GLOBALSTAR COM>]

Brian Russo wrote:
> On Tue, Dec 05, 2000 at 08:13:12AM +0100, Pawe? Krawczyk wrote:
> > On Mon, Dec 04, 2000 at 09:38:05PM -0500, crazytrain.com wrote:
> >
> > > Someone posted recently about a tool to find if a file is encrypted?  I use
> > > IsEncrypted
> > > for just this job.  It's by AccessData.
> >
> > The kind of tools can in general work in two ways - either recognizing
> > known encrypted file formats (OpenPGP, S/MIME etc.) or estimating
> > the file's randomness. For the latter you have an utility in
> > The Coroner's Toolkit by Dan Farmer and Wietse Venema. See
> > http://www.porcupine.org/forensics/
>
> Another thing you can try is to compress the file, and see how it does.
>
> e.g.
>
>    4 -rw-r-----    1 brian    brian         465 Dec  5 15:28 foo
>    4 -rw-r-----    1 brian    brian         847 Dec  5 15:30 foo.gpg
>    4 -rw-r-----    1 brian    brian         878 Dec  5 15:30 foo.gpg.gz
>
> As you can see, the gpg'd (2048 ELG) file doesn't really compress at all,
> actually gets a bit bigger due to some overhead, because this lossless
> compression can't function well when the input is pretty random.

Or it is a sign the data was already compressed. IIRC, gpg is going
to compress by default before doing its encryption. Did you make sure
to disable compression ('-z 0' I believe) when you did this test? What
difference, if any, does it make? I'm curious.

> Granted, this doesn't tell you a lot about the input, but it's somewhat
> unusual to have data that isn't encrypted, and has very high entropy
>  - unless of course, it actually is just meaningless randomish garbage.

This is obviously not true. Compressed data is neither "meaningless,
randomish garbage" nor is it encrypted, but it does have a high entropy
per byte (or some measure of data size).
--
Crist J. Clark                                Network Security Engineer
crist.clark () globalstar com                    Globalstar, L.P.
(408) 933-4387                                FAX: (408) 933-4926