Beefy Boxes and Bandwidth Generously Provided by pair Networks
laziness, impatience, and hubris
 
PerlMonks  

Re: Re: How to tell if something is encrypted

by nardo (Friar)
on Apr 18, 2001 at 21:30 UTC ( [id://73590]=note: print w/replies, xml ) Need Help??


in reply to Re: How to tell if something is encrypted
in thread How to tell if something is encrypted

If the file were an uncompressed binary, it would likely have a proportionally high number of 0x00 characters. If the file were a compressed file, it would have a proportionally high number of 0x00 characters near the beginning of the file, but not so much in the remainder of the file. If the file is encrypted, there is unlikely to be a high proportion of 0x00 characters.
  • Comment on Re: Re: How to tell if something is encrypted

Replies are listed 'Best First'.
(tye)Re: How to tell if something is encrypted
by tye (Sage) on Apr 18, 2001 at 21:40 UTC

    A compression mechanism that always results in a non-uniform distribution of 0-bytes within the output isn't doing the best compression it could.

    Well-compressed output, well-encrypted output, and random output should all be indistinguishable.

            - tye (but my friends call me "Tye")
      You will often need to store some uncompressed information in a compressed file. Information about the compressed data (length, flags, etc.) is usually uncompressed. Integers within the header may contain a 0x00 because of an unused high order byte, and flags often use 0 as the default value. You can usually count on a header being at the beginning of the file, so you will probably find a few 0x00's at the beginning of a compressed file, and because there may be additional headers for additional compressed blocks throughout the file, there will not be a random distribution of 0x00's throughout the file.

        "zip" files fit your description quite nicely (I can't believe that having 20 of the first 29 bytes of a file be zero makes sense when you are trying to compress things -- like I said, they aren't doing the best compression they could).

        The "gzip" files I checked had about 2 zero bytes in the first 10 bytes. This is much more reasonable in my book but also fits your description so...

        I conceed the point; you are right. (:

                - tye (but my friends call me "Tye")

Log In?
Username:
Password:

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: note [id://73590]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this?Last hourOther CB clients
Other Users?
Others sharing their wisdom with the Monastery: (6)
As of 2024-04-23 19:19 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    No recent polls found