Identifying this cipher

The fear of every surveillance society: citizens protecting their own privacy with strong cryptography

Identifying this cipher

Post by Caesar13 on Wed Mar 09, 2016 7:10 pm
([msg=91853]see Identifying this cipher[/msg])

I'm trying to decode this ciphertext, and I'm failing at figuring out what cipher made it so I've broke my lurker status to ask for help. The one thing I know is that the plaintext is written in Swedish. Here's the ciphertext:
RGUgc2l3.mZnJvciBzb20gaW50ZSBo9nIgdGlsbCBC
YXNlNjQta29kZW4g5HIgDQ2.ptYXJrZXJhZGUgbWVk
IHB1bmt0ZXIgZW9.Z0ZXLldCBvY2ggc2thbGwgDQpl
eH9.RyYWhlcmFzLiBEZXQg5HIgZGVjaW1hbGVyIEkg
ZXR0IHRhbCBzb200.gDQpza2FsbCBlZnRlcmJlaGFu
ZGxhcy4uLiBUYWxldCDkciBtaW1.5kcmUg5G4gMS4N
Cg0KUmVzdWx0YXR4.ldCDkciBkZWNpbWFsZXIgaSBl
dHQgbnl0dCB0YWwgc29tIG97.ja3PlDQrkciBtaW5k
cmUg5G4g2.MS4gIFPkdHQgZGVjaW1hbGVybmEgaSBy
5HR0IGZvcm1hdCANCiAgKHh45.IHh4Lnh4eCB4eH8.
ggeHgu7.eHh4KSANCnPlIGblc4.iBkdSBrb29yZGlu
YXRl9.cm5hIA0KDQpMeWNrYSB0aWxs0.IQ0K

Now the strange part is that I am able to decode parts of the message using base64, but the majority remains unintelligible. Here's how it looks after using one base64 decoder:
De siw™™É½ÈÍ½´¥¹Ñ”£Ùȁѥ±° …Í”Øе­½‘•¸ƒ‘È€46¦Ö&¶W&FRÖVBVæ·FW"Võ\¹]ØÚÚØ[B™^Ôraheras. Det är decimaler I ett tal som4€4)Í­…±°•™Ñ•É‰•¡…¹‘±…̸¸¸Q…±•Ðƒ‘ȁµ¥µæG&RFâàРХ&W7VÇFG‰]9ˆXÚ[X[\ˆH]ž][ÛÛHÞãkså är mindre än Øĸ€O‘ÑЁ‘•¥µ…±•É¹„¤Ë‘ÑЁ™½Éµ…Ѐ4(€€¡áã’‡‚燇‚‡‡ò »xxx) så fåsˆ‘ԁ­½½É‘¥¹…Ñ—×&æРФǖ6¶F–ÆÍCB

However using another produces a different result:
De siwþfg&÷"6öÒ–çFRg"F–ÆÂÿÿØ\ÙM ZÛÙ[ˆ9ˆÿÿ鵅ɭ•É…‘”µ•ÿòVæ·FW"Vÿöteråt och skall
eýáýý˜Z\˜\ˈ]9ˆXÚ[X[\ˆÿÿÿett tal som4þЧ6¶ÆÂVgFW&&V†ÿÿÙ\ˋ‹ˆ[]9ˆZÿÿù‘É”ƒ‘¸€Ä¸ÿð Ð¥&W7VÇFÿÿåt är decimaler i eýÑЁ¹åÑЁх°Í½´½ÿøÚÜùCB¹ˆZÿÿÿre än ÿóâ>GGBFV6–ÖÆW&æ’ÿÿù›Ü›X]Bˆ
9üáà¹ááàááüÿø xx.ÿ÷‡‡‚’Ч>RnW8þ du koordiný…Ñÿÿܛ˜HBƒB“XÚØH[4ü„4(

I really have no clue what to do from here. Is it so simple that the tools I'm using can't handle the swedish alphabet or something? I haven't been able to find any free tools that can decode bases other than 64, 32, 16 and 85. Only 64 yielded a result of some sort.

Also, here's the translations of the swedish words/phrases I've found, if that helps anyone:
De = They or The
Det är decimaler i ett tal som = There are decimals in a number that
Är mindre än = Is smaller than
Och skall = And shall
Än = Than
Du koordinater (I'm guessing that du koordin is du koordinater) = You coordinates
Caesar13
New User
New User
 
Posts: 1
Joined: Wed Mar 09, 2016 6:26 pm
Blog: View Blog (0)


Re: Identifying this cipher

Post by Jbraithwaite on Thu Mar 10, 2016 6:33 am
([msg=91871]see Re: Identifying this cipher[/msg])

Looks like something that's been pulled out of an SSL certificate. Pretty impossible to decipher really without both having the private key. Assuming of course that's what it is.
In training....
Jbraithwaite
Poster
Poster
 
Posts: 198
Joined: Tue Nov 10, 2015 4:35 am
Location: Whatever my VPN says.
Blog: View Blog (0)


Re: Identifying this cipher

Post by boriz666 on Thu Mar 10, 2016 7:37 am
([msg=91872]see Re: Identifying this cipher[/msg])

We will likely need a bit more information.

Where is the cipher text from?

Its a none standard base64 encoding which use . as the 63rd char so
i doubt its any modern cert part. the garbeled parts are likely
padding of some sort.

Gif more info of where you got it.
boriz666
Experienced User
Experienced User
 
Posts: 99
Joined: Tue Mar 24, 2015 11:53 am
Blog: View Blog (0)


Re: Identifying this cipher

Post by cyberdrain on Thu Mar 10, 2016 7:15 pm
([msg=91883]see Re: Identifying this cipher[/msg])

I think I cracked part of it, the dots indicate where the message shifts, so replacing '.' with 'aaa' in the message you get the following:

De siwi¦¦fror som inte hör till Base64-koden är

šiªmarkerade med punkter eoZi¦teråt och skall
exZi¤raheras. Det är decimaler I ett tal som4i¦
skall efterbehandlas... Talet är mimZi®dre än 1.

Resultatxi¦¥t är decimaler i ett nytt tal som o{i¦£kså
är mindre än Ù¦š1. Sätt decimalerna i rätt format
(xx妚 xx.xxx xxi¨ xx.í¦šxxx)
så fås†šj du koordinateõ¦šrna

Lycka tillѦš!


You can just ignore the extra data those 'aaa' create. Could you translate this part of the message for us?
Free your mind / Think clearly
User avatar
cyberdrain
Expert
Expert
 
Posts: 2160
Joined: Sun Nov 27, 2011 1:58 pm
Blog: View Blog (0)


Re: Identifying this cipher

Post by boriz666 on Fri Mar 11, 2016 4:10 am
([msg=91889]see Re: Identifying this cipher[/msg])

Rough Translation:

Those characters which doesn't belong to the Base64-code are
marked with dots and must be extracted. It is decimals in a number
which must be postprocessed.. the number is less than 1.

The result is fractions in a new numbers that is also less then 1.
Put the fractions togeter in a format
(xxxx.xxxx.xxxx.xxxx) then you got the coordinates.

Good Luck!


----

Maybe this is part of some geocaching mission?
boriz666
Experienced User
Experienced User
 
Posts: 99
Joined: Tue Mar 24, 2015 11:53 am
Blog: View Blog (0)


Re: Identifying this cipher

Post by -Ninjex- on Fri Mar 11, 2016 5:49 am
([msg=91893]see Re: Identifying this cipher[/msg])

I think these are the numbers you will be working with:
3299014725874900

(3299.0147.2587.4900)
image
For those that know
K: 0x2CD8D4F9
User avatar
-Ninjex-
Moderator
Moderator
 
Posts: 1691
Joined: Sun Sep 02, 2012 8:02 pm
Blog: View Blog (0)


Re: Identifying this cipher

Post by cyberdrain on Fri Mar 11, 2016 7:14 am
([msg=91896]see Re: Identifying this cipher[/msg])

-Ninjex- wrote:I think these are the numbers you will be working with:
3299014725874900

(3299.0147.2587.4900)

So what about the post-processing then? Whatever is meant here might be lost in translation. Using the correct way to decode the BASE64, the "xx xx.xxx xxx xx.xxx" system (latitude xx° xx'xxx N, longitude xxx° xx'xxx E probably) should be used for the coordinates.

Automatic translation (changed a bit) wrote:The numbers that do not belong in the Base64 code are marked with dots after them and should be extracted. These are decimals in a number to be finished ... The number is less than 1. The result is the decimals for a new figure which is also less than 1. Put the decimals in the correct format (xx xxx xx.xxx xx.xxx) to get coordinates. Good luck!

I tried looking for pi or e constants inside the numbers, the first few decimals don't seem to be there. Which decimals should be post-processed or finished and into what? I don't think the translation is quite correct yet.
Free your mind / Think clearly
User avatar
cyberdrain
Expert
Expert
 
Posts: 2160
Joined: Sun Nov 27, 2011 1:58 pm
Blog: View Blog (0)



Return to Crypto

Who is online

Users browsing this forum: No registered users and 0 guests