Modern encryption algorithms such as AES and DES are designed to produce ciphertext outputs that appear statistically indistinguishable from noise. Assembled into random characters, encrypted text functions to mask patterns and resist statistical analysis. This study aims to investigate whether statistical features extracted from ciphertext chunks can be used to retrace which encryption algorithm was used, and specifically how the inclusion or exclusion of certain statistical features affects classification accuracy. We encrypted four literary texts using three cipher configurations, including AES-CBC, AES-ECB, and DES-ECB. Using these, ten features from 128-byte ciphertext chunks were extracted. We trained a Random Forest classifier on these features and used an analysis in which each feature was systematically removed to measure its contribution to overall accuracy. Our results indicate that three-way classification (AES-CBC vs. AES-ECB vs. DES-ECB) achieves 61.9% accuracy compared to a 33.3% baseline, while two-way classification (AES vs. DES) achieves a 92.8% accuracy. The large accuracy gap between the two tests suggests that choosing between two encryption algorithms leaves stronger statistical differences in ciphertext than choosing between two modes of the same algorithm (CBC vs. ECB). Mean byte value and maximum byte frequency are the most important features, while some top byte frequency features appear to contribute noise, though inconsistently. McNemar's test did not confirm statistical significance for any individual feature removal (all p > 0.05), perhaps due to the limited test set size (n = 48). Our results demonstrate that encryption algorithms leave detectable statistical fingerprints, and that feature selection can allow us to exploit those differences.
Parthasarathy et al. (Sun,) studied this question.