stats

package
v0.5.7 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 29, 2026 License: Apache-2.0 Imports: 3 Imported by: 0

Documentation

Overview

Package stats holds the cipher-agnostic statistical primitives the toolkit uses to triage a captured payload: is it plaintext, a weak classical cipher, an obfuscation, or strong encryption? Plus the repeating-key-XOR key-length estimators (Friedman/Hamming) and a crib-dragging helper for many-time-pad / keystream-reuse analysis.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func ByteFrequency 

func ByteFrequency(data []byte) [256]int

ByteFrequency returns the count of each byte value.

func ChiSquareUniform 

func ChiSquareUniform(data []byte) float64

ChiSquareUniform returns the chi-square statistic of the byte distribution against a uniform 256-value model. Near (256-1)=255 for uniform/random data; large for structured data.

func HammingDistance 

func HammingDistance(a, b []byte) int

HammingDistance returns the bit-difference count between equal-length byte slices. It panics if the lengths differ — callers slice first.

func IndexOfCoincidence 

func IndexOfCoincidence(data []byte) float64

IndexOfCoincidence returns the probability that two bytes drawn at random (without replacement) are equal. English text over the 26-letter alphabet sits near 0.066; uniform random over 256 values near 1/256.

func ShannonEntropy 

func ShannonEntropy(data []byte) float64

ShannonEntropy returns the per-byte Shannon entropy in bits (0..8). High values (~8) indicate compression or strong encryption; low values indicate structure (plaintext, weak ciphers, obfuscation).

Types

type DragHit 

type DragHit struct {
	Offset    int
	Revealed  []byte
	Printable bool
}

DragHit is one crib-drag position and the plaintext fragment it reveals in the other message when two ciphertexts share a keystream (c1 ^ c2 ^ crib).

func CribDrag 

func CribDrag(a, b, crib []byte) []DragHit

CribDrag slides crib across a^b (where a and b are two ciphertexts that reused the same keystream, so a^b = p_a ^ p_b) and reports, at each offset, the bytes the crib reveals in the partner plaintext. Offsets that reveal all-printable fragments are flagged — those are likely real.

type KeyLenScore 

type KeyLenScore struct {
	Length int
	Score  float64
}

KeyLenScore pairs a candidate repeating-XOR key length with its normalized average Hamming distance (bits/byte); the true length tends to minimize it.

func GuessXORKeyLength 

func GuessXORKeyLength(ct []byte, maxLen int) []KeyLenScore

GuessXORKeyLength ranks candidate key lengths for a repeating-key XOR ciphertext by averaging the normalized Hamming distance between adjacent key-length blocks (the Friedman/Kasiski idea). Lower score = more likely. Results are sorted best-first.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.