Encrypt with one cipher and decrypt with a different cipher? I recently installed an android app called Secret Space Encryptor and think I found a serious flaw in it.

Let me explain: This app provides a variety of different ciphers to use and I used Threefish 1024 to encrypt a test message with "Your Key" as the key.

I then saved the ciphertext to a text file using the export function in the app. Then I changed the text encryption program in the app to use Blowfish 448 and imported the TF-1024 encrypted message into the app once more.

I then entered the "Your Key" test key and to my total surprise the message successfully decrypted! I encrypted a message with one cipher and then decrypted that same message with a totally different cipher! 

Now this should be totally impossible right? If so then is there a deadly flaw in this app?
I've checked out the source code (well, more or less, it's not that well designed, the main crypto class is 1600 lines) and as Richie guessed, the algorithm is stored together with the ciphertext.

Pretty gruesome stuff, but it does do EAX mode for text strings to my surprise. It probably only uses it for text strings originating from the password vault code though.

File encryption is performed in CBC mode. It does (ZIP) compress and stream files using CBC mode. It uses a static IV but this is offset by a random header that is included into the encryption.

This is a homegrown project with little documentation or comments in the code and a  slightly erratic class design.



Thanks go out to Tron to supply us the link to the format defition on the Paranoiaworks website.