7 ms·

So, You Want to Learn to Break Ciphers

180 points by noch 6y ago

tptacek 6y ago
Somewhere on Reddit there's a great Mike Hamburg (I think?) comment about his approach to quickly analyzing new cipher designs --- is it linear? Can a SAT solver break it? There's more to it, but not much more, and it's one of the denser crypto comments I've read.
- chordalkeyboard 6y ago
  I’d be interested in reading it if anyone finds a link.
  - jdc 6y ago
    This should get you started if it is a Mike Hamburg comment: https://keybase.io/bitwiseshiftleft https://keybase.io/bitwiseshiftleft
    - chordalkeyboard 6y ago
      Thanks!
  - pbsd 6y ago
    Presumably https://www.reddit.com/r/crypto/comments/3or80y/i_designed_my_own_crypto/cvzvw7e/ https://www.reddit.com/r/crypto/comments/3or80y/i_designed_m...
    - chordalkeyboard 6y ago
      Thank you!
    - tptacek 6y ago
      I tried to double check whether this was the one, but got lost reading Mike Hamburg comments to verify it.
kwizzt 6y ago
I always wonder how people come up with the designs for various ciphers. When I took crypto class in uni, it all seems like different math/bit/word operations get randomly mashed up and repeated for several rounds. Is there a good resource for learning how to design ciphers? Edit: typo
- goldenkey 6y ago
  It all comes down to efficiently ranking and unranking permutations, at least for symmetric ciphers.
- dehrmann 6y ago
  This is sort of more interesting because modern ciphers are so much better than older ones. Between Caesar, Enigma, and AES, the growth in robustness seems exponential.
- BelenusMordred 6y ago
  > it all seems like different math/bit/word operations get randomly mashed up and repeated for several rounds Honestly think you have it down. /s Need to add some S-Boxes, P-Boxes and SP-Boxes though. The post-quantum stuff people are proposing now gets a bit hairy mathematically but lattices and their hardness properties are fairly easy to understand. Gimli is a cool place to start for anyone wanting to dip their toes in the water. It's a permutation in 30 lines or so. Building a cryptographic hash out of it is another 30 sloc. https://gimli.cr.yp.to/spec.html https://gimli.cr.yp.to/spec.html
- bawolff 6y ago
  Im not an expert, but i think it comes down to knowing how to break ciphers, and not doing any of those things. Most symmetric block ciphers involve something along the lines of mixing in the (sub) key, some linear permutations, some non-linear permutations, then repeat all 3 in many "rounds" You may also be interested in reading about https://en.wikipedia.org/wiki/Feistel_cipher https://en.wikipedia.org/wiki/Feistel_cipher and https://en.wikipedia.org/wiki/Substitution%E2%80%93permutation_network https://en.wikipedia.org/wiki/Substitution%E2%80%93permutati... which are generic designs for the parts of a block cipher.
bathtub365 6y ago
I’ve enjoyed starting to work through the exercises on Cryptopals[1]. It teaches you the underlying concepts for different ways of encrypting information and asks you to write code to break them. [1] https://cryptopals.com/ https://cryptopals.com/
- kitd 6y ago
  Cryptopals is great. I use it when I want to kick the tyres on a new language.
- Retr0spectrum 6y ago
  Cryptohack[1] is also great - it's a more gamified, CTF-like platform. [1] https://cryptohack.org/ https://cryptohack.org/
- zeroxfe 6y ago
  Cryptopals was by far the most fun and the most educational set of puzzles I've worked on. It was also a great way to spend my unemployed Covid summer, right after my startup went bust. I used Go to solve them, which are here incase anyone's interested: https://github.com/0xfe/cryptopals https://github.com/0xfe/cryptopals
baby 6y ago
Coincidentally I was reminded today that some students are using something I made a while back to learn about breaking AES: https://davidwong.fr/blockbreakers/ https://davidwong.fr/blockbreakers/
squeezingswirls 6y ago
I'm having fun reading and playing with 'Codebreaking, a practical guide' by Elonka Dunin & Klaus Schmeh. https://www.codebreaking-guide.com/ https://www.codebreaking-guide.com/
bbno4 6y ago
Shameless plug: I built a tool that's designed to automatically crack simple ciphers, encodings, hashes (soon™), esolangs and more :) https://github.com/ciphey/ciphey https://github.com/ciphey/ciphey

180 points by noch 6y ago

Somewhere on Reddit there's a great Mike Hamburg (I think?) comment about his approach to quickly analyzing new cipher designs --- is it linear? Can a SAT solver break it? There's more to it, but not much more, and it's one of the denser crypto comments I've read.

chordalkeyboard 6y ago
I’d be interested in reading it if anyone finds a link.
- jdc 6y ago
  This should get you started if it is a Mike Hamburg comment: https://keybase.io/bitwiseshiftleft https://keybase.io/bitwiseshiftleft
  - chordalkeyboard 6y ago
    Thanks!
- pbsd 6y ago
  Presumably https://www.reddit.com/r/crypto/comments/3or80y/i_designed_my_own_crypto/cvzvw7e/ https://www.reddit.com/r/crypto/comments/3or80y/i_designed_m...
  - chordalkeyboard 6y ago
    Thank you!
  - tptacek 6y ago
    I tried to double check whether this was the one, but got lost reading Mike Hamburg comments to verify it.

kwizzt 6y ago

I always wonder how people come up with the designs for various ciphers. When I took crypto class in uni, it all seems like different math/bit/word operations get randomly mashed up and repeated for several rounds. Is there a good resource for learning how to design ciphers? Edit: typo

goldenkey 6y ago
It all comes down to efficiently ranking and unranking permutations, at least for symmetric ciphers.
dehrmann 6y ago
This is sort of more interesting because modern ciphers are so much better than older ones. Between Caesar, Enigma, and AES, the growth in robustness seems exponential.
BelenusMordred 6y ago
> it all seems like different math/bit/word operations get randomly mashed up and repeated for several rounds Honestly think you have it down. /s Need to add some S-Boxes, P-Boxes and SP-Boxes though. The post-quantum stuff people are proposing now gets a bit hairy mathematically but lattices and their hardness properties are fairly easy to understand. Gimli is a cool place to start for anyone wanting to dip their toes in the water. It's a permutation in 30 lines or so. Building a cryptographic hash out of it is another 30 sloc. https://gimli.cr.yp.to/spec.html https://gimli.cr.yp.to/spec.html
bawolff 6y ago
Im not an expert, but i think it comes down to knowing how to break ciphers, and not doing any of those things. Most symmetric block ciphers involve something along the lines of mixing in the (sub) key, some linear permutations, some non-linear permutations, then repeat all 3 in many "rounds" You may also be interested in reading about https://en.wikipedia.org/wiki/Feistel_cipher https://en.wikipedia.org/wiki/Feistel_cipher and https://en.wikipedia.org/wiki/Substitution%E2%80%93permutation_network https://en.wikipedia.org/wiki/Substitution%E2%80%93permutati... which are generic designs for the parts of a block cipher.

bathtub365 6y ago

I’ve enjoyed starting to work through the exercises on Cryptopals[1]. It teaches you the underlying concepts for different ways of encrypting information and asks you to write code to break them. [1] https://cryptopals.com/ https://cryptopals.com/

kitd 6y ago
Cryptopals is great. I use it when I want to kick the tyres on a new language.
Retr0spectrum 6y ago
Cryptohack[1] is also great - it's a more gamified, CTF-like platform. [1] https://cryptohack.org/ https://cryptohack.org/
zeroxfe 6y ago
Cryptopals was by far the most fun and the most educational set of puzzles I've worked on. It was also a great way to spend my unemployed Covid summer, right after my startup went bust. I used Go to solve them, which are here incase anyone's interested: https://github.com/0xfe/cryptopals https://github.com/0xfe/cryptopals

baby 6y ago

Coincidentally I was reminded today that some students are using something I made a while back to learn about breaking AES: https://davidwong.fr/blockbreakers/ https://davidwong.fr/blockbreakers/

squeezingswirls 6y ago

I'm having fun reading and playing with 'Codebreaking, a practical guide' by Elonka Dunin & Klaus Schmeh. https://www.codebreaking-guide.com/ https://www.codebreaking-guide.com/

bbno4 6y ago

Shameless plug: I built a tool that's designed to automatically crack simple ciphers, encodings, hashes (soon™), esolangs and more :) https://github.com/ciphey/ciphey https://github.com/ciphey/ciphey