3 ms·

I don't have time to analyze it carefully, but you have created a stream cipher. It is actually quite fun to implement ciphers and learn about all of the variou

I don't have time to analyze it carefully, but you have created a stream cipher. It is actually quite fun to implement ciphers and learn about all of the various attacks. If you are to be serious about this you should really not start from a pure product of your mind, but learn about the latest and greatest techniques. The academic field of cryptography doesn't move /that/ quickly, so it is quite reasonable to keep up with it if you are passionate about it. You can do much better with just a little knowledge about basic attacks. You can basically keep designing algorithms that fewer and fewer people can break until you reach the point where no one can break it with known, modern, academic cryptanalytic techniques. And when you get there... you might be a Cryptographer :) http://en.wikipedia.org/wiki/Stream_cipher_attack http://en.wikipedia.org/wiki/Stream_cipher_attack -- in particular, the period of your key stream is very weak. Also, without an IV, you will be in trouble. Essentially, you need to take a key, and an IV, and feed it into your magic box (algorithm) and all that should come out is an incredibly long random string that does not repeat for a very, very long time. The shorter the period the worse off you are. I can't be sure, but I think you have a predictable, short period. Even more interesting, read up on RC4: http://en.wikipedia.org/wiki/RC4 http://en.wikipedia.org/wiki/RC4 -- there were small but detectable biases in the initial part of the key stream, which allowed an attacker to break the algorithm. The solution was to advance the key stream a bit to discard the initial, biased part. And thus we get to the hardest part of cryptographic algorithm design and why these exercises are so hard. It is very easy for someone to build an algorithm they can't break themselves. Obviously, you did everything you knew how to do to prevent it from being broken. It might even take an experienced cryptographer a while to break it (the key stream bias in RC4 was not found for a long time). Check out some of the WEP attacks. Another thought for you: http://www.rickwash.org/papers/stream.pdf http://www.rickwash.org/papers/stream.pdf -- just how easy it is to be wrong. Page 8: If the swap operation of RC4 is omitted, the keystream becomes cyclic with a period of 2 n+1 -- very small changes can introduce non-obvious periods, etc. Final thought: check out how WEP got broken. Stream ciphers are hard. This is why it is often very good as an educational exercise to write your own ciphers (I have done it), but you sort of do it once and either decide to get good at it or realize it takes a LOT of knowledge and it is better to just know the attacks and not invest a lot of time in it. Anyhow, hope you had fun with this. Read up on the various ways stream cipher design can be broken, and check out how AES can be used as a stream cipher. Not sure I had a point, precisely, just wanted to share some thoughts having seen a dozen or more of these crazy algorithms in use in live code meant to protect truly sensitive data. Some programmer always thinks he is clever and ends up creating some XOR cipher (I know that is not you as you have the right goals, in my mind, for doing this).

pjbrunet 13y ago
Fewer and fewer people. The art world is similar. Artists should be aware what other artists have done, to not do something unoriginal unintentionally. But that's hard work because it requires so much time/energy to investigate. So the hard work of art criticism falls on the non-artist who can dedicate him/herself to the task full-time. My analogy is the critic is the codebreaker and the artist is the code-maker. Artists make great critics because they have inside knowledge of how the moves (decisions) are made. But artists often lack the historical perspective, awareness of emerging work and (while I can't read anyone's mind) they typically lack the vocabulary to discuss their decisions analytically. But splitting up the work allows for more specialization. They're both specialists with tons of overlap but they have different goals. So maybe the cryptography world will make the same split, if it hasn't already? Crypto-artists dedicated to creating complexity and then historian-critic-codebreakers to determine the value (strength?) of what was created. They need each other. One creates, the determines the value of it. Anyway, as in art, "naiveté" (no formal education) can sometimes lead to a surprising breakthrough. While it's rare for an uneducated artist to do something interesting, I believe education hinders creativity in some instances. Though most unschooled artists, most of the time, tend to produce the same cliché results as predecessors, they do have the advantage of always thinking outside the box because the box is invisible to them. So outsiders can get breathtakingly weird results sometimes and part of that weirdness is due to their lack of education. It seems to me cryptography is like art in that originality is a goal. In non-objective art especially, you don't want anything recognizable. Like cryptography, non-objective art conceals the true meaning behind the intent. Sometimes cryptography and art even conceal the intent. So creativity allows for infinite approaches and therefore infinite ways to conceal information. Anyway, I don't plan to become a cryptographer but I think it's a cool analogy (to compare to art) and would be interested in learning more about the "big picture" of cryptography if there are any good books on the subject, even if it's fiction.
- bitexploder 13y ago
  This is a good point. The interesting there here is the raw level of information you need to have to even hope to do something new. From a period, say WWII up to when Shannon was just doing his seminal work, you could think maybe a little on a fairly broad area, and maybe come up with something new. Now, as with many areas of academic thinking, you have to learn so much just to get to a point where you can advance a really small piece of state of the art just a little bit. I think a lot of real math and academic work follows this pattern, and it is the reason one has a right to be skeptical, or even dismissive, of someone doing something like this if they were to present it as a serious work. "Here, try to break this". It is great for someone to learn the true scope of their ignorance, but at the same time, it is also so unlikely you have done even the tiniest novel thing that it is almost always OK to dismiss it out of hand. Cryptography is really just an applied branch of math/information theory. Things that work for advancing the state of art for math are generally the same tools that work for advancing the state of art for cryptography. In the raw, pure and abstract sense. In the practical world, where you have to have real bits on real physical things, the attacks are myriad and the innovators in that space often need minimal training in cryptography (relative to someone doing the theoretical work).

pjbrunet 13y ago

Fewer and fewer people. The art world is similar. Artists should be aware what other artists have done, to not do something unoriginal unintentionally. But that's hard work because it requires so much time/energy to investigate. So the hard work of art criticism falls on the non-artist who can dedicate him/herself to the task full-time. My analogy is the critic is the codebreaker and the artist is the code-maker. Artists make great critics because they have inside knowledge of how the moves (decisions) are made. But artists often lack the historical perspective, awareness of emerging work and (while I can't read anyone's mind) they typically lack the vocabulary to discuss their decisions analytically. But splitting up the work allows for more specialization. They're both specialists with tons of overlap but they have different goals. So maybe the cryptography world will make the same split, if it hasn't already? Crypto-artists dedicated to creating complexity and then historian-critic-codebreakers to determine the value (strength?) of what was created. They need each other. One creates, the determines the value of it. Anyway, as in art, "naiveté" (no formal education) can sometimes lead to a surprising breakthrough. While it's rare for an uneducated artist to do something interesting, I believe education hinders creativity in some instances. Though most unschooled artists, most of the time, tend to produce the same cliché results as predecessors, they do have the advantage of always thinking outside the box because the box is invisible to them. So outsiders can get breathtakingly weird results sometimes and part of that weirdness is due to their lack of education. It seems to me cryptography is like art in that originality is a goal. In non-objective art especially, you don't want anything recognizable. Like cryptography, non-objective art conceals the true meaning behind the intent. Sometimes cryptography and art even conceal the intent. So creativity allows for infinite approaches and therefore infinite ways to conceal information. Anyway, I don't plan to become a cryptographer but I think it's a cool analogy (to compare to art) and would be interested in learning more about the "big picture" of cryptography if there are any good books on the subject, even if it's fiction.

bitexploder 13y ago
This is a good point. The interesting there here is the raw level of information you need to have to even hope to do something new. From a period, say WWII up to when Shannon was just doing his seminal work, you could think maybe a little on a fairly broad area, and maybe come up with something new. Now, as with many areas of academic thinking, you have to learn so much just to get to a point where you can advance a really small piece of state of the art just a little bit. I think a lot of real math and academic work follows this pattern, and it is the reason one has a right to be skeptical, or even dismissive, of someone doing something like this if they were to present it as a serious work. "Here, try to break this". It is great for someone to learn the true scope of their ignorance, but at the same time, it is also so unlikely you have done even the tiniest novel thing that it is almost always OK to dismiss it out of hand. Cryptography is really just an applied branch of math/information theory. Things that work for advancing the state of art for math are generally the same tools that work for advancing the state of art for cryptography. In the raw, pure and abstract sense. In the practical world, where you have to have real bits on real physical things, the attacks are myriad and the innovators in that space often need minimal training in cryptography (relative to someone doing the theoretical work).