7 ms·

This png encrypts to the same image

154 points by diafygi 12y ago

diafygi 12y ago
Command: openssl aes-128-cbc -K "55555555555555555555555555555555" -iv "83deccd3f93b37c70d37297f319cf367" -in WRxFKdq.png -out OMG_SAME_IMAGE.png Youtube Link: http://youtu.be/wbHkVZfCNuE http://youtu.be/wbHkVZfCNuE Previous discussion: https://news.ycombinator.com/item?id=7771568 https://news.ycombinator.com/item?id=7771568
- _nullandnull_ 12y ago
  Ange Albertini does some amazing work. If you haven't checked out his corkami repo I would highly recommend it. https://code.google.com/p/corkami/ https://code.google.com/p/corkami/
  - dfc 12y ago
    If you want the highlight reel: http://ange4771.imgur.com/ http://ange4771.imgur.com/
  - dominicgs 12y ago
    He's very enthusiastic about sharing his tricks too. I spent the day hanging out with him at Troopers in March and we spent a lot of time discussing the structure of PDFs. He's the one behind the file tricks in the journal of POC||GTFO - http://www.exploit-db.com/wp-content/themes/exploit/docs/pocorgtfo03.pdf http://www.exploit-db.com/wp-content/themes/exploit/docs/poc... In fact, he set a fun challenge - can you produce a PDF file that is different every time it's opened? e.g. a bingo card generator. The back of his business cards have cut down introductions versions of his posters, so everyone takes something away from meeting him. It's fun watching people decide which one they want.
userbinator 12y ago
Could this be considered a rather perverse form of a quine?
- recursive 12y ago
  If it was really a quine, the process could be repeated. This one works only once.
- colechristensen 12y ago
  It's not even all that perverse, it just so happens that this quine has a human reading and executing a few more steps in it's code than usual.
- im3w1l 12y ago
  See https://news.ycombinator.com/item?id=7775146 https://news.ycombinator.com/item?id=7775146 for the tldr of they did it. To make a real quine, you'd have to know a fixpoint (block) of AES. By appropriate choice (easy to compute) of IV and plaintext this could then be extended into an arbitrary length "quine". From my quick googling there doesn't seem to be any known fixpoints.
AdmiralAsshat 12y ago
Novelty aside, if you encrypt to the same image, what was the point of encrypting? Can you hide something in the metadata that wouldn't have been visible until decryption?
- yincrash 12y ago
  The visual image is the same, but the actual file is different. It basically stores a reverse encrypted (decrypted) version of the image as appended junk data.
  - yincrash 12y ago
    You can confirm this by diffing the resulting file.
  - Pxtl 12y ago
    Aww, that means you can't loop the process. OCR the text, run it, repeat.
- diafygi 12y ago
  The technique allows encryption from one image to another (doesn't have to be the same). I just made both images the same for fun.
  - deleted 12y ago
    [deleted]
- gfosco 12y ago
  This would be a great form of Steganography. [1] Obviously, not having it return the same image, but something different. Encrypting a given file into a valid image file (like a meme.) It would pass by many things without raising suspicion, and require private knowledge (key, iv) to recover the alternate payload. It might even be plausibly deniable. [1] http://en.wikipedia.org/wiki/Steganography http://en.wikipedia.org/wiki/Steganography
  - deleted 12y ago
theoh 12y ago
Reminds me of http://en.wikipedia.org/wiki/Tupper's_self-referential_formula http://en.wikipedia.org/wiki/Tupper's_self-referential_formu...
mey 12y ago
For others, you may find this http://projectnaptha.com/ http://projectnaptha.com/ useful to extract text from the image inside the browser.
- ultrafez 12y ago
  This image was the first time I've found it handy to have it installed. It's not as useful in day-to-day browsing as you might think.
  - MasterScrat 12y ago
    Indeed, and it takes quite some memory, and it's for me the first extension ever which actually crashed at some points (I'm using Chrome with a dozen other extensions installed).
- malkia 12y ago
  And for the first time, I got confused and thought it was text, not png (I've had Naptha installed few weeks ago).
yzzxy 12y ago
Similar: the creation of an image that is it's own histogram. http://www.ironicsans.com/2007/09/idea_the_histogram_as_the_imag.html http://www.ironicsans.com/2007/09/idea_the_histogram_as_the_...
- csense 12y ago
  Obligatory xkcd reference: http://xkcd.com/688/ http://xkcd.com/688/
  - dfc 12y ago
    The word you were looking for is perfunctory.
    - valleyer 12y ago
      Can you explain? “Obligatory” sounds reasonable here.
      - sockgrant 12y ago
        He's didn't mean obligatory was the wrong word. He's saying we could have done without the xkcd.
        jl6 12y ago
        Possibly derived from the Usenet habit of putting an "Ob" footer reference to a piece of pop culture, to demonstrate hipness.
        valleyer 12y ago
        Thanks, missed the snark.
Houshalter 12y ago
How on Earth does this work?
- mkesper 12y ago
  Yesterday's article was more helpful: https://speakerdeck.com/ange/when-aes-equals-episode-v https://speakerdeck.com/ange/when-aes-equals-episode-v

154 points by diafygi 12y ago

Command: openssl aes-128-cbc -K "55555555555555555555555555555555" -iv "83deccd3f93b37c70d37297f319cf367" -in WRxFKdq.png -out OMG_SAME_IMAGE.png Youtube Link: http://youtu.be/wbHkVZfCNuE http://youtu.be/wbHkVZfCNuE Previous discussion: https://news.ycombinator.com/item?id=7771568 https://news.ycombinator.com/item?id=7771568

_nullandnull_ 12y ago
Ange Albertini does some amazing work. If you haven't checked out his corkami repo I would highly recommend it. https://code.google.com/p/corkami/ https://code.google.com/p/corkami/
- dfc 12y ago
  If you want the highlight reel: http://ange4771.imgur.com/ http://ange4771.imgur.com/
- dominicgs 12y ago
  He's very enthusiastic about sharing his tricks too. I spent the day hanging out with him at Troopers in March and we spent a lot of time discussing the structure of PDFs. He's the one behind the file tricks in the journal of POC||GTFO - http://www.exploit-db.com/wp-content/themes/exploit/docs/pocorgtfo03.pdf http://www.exploit-db.com/wp-content/themes/exploit/docs/poc... In fact, he set a fun challenge - can you produce a PDF file that is different every time it's opened? e.g. a bingo card generator. The back of his business cards have cut down introductions versions of his posters, so everyone takes something away from meeting him. It's fun watching people decide which one they want.

userbinator 12y ago

Could this be considered a rather perverse form of a quine?

recursive 12y ago
If it was really a quine, the process could be repeated. This one works only once.
colechristensen 12y ago
It's not even all that perverse, it just so happens that this quine has a human reading and executing a few more steps in it's code than usual.
im3w1l 12y ago
See https://news.ycombinator.com/item?id=7775146 https://news.ycombinator.com/item?id=7775146 for the tldr of they did it. To make a real quine, you'd have to know a fixpoint (block) of AES. By appropriate choice (easy to compute) of IV and plaintext this could then be extended into an arbitrary length "quine". From my quick googling there doesn't seem to be any known fixpoints.

AdmiralAsshat 12y ago

Novelty aside, if you encrypt to the same image, what was the point of encrypting? Can you hide something in the metadata that wouldn't have been visible until decryption?

yincrash 12y ago
The visual image is the same, but the actual file is different. It basically stores a reverse encrypted (decrypted) version of the image as appended junk data.
- yincrash 12y ago
  You can confirm this by diffing the resulting file.
- Pxtl 12y ago
  Aww, that means you can't loop the process. OCR the text, run it, repeat.
diafygi 12y ago
The technique allows encryption from one image to another (doesn't have to be the same). I just made both images the same for fun.
- deleted 12y ago
  [deleted]
gfosco 12y ago
This would be a great form of Steganography. [1] Obviously, not having it return the same image, but something different. Encrypting a given file into a valid image file (like a meme.) It would pass by many things without raising suspicion, and require private knowledge (key, iv) to recover the alternate payload. It might even be plausibly deniable. [1] http://en.wikipedia.org/wiki/Steganography http://en.wikipedia.org/wiki/Steganography
- deleted 12y ago

theoh 12y ago

Reminds me of http://en.wikipedia.org/wiki/Tupper's_self-referential_formula http://en.wikipedia.org/wiki/Tupper's_self-referential_formu...

mey 12y ago

For others, you may find this http://projectnaptha.com/ http://projectnaptha.com/ useful to extract text from the image inside the browser.

ultrafez 12y ago
This image was the first time I've found it handy to have it installed. It's not as useful in day-to-day browsing as you might think.
- MasterScrat 12y ago
  Indeed, and it takes quite some memory, and it's for me the first extension ever which actually crashed at some points (I'm using Chrome with a dozen other extensions installed).
malkia 12y ago
And for the first time, I got confused and thought it was text, not png (I've had Naptha installed few weeks ago).

yzzxy 12y ago

Similar: the creation of an image that is it's own histogram. http://www.ironicsans.com/2007/09/idea_the_histogram_as_the_imag.html http://www.ironicsans.com/2007/09/idea_the_histogram_as_the_...

csense 12y ago
Obligatory xkcd reference: http://xkcd.com/688/ http://xkcd.com/688/
- dfc 12y ago
  The word you were looking for is perfunctory.
  - valleyer 12y ago
    Can you explain? “Obligatory” sounds reasonable here.
    - sockgrant 12y ago
      He's didn't mean obligatory was the wrong word. He's saying we could have done without the xkcd.
      - jl6 12y ago
        Possibly derived from the Usenet habit of putting an "Ob" footer reference to a piece of pop culture, to demonstrate hipness.
      - valleyer 12y ago
        Thanks, missed the snark.

Houshalter 12y ago

How on Earth does this work?

mkesper 12y ago
Yesterday's article was more helpful: https://speakerdeck.com/ange/when-aes-equals-episode-v https://speakerdeck.com/ange/when-aes-equals-episode-v