Friday, September 15, 2006

Crypt::Lite

Continued from http://cpanratings.perl.org/dist/Crypt-Lite

Welcome back.

No one of you have come to the point about the statistical facts. Of course I'm not an expert (and have never told smth like that!). But just wondering in general about a smart answer to one of the following questions.
  • How would you crack an encrypted text if the characters are distributed evenly?
  • What if you can't expect a long sentence written in a known language?
  • Why is a One-time hash safe under certain conditions? It's nothing else than a XOR encrpytion, isn't it?
  • Was Tripple-DES a factual error?
Not only the installation of strong crypto libs may be a pain, the usage of block ciphers as well -
please don't tell me they're much more secure - I know that already!

2 comments:

Ask Bjørn Hansen said...

Why is a One-time hash safe under certain conditions

It's safe when the *key* is the same size as the message.

(IIRC etc etc; I'm not an expert on such matters either -- which is why I'm not writing any Crypt::* modules!)


- ask

Eugene van der Pijll said...

A xor-based encryption is only good if each character of the key is used only once. This means that every key should only be used once, and that you should not encrypt a message that is longer than your key. But given these constraints, a one-time pad is unbreakable, and your module would not have any advantage over a simple xor.

In your example on cpanratings, you used a 17 byte key to encode a message of about 5 times that length. That is enough to recover about half of the key, and therefore half of the message. Because you also encode the key, this means that I also found half of the remainder of the secret key, etc.

If you still believe your key to be good, post an encoded message here. If it's more than 5 times the length of the key, I'll post the solution here. (As long as it's in a language I know, and there are messages that cannot be decoded. If you pick a normal, random sentence, though, it can be recovered.)