Security

Consider the following block cipher. Suppose that each block cipher T simply reverses the order of the eight input bits (so that, for example 11110000 becomes 00001111).

Further suppose that the 64-bit scrambler does not modify any bits. With n = 3 iterations and the original 64-bit input equal to 10100000 repeated eight times, what is the value of the output?

Now change the last bit of the original 64-bit input from 0 to a 1. Now suppose that the 64-bit scrambler inverses the order of the 64 bits.

Solution in python:

def chunks( l, n ):
    """accept a list and chuck size, return chunks"""
    return [ l[ i:i+n ] for i in range( 0, len(l), n ) ]

def T( blocks ):
    """for each block, reverse block, return blocks"""
    result = []
    for block in blocks:
        result.append( ''.join( [bit for bit in reversed( block )] ) )

    return result

def scrambler( input ):
    """inverse the order of input"""
    return ''.join( [i for i in reversed( input ) ] )

def cipher1( input, n = 3, chunk_length = 8 ):
    """make chucks out of input, reverse each chunk return result"""
    blocks = chunks( input, chunk_length )
    for i in range( 0, n ): blocks = T( blocks )
    return ''.join( blocks )

def cipher2( input, n = 3, chunk_length = 8 ):
    """same as cipher1 but with scrambler"""
    blocks = chunks( input, chunk_length )
    for i in range( 0, n ):
        blocks = T( blocks )
        blocks = chunks( scrambler( ''.join( blocks ) ), chunk_length )
    return ''.join( blocks )

if __name__ == "__main__":

    input = "1010000010100000101000001010000010100000101000001010000010100000"
    print cipher1( input )
    # output: 0000010100000101000001010000010100000101000001010000010100000101

    input = "1010000010100000101000001010000010100000101000001010000010100001"
    print cipher1( input )
    # output: 0000010100000101000001010000010100000101000001010000010110000101

    input = "1010000010100000101000001010000010100000101000001010000010100000"
    print cipher2( input )
    # output: 1010000010100000101000001010000010100000101000001010000010100000

    input = "1010000010100000101000001010000010100000101000001010000010100001"
    print cipher2( input )
    # output: 1010000110100000101000001010000010100000101000001010000010100000

Here is my implementation of a Monoalphabetic Cipher written with a python dictionary:

monoalpha = {
    'a': 'm',
    'b': 'n',
    'c': 'b',
    'd': 'v',
    'e': 'c',
    'f': 'x',
    'g': 'z',
    'h': 'a',
    'i': 's',
    'j': 'd',
    'k': 'f',
    'l': 'g',
    'm': 'h',
    'n': 'j',
    'o': 'k',
    'p': 'l',
    'q': 'p',
    'r': 'o',
    's': 'i',
    't': 'u',
    'u': 'y',
    'v': 't',
    'w': 'r',
    'x': 'e',
    'y': 'w',
    'z': 'q',
    ' ': ' ',
}

inverse_monoalpha = {}
for key, value in monoalpha.iteritems():
    inverse_monoalpha[value] = key

message = "This is an easy problem"
encrypted_message = []
for letter in message:
    encrypted_message.append( monoalpha[letter.lower()] )

print ''.join( encrypted_message )

The encrypted output: uasi si mj cmiw lokngch

Now we may use the inverse cipher to decrypt a message, “rmij’u uamu xyj”

encrypted_message = "rmij'u uamu xyj"
decrypted_message = []
for letter in encrypted_message:
    try:
        decrypted_message.append( inverse_monoalpha[letter] )
    except KeyError:
        decrypted_message.append( letter )

print ''.join( decrypted_message )

Decrypted message: wasn't that fun

Why does a Hash provide better message integrity then an Internet checksum?

A hash aims to produce a unique “key” without collisions. A hash also attempts to be computationally difficult to reverse.

An Internet checksum is designed to detect common errors quickly and efficiently. An Internet checksum does not attempt to prevent collisions.

A Hash provides better message integrity because it has less collisions then an Internet checksum. A collision means there is more then one way to produce the same sum.

Let H() be a hash function. Let x and y be two differing messages. H(x) = H(y) would be a collision.

When discussing Hash Cryptography I like to show examples using python.

In this example I will produce a MD5 hash fingerprint of a message:

import hashlib as h
message = "This message will be placed into an MD5 hash function to authenticate its integrity."
print h.md5(message).hexdigest()

Hash Output:
18f189f94b245ad8566206c199b4f60a

Now If I passed that message to you along with its MD5 hash hex representation, you could put the message into your own MD5 hash function and compare the resulting hash. This method is used to insure message or data integrity.

Can you “decrypt” a hash of a message to get the original message?

By design a good hash algorithm will prevent you from decrypting a hash to get the original message. However a rainbow table could be used to quickly find matches. In this case a more robust solution would be to use salt or shared secret.

What is salt or a shared secret?

You can use salt or a shared secret to add extra data to a message before hashing with a publicly known algorithm. Below I will document how to properly add salt to a message before generating a SHA256 hash.

import hashlib as h
message = "This message and some salt will be hashed with SHA 256."
salt = "This is some secret salt data"
print h.sha256(message+salt).hexdigest()

Hash Output:
5e8d86bab9604620f19cfbc5f836f47feb9e8c9e74264fff1f4938bdaab1eeaa

Adding a salt to the message allows us to use a publicly know algorithm in a more protected manner. This method helps protect against rainbow table cracking.

Can you spot the error in the python code below?

import hashlib as h
message = "This message and some salt will be hashed with SHA 256."
salt = "This is some secret salt data"
print h.sha256(message).hexdigest()+salt

If you guessed that the message and salt BOTH need to be hashed together then you are correct!

The above code would have produced the following invalid hash:

Hash Output:
79cd4bfa1bcb71a7a1b5bfd5e8cfc8368a6cc6cb836d24bf04f2ef2bd0e81261This is some secret salt data

You should follow me on twitter here.