3

What I tried to do here is create a function that will encrypt the same input into completely different output every time it is called. The base of this function is xor, but to prevent easy spotting of repetitive patterns in string. I added random hashing based on time and portion of a string to self-verify on decription.

All I ask for is if I made any kind of errors here that could reveal hidden text to experienced person without doing a brute force on the string. (I know that php has a module just for encryption but this is a poor mans version in case encryption module is not available.) Second: I do not ask you to rewrite this functions or to write something for me, what I ask is for a simple guidance what I have done wrong. I know that one possible security breach is that I use salsa by default, which is all zeros for empty string, but advantage is that this is the longest hash available in php, and second, what fool will use empty password to protect their data ?

function crapt($str,$pass,$hmac = false,$meth = 'salsa20') {
   $hash = pack('H*',($hmac===false) ? hash($meth,$pass) : hash_hmac($meth,$pass,$hmac));
   $str = gzdeflate($str,9);
   $tmphash = pack('H*',sha1(sin(microtime(1))));
   $str = $tmphash.((string)$str ^ (string)str_repeat($tmphash,strlen($str)/strlen($tmphash)+1));
   $str .= pack('H*',sha1($str));
   return (string)$str ^ (string)str_repeat($hash,strlen($str)/strlen($hash)+1);
}

function decrapt($str,$pass,$hmac = false,$meth = 'salsa20') {
  $hash = pack('H*',($hmac===false) ? hash($meth,$pass) : hash_hmac($meth,$pass,$hmac));
  $str = (string)$str ^ (string)str_repeat($hash,strlen($str)/strlen($hash)+1);
  $check = substr($str,-20);
  $str = substr($str,0,strlen($str)-20);
  if(pack('H*',sha1($str))!==$check) return false;
  $tmphash = substr($str,0,20);
  $str = substr($str,20);
  return gzinflate((string)$str ^ (string)str_repeat($tmphash,strlen($str)/strlen($tmphash)+1));
}

var_dump(decrapt(crapt('sometext','secretpassword'),'secretpassword'));
3
  • 2
    +1 for crapt and decrapt. :-D Commented Dec 23, 2010 at 22:38
  • PHP should always have its encryption module available. Please use it: it's extremely hard to do encryption right. Compress the input, generate a random IV, and encrypt using CBC mode with Rijndael. Prepend the unencrypted IV to the encrypted text so that it can be used in decryption.
    – Olathe
    Commented Jan 1, 2011 at 20:01
  • 1
    If you're interested in crypto, please feel invited to join cryptography.SE.
    – e-sushi
    Commented Aug 1, 2013 at 11:00

3 Answers 3

13

Any cipher you invent yourself will undoubtedly have vulnerabilities - and if those of us on Stack Overflow can't detect it, that doesn't mean someone else won't. The first rule of cryptography is not to invent your own: use existing ciphers, and where possible, well known and tested implementations. If you absolutely can't use a standard library, implement an existing cipher, such as TEA - or better, find an existing implementation in your language of choice.

5
  • +1 I don't know about TEA but really the important part is to don't invent it yourself. There is NO REASON whatsoever to do that and the result will most likely not be better, easier or in any way preferable to what is already there for you to use.
    – Fredrik
    Commented Dec 23, 2010 at 23:16
  • @Fredrik I only suggest TEA because it's extremely simple to implement, if he insists on writing it himself, and it's had some degree of peer review. Obviously if he's using an existing library, something better known like AES would be a better choice. Commented Dec 23, 2010 at 23:24
  • Sure, I didn't mean to object, I just didn't have an opinion about it.
    – Fredrik
    Commented Dec 23, 2010 at 23:38
  • @Fredrik Didn't think you were - I just wanted to clarify my reasoning. Commented Dec 24, 2010 at 2:15
  • I found this about xxtea (the supposedly better version of tea) cipherdev.org/break-xxtea.c.txt .
    – rsk82
    Commented Dec 24, 2010 at 6:14
7

Your algorithms operates in blocks of length strlen($hash)==strlen($tmphash). EDIT: wrong, but see below.

In the ciphertext, the first of such blocks is equal to ($tmphash XOR $hash). The following ones are each equal to (a_block_of_plaintext XOR $tmphash XOR $hash).

The first block of ciphertext is the key to your data. Just xor the ciphertext with a repetition of the first block of the ciphertext and you get the plaintext. No password needed.

I'm not a PHP programmer, so perhaps I'm missing something, but a practical attack would not be much different from this.

As a general rule only use professional grade crypto modules. If they are not available, then your application is not secure.

EDIT: by rereading the question I noticed that $hash and $tmphash have different lengths. $hash is 512 bit and $tmphash is 160 bit. However this does not change the basic idea; since the least common multiple of 512 and 160 is 2560, the blocks synchronize every 2560 bits. Therefore you are able to decipher only the first 160 bit of every 2560-bit block.

5
  • I think you are correct with this. Given $tmphash, I can decrypt all subsequent encryptions. I am surprised you caught the str_repeat in here. I missed that until you showed us. My assumption was that this only accepted up to the output size of the output of sha1. This is a much more elegant attack than my proposed one. Commented Dec 24, 2010 at 1:25
  • 1
    $hash is obtained with salsa20, which outputs 512 bits (you can see it here: cr.yp.to/salsa20.html Commented Dec 24, 2010 at 1:49
  • 1
    $tmphash is obtained with sha1, which outputs 160 bits -- en.wikipedia.org/wiki/SHA-1 After repeating tmphash 16 times and hash 5 times you get a supeblock of 2560 bits Commented Dec 24, 2010 at 1:56
  • You were too quick. I checked out salsa20 and tried to edit my comment because I knew about the sha1 length, then after that was timed out, I deleted it, then I saw all your replies. Thanks, this is more clear to me now. I didn't know how that 512 came about. Commented Dec 24, 2010 at 2:02
  • 1
    You get the first 160 bits of each block for free, but you can compute the rest, too: XORing subsequent blocks will give the XORs of the plaintexts as result, which is fairly easy to cryptanalyze. Once you have that, you can determine the repeating key and decipher the whole message. This is a variant of a vinegere cipher. Commented Dec 24, 2010 at 2:18
3

My php is not great and I'm a dude with one semester's worth of crypto, so by no means an expert. When evaluating the strength of a crypto system, one typically assumes an adversary has full access to your algorithm and implementation.

I see the line:

 $tmphash = pack('H*',sha1(sin(microtime(1))));

and I think that this is your key. Like I said, my PHP is pretty bad, so please correct me if I am wrong.

If the php sha1 function returns 40-bit hex number, this gives you a key space of WEP. The last time I checked, WEP can be cracked in about 3 minutes. I'm not totally sure if this is based on inherent vulnerabilities in the protocol through information leakage, or if this is because of a super small keyspace. However, 16^40 doesn't seem like a big enough key space for cryptographic security.

Additionally, based on this, all I would need to know is an approximate time that a user generated this request and you would greatly reduce the key space you need to search through. If the microtime() method in php actually gives you the current microseconds since the epoch, this would reduce my key search space from whatever 16^40 (php output ofsha1?) to the number of microseconds in the time frame I feel confident your user received this data from you. I could write a cracker that would run through this keyspace from the time I feel most confident at (the time I sniffed the packet) and back off from there until I hit some sort of a threshold.

You can always play the game of "my algorithm is a secret", but most security professionals I know don't really feel like that is a very valid argument (or a fun game to play). These are just two arguments a dude with a very basic education came across that only address your keyspace.

Don't implement anything like this yourself. It's a bad idea. If you are writing toy programs for a class it's cool, but if this is for any sort of production system whatsoever, I highly recommend using a tried and true cryptosystem.

-Brian J. Stinar-

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.