EH-Net

Ethical Hacking Discussions and Related Certifications => Programming => Topic started by: sagar1596 on March 17, 2012, 09:42:41 AM



Title: Need good password crackers to test my encryption algorithm.
Post by: sagar1596 on March 17, 2012, 09:42:41 AM
Hi All,

I have implemented an encryption algorithm.

This algorithm does a two level encryption on plain text and generates a cypher.

I want to know the strength of this algorithm.

So any of you guys can try to crack this cypher.

If it can be cracked, it has loopholes. If any of you can point to any loopholes, It will be fun for you guys and also, you guys will get mine and others respect and on top of that, your name will be in the credits of this algorithm when I release it.

Please find below is the Cypher:
MTAwODgxNTk2MTAwNzAxNTk2MTAwNzYxNTk2MTAwNzAxNTk2MTAwODcxNTk2

Hint: The plain text is a 5 letter word.


Title: Re: Need good password crackers to test my encryption algorithm.
Post by: unicityd on March 22, 2012, 05:57:03 PM
Don't mistake my bluntness for malice, but you do not understand very much about cryptography and your code is almost certain to be fatally flawed.  First, you don't seem to understand either Kerchoff's principle or unicity distance. 

Kerchoff's principle, a long-held principle in cryptography, is that your system should be secure even if all of the information about how the system works is public.  Only the key is kept secret.  Publish your algorithm and maybe someone can offer feedback.  If your algorithm does not use a key, it is neither secure nor useful per Kerchoff's principle.

Unicity distance is the amount of ciphertext needed to ensure that there is only one meaningful decryption.  You've given us a very large ciphertext that corresponds to a plaintext of only five characters.  You don't give us any information about the key, but given a ciphertext of 60 characters, there are an infinite number of transformations that could turn those 60 characters into 5.  Even, if I knew your transformation (encryption algorithm), there should be a large number of keys that could turn those characters into a valid 5-letter word.

Your ciphertext is very repetitive.  What encoding are you using?

Developing strong cryptographic algorithms is very hard and requires experience breaking algorithms and very strong math skills in algebra, statistics, probability, linear algebra and abstract algebra as well as a working knowledge of concepts in computation and algorithm analysis.  Algorithms are typically published alongside the author's own analysis in order to convince other experts that the new design is worth a look.  If it appears strong/useful/interesting, other cryptographers will spend their own time trying to break the system and publish their results.  If the algorithm is strong, the resulting publications will explain why the algorithm is *not* vulnerable to various attacks or what about the algorithm causes those attacks to fail.

If you want to learn more about cryptography, read this book:

http://www.amazon.com/Understanding-Cryptography-Textbook-Students-Practitioners/dp/3642041000

It's very accessible and doesn't assume any hard mathematical prerequisites. 


Title: Re: Need good password crackers to test my encryption algorithm.
Post by: former33t on March 22, 2012, 09:36:30 PM
I'll second this.  The sample you provide is insufficient to determine anything about either the algorithm or the keying material.

That being said, rolling your own encryption algorithm is always a bad idea.  Correctly implementing existing encryption libraries can be difficult (ask the Debian team).  Getting your own algorithm built from the ground up is MUCH harder (and likely to be an epic fail).


Title: Re: Need good password crackers to test my encryption algorithm.
Post by: MaXe on March 23, 2012, 01:55:01 PM
"The best encryption algorithm is only as strong as the password behind.", anyway, your algorithm seems to need some improvements.

There's a repeating pattern of "MTA" and "NTk2", and there's several occurences of: "wNzAx", where (X) is sometimes substituted in this format:   wNz(X)x

There's also a re-occurence of: wOD(X)x, e.g., "wODcx" and "wODgx".

By taking the cipher appart, it looks quite insecure with a lot of garbage data. I think we'll stick with SHA-512 instead.