Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently found isaac but I'm not sure what type of encryption is possible using it. Does the random number generator itself become the message somehow or does it get used as a seed for an encryption method? If so, what; and can someone maybe give some code example in a C based language (if possible). If you just mention the encryption name thats fine. Basically I need this for encrypting mmorpg tcp packets (online gaming for the non-gamer) in order to prevent MITM attacks and whatever other attacks are possible to prevent.

share|improve this question
Why not just use SSL? It'll give you even better transport security and most languages have built-in support. – Polynomial Apr 3 '13 at 10:02
@Polynomial I'll try that instead. – lost_with_coding Apr 3 '13 at 20:23
Don't roll your own crypto. However, ISAAC may be somewhat appropriate if you are actually using it only for (CS)PRNG purposes as part of the game (rather than as part of crypto for the game). That said, ISAAC is old (semi-abandoned) code which was implemented before the advent of 64-bit hardware. – Steven Lu Feb 17 '14 at 21:25
up vote 4 down vote accepted

If you want to ensure security of your communications, in particular prevent Man-in-the-Middle attacks, you need much more than encryption. Encryption only provides confidentiality, but does not prevent alterations (e.g. replaying packets, dropping packets, reordering packets, switching bits...). You also need some integrity checks, and a way to guarantee that the client is talking to the right server. Assembling cryptographic protocols is very hard (making it run is not hard; achieving security is hard), so the smart thing to do is to reuse an already defined protocol which does the job and has been well studied. This is called SSL (aka "TLS" in its recent versions). It will be much better than any homegrown scheme, and much easier for you since libraries implementing it already exist. The software which is easiest to implement is the software which has already been implemented.

For your specific question, it is possible to turn a deterministic cryptographically secure PRNG into an encryption scheme by using as key the internal starting state of the PRNG: you generate the key-dependent pseudo-random stream, which you then XOR with the data to encrypt; decryption is identical. This is how most stream ciphers work. Usage is delicate: you must NEVER encrypt two messages with the same key, because that would be the infamous two-times pad situation. When SSL uses RC4 (another, more well-known stream cipher), each connection uses a new key.

Whether ISAAC is cryptographically secure remains to be seen. It is old, and has attracted some reviewing by cryptographers, which is good; however, it was not part of the eSTREAM project and has not even been submitted to eBASC (for benchmarking on a lot of types of PC), so it looks a bit "abandoned". Since the "seeding" part (turning an initial key, as a small sequence of bits, into the starting initial state of the PRNG) is not specified, one can argue that ISAAC, as a cryptographic algorithm, was never "completed", precluding any decent effort at cryptanalysis. Studying it for academic purposes is fine, but I must recommend against using it for any production usage. And, anyway, you should really use SSL.

share|improve this answer
Is there any way to pick the type of encryption SSL uses for sending packets for example in openSSL, or what type of encyrption does openSSL generally use? – lost_with_coding Apr 3 '13 at 15:05
In SSL, the set of algorithms in force for a given connection is called a cipher suite and is negotiated between the client and the server. The client announces what cipher suites it supports and is willing to use, and the server chooses one among them. All decent SSL implementations (including OpenSSL) allow you to configure both client and server in that respect. – Thomas Pornin Apr 3 '13 at 15:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.