I've been using sbd to compare it with Ncat. Ncat offers SSL with or without certificates. sbd offers AES-CBC-128, with an option to override the "default phrase to use for encryption".

sbd -h


-c on|off   encryption on/off. specify whether you want to use the built-in
            AES-CBC-128 + HMAC-SHA1 encryption implementation (by
            Christophe Devine - http://www.cr0.net:8040/) or not
            default is: -c on
-k secret   override default phrase to use for encryption (secret must be
            shared between client and server)

This looks like a default encryption key is hardcoded into sbd. Is this true? If so, would using this default secret make it possible to reverse the distributed binary, find the key, then reassemble TCP streams of sbd sessions and decrypt them?

  • "roses are red, violets are blue." Dec 1, 2016 at 11:45
  • 1
    sbd looks more like a backdoor that supports obfuscated communication and not like a serious encrypted transport to me. Dec 1, 2016 at 11:51

1 Answer 1


It uses the default passphrase "roses are red, violets are blue." which can be overridden at compile time by defining SHARED_SECRET or at runtime using the command line switch you mention in the question.

    #define SHARED_SECRET "roses are red, violets are blue."

from sbd.c line 136-138

You must log in to answer this question.