I recently found isaac but I'm not sure what type of encryption is possible using it. Does the random number generator itself become the message somehow or does it get used as a seed for an encryption method? If so, what; and can someone maybe give some code example in a C based language (if possible). If you just mention the encryption name thats fine. Basically I need this for encrypting mmorpg tcp packets (online gaming for the non-gamer) in order to prevent MITM attacks and whatever other attacks are possible to prevent.

  • 1
    Why not just use SSL? It'll give you even better transport security and most languages have built-in support. – Polynomial Apr 3 '13 at 10:02
  • @Polynomial I'll try that instead. – pandoragami Apr 3 '13 at 20:23
  • Don't roll your own crypto. However, ISAAC may be somewhat appropriate if you are actually using it only for (CS)PRNG purposes as part of the game (rather than as part of crypto for the game). That said, ISAAC is old (semi-abandoned) code which was implemented before the advent of 64-bit hardware. – Steven Lu Feb 17 '14 at 21:25

If you want to ensure security of your communications, in particular prevent Man-in-the-Middle attacks, you need much more than encryption. Encryption only provides confidentiality, but does not prevent alterations (e.g. replaying packets, dropping packets, reordering packets, switching bits...). You also need some integrity checks, and a way to guarantee that the client is talking to the right server. Assembling cryptographic protocols is very hard (making it run is not hard; achieving security is hard), so the smart thing to do is to reuse an already defined protocol which does the job and has been well studied. This is called SSL (aka "TLS" in its recent versions). It will be much better than any homegrown scheme, and much easier for you since libraries implementing it already exist. The software which is easiest to implement is the software which has already been implemented.

For your specific question, it is possible to turn a deterministic cryptographically secure PRNG into an encryption scheme by using as key the internal starting state of the PRNG: you generate the key-dependent pseudo-random stream, which you then XOR with the data to encrypt; decryption is identical. This is how most stream ciphers work. Usage is delicate: you must NEVER encrypt two messages with the same key, because that would be the infamous two-times pad situation. When SSL uses RC4 (another, more well-known stream cipher), each connection uses a new key.

Whether ISAAC is cryptographically secure remains to be seen. It is old, and has attracted some reviewing by cryptographers, which is good; however, it was not part of the eSTREAM project and has not even been submitted to eBASC (for benchmarking on a lot of types of PC), so it looks a bit "abandoned". Since the "seeding" part (turning an initial key, as a small sequence of bits, into the starting initial state of the PRNG) is not specified, one can argue that ISAAC, as a cryptographic algorithm, was never "completed", precluding any decent effort at cryptanalysis. Studying it for academic purposes is fine, but I must recommend against using it for any production usage. And, anyway, you should really use SSL.

  • Is there any way to pick the type of encryption SSL uses for sending packets for example in openSSL, or what type of encyrption does openSSL generally use? – pandoragami Apr 3 '13 at 15:05
  • In SSL, the set of algorithms in force for a given connection is called a cipher suite and is negotiated between the client and the server. The client announces what cipher suites it supports and is willing to use, and the server chooses one among them. All decent SSL implementations (including OpenSSL) allow you to configure both client and server in that respect. – Thomas Pornin Apr 3 '13 at 15:09

In short, given that you can't or don't want to use SSL (that would be a good choice imVHo), here's how to use ISAAC to encrypt a stream

  • Pick a key, either entered by the user or derived from informations you have about him (stuff stored somewhere and/or retrieved from the current connection)

  • Use PKCS #5 v2.0 to generate an adequate number of bytes deriving them from the above key

  • Seed the ISAAC CSPRNG using the derived bytes block

  • Now, for each input byte, get a byte from ISAAC and use XOR to en/de-code the byte

That's all, the approach is the same as using OTP and basically gives you the same security level of the vanilla XOR applied to an input stream and having a totally random key of the same length of the input stream.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.