2

I created a simple two way cryptographic function which allows you to encrypt a message and decrypt it with the same key. Here's how it works.

  1. Split the message into an array of 32-bit (or something else, depending on your key's length) segments
  2. Generate a random 32-bit number and xor all segments with it, and append it to the start of the array. (This is done to prevent an attacker recognizing that the same message or certain parts of it have been sent twice)
  3. Xor all segments with a hash of the key and the index of the segment. The index is included to prevent an attacker finding patterns inside the message where there are 0s or some other known data.

My questions are:

  • Does there already exist a similar two-way function?
  • Are there any flaws in it, and if so, what can be done to correct them?

Please explain in simple terms, I'm not a cryptography expert.

  • 3
    See security.stackexchange.com/questions/18197/… and schneier.com/crypto-gram-9810.html#cipherdesign -- anyone can make a cipher that they themselves can't break; the hard part is making a cipher that nobody can break. – Mark Dec 2 '14 at 2:55
  • 2
    As soon as I read, "I created a..." I found I could answer "yes" to your question about flaws. As DTK says in an answer, keep learning. As Bob Brown says, never bet your money, or your credit card numbers, on a home-brew cipher unless you have a Ph.D. in math and ten years' experience at the NSA. – Bob Brown Dec 2 '14 at 3:18
  • 5
    Yes, it's insecure. The formula for ciphertext segment i can be rewritten as (something which is the same for block i of ALL messages using key K) xor (a particular component of the ciphertext) xor (plaintext segment i) (from there, you can get message_1 xor message_2 for any two messages sharing a key, which is a serious compromise). – cpast Dec 2 '14 at 4:02
5

First don't roll your own crypto and read DTK answer. But, I do believe that we learn by experimenting so I will answer your questions

Does there already exist a similar two-way function?

Yes. They are called block cipher and come with different mode of operation. The block cipher is a function that encrypt the data for 1 particular block. In your case, it would be your hash function that use the {key, index} pair to create an encrypted message that you then XOR with the original message. The mode of operation is how you chain them. In your case, the mode of operation that is the most similar to what you describe is CTR

Are there any flaws in it, and if so, what can be done to correct them?

There are a lot of flaws

  1. Always adding the same random number to 1 character (or a group of character) doesn't help you. Check Frequency Analysis
  2. The hash of the key + index is always the same as long as the key doesn't change. This is the most critical flaw in your algorithm.

    Xn = Hash(key + index-n)
    R1 = random number of first message
    R2 = random number of second message
    Y1n = Xn XOR R1
    Y2n = Xn XOR R2
    Z = R1 XOR R2

If I send you a first message and you give me the encrypted answer, I can then compute every values Y1n.

Then, if you send me only the encrypted version of a second message, I can easily find the value Z by using XOR on the first 2 elements of your messages

Then Y2n XOR Z = Y1n and I know your second message even if you only sent me the encrypted version.

Your biggest problem is the mode of operation. I suggest you start by that. Then, your block cipher might have flaws on it's own.

Doing this exercise can be good for learning, but never use your own in any system.

7

Read Shannon's 1949 work. Understand diffusion and confusion. Then understand that you do not understand enough *YET* about set theory, probability and linear maths to know that you don't have enough background to design or implement an enciphering algorithm. Read Dunning-Kruger effect while you are at it, but please keep learning, so that some day you will know enough to design a secret system.


0

As others have stated thats a block cipher.

Its ok to experiment with your own ideas and techniques. It can be fun!

Just don't put your experiments into production. Other people that are way smarter than you or I can probably defeat your protection.

Go check out modes of operation for block ciphers, identify the mode most closely related to yours, and their should be a list of weaknesses associated with that mode.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.