3

I’m at the beginning of my journey into the world of security. I am reading about the most fundamentals topics and I have encountered something unusual that has thrown me.

The Conundrum:

I have come across an encryption process on an appliance that can be configured with a plain text key. When you view the configuration of the appliance it shows the key as a cipher text (imagine perhaps the idea is stop people shoulder surfing the key of the appliance). So the plain text key I entered in the appliance configuration has been encrypted somehow.

An appliance will use my configured key with MD5 to hash messages between its self and another appliance. What confuses me is that when I configure a second appliance to talk to the first one I can either configure the same plain text key or I can copy the cipher text from the first appliance shown when viewing the appliance configuration and input that cipher text into the second appliance (specifying as I enter it that I am entering the cipher text version of the key not a plain text version of the key).1

The two appliances talk happily, hashing their inter-appliance message with MD5. At this point I thought the cipher method used to store my key must be symmetrical. The 2nd appliance runs a decryption function that is the reverse of the encryption function and voila, it gets the plain text key so it can be used for the inter- appliance MD5 hashing. After a little digging on the Internet I have found that the cipher method is using a salt2. To the best of my beginner knowledge salts are used for asymmetric ciphers but these appliances exhibit the behaviour of a symmetrical cipher function because they can both encode/decode the same plain text to cipher text (or vice versa) independently of each other. A bit more digging has revealed the salt value is hard coded into the appliance OS and so it’s the same on every one of these appliances.

The question: (Skip to here for short version)

So is this an asymmetric encryption cipher being used that is being “forced” to act symmetrically by given all appliances the same hard coded salt value, or can symmetric ciphers use a salt?


1 If I had three appliances meshed in a traingle all talking to each other, I can configured them with any combination of putting the plain text key into all appliances, configuring one with the plain text key then copying the cipher text version of that key to the other two, or configuring two appliances with the plain text key and copying the cipher text key from one of the appliances to the third appliance. They will still all talk happily so they must all be doing the exact same encryption/decryption process?

2 This encryption/decryption process has been broken wide open and has become public knowledge.

  • 3
    I think you might be confusing asymmetric cryptography with cryptographic hash functions. MD5 is an example of the latter. It sounds like your system could be passing salted hash values around for authentication, and it allows users to create those hash values from a plain text key. – Aron Foster Apr 22 '15 at 17:20
  • I don't think I'm confusing them, in my example they are both in use. Two devices communicate via TCP and use the key I have configured as part of the input for the MD5 hasing process along with the TCP packet payload. The MD5 digest is added to the end of the TCP payload. The receiving device will need the same key so it can generate the same hash on the incomming packet. I'm confused about the cipher that is used to store that key safely on the device. – jwbensley Apr 22 '15 at 17:58
  • 2
    "salts are used for asymmetric ciphers" -- salts are used for neither symmetric nor asymmetric ciphers; they are used for one-way transformations like hash functions. – apsillers Apr 22 '15 at 18:33
  • 1
    Is your "plain text key" a fixed-length value? (i.e., can you type in whatever you like, like a passphrase, or is does it require an exact length like 256 bits?) If it's not fixed-length, then certainly your plaintext input is being transformed into a key somehow, either by a hash function or a key derivation function, and the "ciphertext" version you see is simply the one-way transformation of that passphrase. – apsillers Apr 22 '15 at 18:38
2

I think you're confused because of a misunderstanding between encrypting and hashing. I'll try to clarify by quoting your original post.

"When you view the configuration of the appliance it shows the key as a cipher text (imagine perhaps the idea is stop people shoulder surfing the key of the appliance). So the plain text key I entered in the appliance configuration has been encrypted somehow."

The key is hashed, not encrypted. It is good practice to not store keys in plaintext because an intruder able to compromise the appliance would get access to all account passwords.

"An appliance will use my configured key with MD5 to hash messages between its self and another appliance. What confuses me is that when I configure a second appliance to talk to the first one I can either configure the same plain text key or I can copy the cipher text from the first appliance shown when viewing the appliance configuration and input that cipher text into the second appliance (specifying as I enter it that I am entering the cipher text version of the key not a plain text version of the key)."

Replace cipher text with hashed key here. Apart from that, everything is normal, the appliance allows you to enter the key either in plaintext or in its hashed form; that's a common feature.

"At this point I thought the cipher method used to store my key must be symmetrical. The 2nd appliance runs a decryption function that is the reverse of the encryption function and voila, it gets the plain text key so it can be used for the inter- appliance MD5 hashing."

There is no cipher method or decryption here, your key is stored hashed in the appliances. Appliance 2 is able to talk with appliance 1 because you entered the key in both devices. They can then use this key to communicate securely by encrypting the exchanged message with any symmetric cipher.

"After a little digging on the Internet I have found that the cipher method is using a salt. To the best of my beginner knowledge salts are used for asymmetric ciphers but these appliances exhibit the behaviour of a symmetrical cipher function because they can both encode/decode the same plain text to cipher text (or vice versa) independently of each other."

No, salt is used to secure the hash function used to store safely the key in the appliance. Salt has nothing to do with symmetric or asymmetric ciphers.

"So is this an asymmetric encryption cipher being used that is being “forced” to act symmetrically by given all appliances the same hard coded salt value, or can symmetric ciphers use a salt?"

None of the above, see previous answer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.