Little contest: Crack my 'ROT13 On Steroids' cypher
Submitted by nielsvm on Tue, 03/04/2008 - 09:21
update: Added a form online and changed the last chapter
A few weeks ago I was in a what-to-code-right-now-mood and inspired by The Gold Bug I decided to write a little easy cypher in PHP (could have been any languageTM of course) without any secret key. You know, just for fun.
So what did I write exactly? Well, I wrote two API functions, one for encrypting and the other for decrypting a string, and used all kinds of string manipulations to get it the way it is. A little example for encrypting the first paragraph of The Gold Bug:
#!/usr/bin/php
<?PHP
include('rotsteroids_contest.inc.php');
$msg = "This Island is a very singular one. (....) The vegetation,
as might be supposed, is scant, or at least dwarfish.";
echo rot_encrypt($msg);
Which will print something along the lines of this:
11:m0xbfvtumj=yA5EyOpOWO=RKJUJPzlKKtVnLMoMo LqYmmtuthcxgmby5jIRScIOOAT2PzTT3JFFKnoMpVooM MMnHwhvztilbvzSOSO94OOEOWTP2lTJPvUPKBq(.......) chttOOS5DAqk4jwPvTTKUU2JPMMMVVFVVpMMvhim0tu mtbyySOyS4OED1AwTlTTFFKzP3ZopVVMrnonoAs you can see the cypher hasn't been optimized for speed at all and can :P contain all sorts of salts and/or junk, or am I giving away too much fish now? For encrypting we have the function rotsteroids_encrypt( str ) and rotsteroids_decrypt( str ) for the other way round. So now the fun part, which is up to those nifty smart minds out here to crack my implementation. I've written the cypher in pure PHP which might use some other string manipulating functions, or not, but still, it is pure PHP. To make it even more fun I'm just going to make it a contest, and for the first reader who is able to send me a reference implementation that works, I'm going to send a bottle of beer trough mail =). So how to get started? Well, as I said, it is easy to deal with the code, API-wise there are only to functions one for encrypting and the other for decrypting. To not give away the source-code, and thus the answer to my contest, I've created a online form in which you can use the encrypting and decrypting of strings. Earlier today I got a few mails from people that actually decoded the phps file I had uploaded and delivered me the source that way, which is, in fact, cheating. I'm curious for any responds, let me know! mail: niels-[AT]-shodan-[DOT]-nl
Categories:
Comments
Jonathan Verner (not verified)
Thu, 03/06/2008 - 17:08
Permalink
Hmmm, I had nothing to do
Hmmm, I had nothing to do yesterday, so I spent a few hours looking at this stuff. I wonder how far have other people got :-) Here's what I was able get:
I think I can now compute the size of the encrypted message: its approximately (num_of_chars/3)*4 + 47 (some kind of a hash?) ? The first character always seems to be a number which changes depending on the length. My guess is that its always a power of 2 or 3, where it's 3 always for three different consecutive lengths. But haven't yet checked on this thoroughly. Anyway, seems like a lot of work to do a complete reengineering. I didn't get very far with the way the text is encrypted, although the algorithm seems to take a triple of characters and outputs four, where the first is coded by the third, the third is coded by the fourth and the second codes the second two.
nielsvm (not verified)
Wed, 03/05/2008 - 01:02
Permalink
Well, the form is online
Well, the form is online right now, and should be working fine.
To answer some some of the commenters above. It is indeed not a algorithm using any kind of secret between begin or end, so it is, always decryptable by everyone.
As the name might suspect, I got inspired by the simpleness of ROT13, which doesn't mean this cypher is that easy. In fact it is indeed a long, expensive and confusing chain of string mangling and a little more then that.
So yes, I wrote this for fun. Somebody relying on this cypher would be better of whispering his secrets directly to the receiver.
I'm still curious :)
Marc (not verified)
Tue, 03/04/2008 - 18:13
Permalink
> One might be able to
> One might be able to reverse-engineer the code, but it would be more fun without any cheating.
Seriously, this is not *that* hard to understand.
While trying to re-implement the functions I used a lot of looping constructs. That wouldn't have been much fun without direct access to the code. But then, I didn't get very far.
I wonder whether figuring out an encryption algorithm is as difficult as i think it is... In theory, you could add layer over layer of arbitrary difficulty by making extensive use of bit manipulations.
nielsvm (not verified)
Tue, 03/04/2008 - 17:19
Permalink
I will update the blog
I will update the blog tonight and add a PHP form to insert and retrieve the results instead of the code.
Edgeman (not verified)
Tue, 03/04/2008 - 16:39
Permalink
You probably should just
You probably should just create a .php page with a form to pass to the rot_encrypt() and then echo the encrypted text, instead of the easily reversed source. That keeps the code on the server and hidden while still allowing people to use it to pass various strings to see what results.
Martin (not verified)
Tue, 03/04/2008 - 16:08
Permalink
I'm not sure I get the idea
I'm not sure I get the idea here. So basically, it's about guessing the correct order of invocing base64, md5
Jason (not verified)
Tue, 03/04/2008 - 14:41
Permalink
Careful with that phps file..
Careful with that phps file...
All I have to do is run that base64 encoded string into base64_decode, and then I'll have the full source. It's not long enough to make symbol obfuscation much of a problem.
In fact, I just did this, reformatted the resultant source, and now I have the complete algorithm.
I'll e-mail it to you.
Add new comment