Cryptanalysis
is not just for mathematicians. It can be very fun for regular
folks. My favorite hand cipher is the Playfair
cipher. It was used by the British in WW I. The Germans
modified it a bit and used it in WW II. The British cracked it by
hand (no computers) and read much of the secret communications of
the Nazis. You can read about it in this awesome book.
To use it you pre-share a
5 x 5 grid with your buddy. Part of the grid usually has a
secret word in it to help you remember which grid to use. This is
for when you use a different grid each day, for instance. Divide
your message into pairs of letters. Then you encipher your message
by replacing each pair with the letters in the exact opposite
positions, upside down & backwards, so to speak. The link
above will illustrate this so it is clear. deciphering the message
is the reverse of that process.
Cracking
real encryption (and hashes) can be done with a really cool
program called John The
Ripper. It runs on Windows, Mac OS X, Linux, and Unix. There
are a lot of other programs that do this kind of thing. To use
them you have to find the encrypted or enciphered or hashed
password and point the program at it. The instructions in the
software should tell you how. It can be addictive. By the way,
don't get the password hashes by hacking into other people's
computers. In any Western country, and much of the rest of the
world, it will land you in prison.
You
can see that several of the passwords here were cracked and the
program is still working on six more. The actual passwords
recovered are in the second column. The corresponding usernames
are in the first column. The six that it is still working on are
in the last two columns of those six rows. The pairs are
representations of the starting and ending points of a range of
letter & number groups that the program is trying.
For
years I have lamented the difficulty of securely storing and
retrieving username and password pairs. In my line of work there
are a lot of these, too many to remember.
But storing them
in specialized software is always risky. Apple's keychain program
once erased every password I had. The same happened to my brother.
Other GUI password managers risk the same, or worse , they might
not run on your new OS when you upgrade your computer. Then when
you someday have to get them all out the software you'll probably
have to cut/paste each username and each password into something
new.
Some guys store their passwords in encrypted MS Word
documents. With Word now supporting AES encryption, maybe this is
a good system - cryptographically - but versions of Word seem to
only take about six or seven years to become unuseable on new
computer. Also, Microsoft products turn out to have bugs and
backdoors pretty often.
For a long time I've been storing
my passwords in a PGP/GPG encrypted text file. This has the
advantage of being decryptable on any OS that supports PGP. And if
you use a decent length key (>512 bits, I figure), and a decent
passphrase (>6 characters, with upper & lower case,
numbers, and punctuation too) it should be pretty
uncrackable.
But the problems with this system are pretty
significant:
You
must read/write the password file on or at the computer where it
lives. Or you have to connect to that computer remotely. If you
keep this file on more than one computer then you have to get
into manual or automated synchronization.
You
have to decypt all of your passwords at once which can be a
problem if you make any number of mistakes like forgetting to
re-encrypt, leaving your terminal unattended and unlocked, etc.
As the text file
grows, finding the password you need becomes harder.
So recently I've been
working on a hand cipher which can be done either on paper or just
in your head once you get familiar with it. The weakness of
ciphers verses real cryptographic algorithms is that the latter
rely on the secrecy of the cipher system itself, instead of the
secrecy of a key. In fact modern cryptographic algorithms are
almost always published, even with source code. The idea here is
that letting anyone and everyone beat on the algorithm lets you
see how secure it really is. Even if you, like me, don't feel
comfortable with mathematics, reading about how various cipher and
cryptographic algorithms work is really fascinating.
Anyway, the cipher system
I've come up with, called the Gartshore Cipher, has the usual
weakness of simple ciphers that its security is reliant on the
secrecy of the encipherment system itself. I'll go out on a limb
and call it a hybrid block/stream substitution cipher. This means
that the original plaintext is replaced (substituted) in blocks
(chunks of several characters) as well as being substituted as a
stream of characters (one after the other, in sequence). This
description gives the reader a couple of clues as to how to crack
it. Here are two enciphered strings for you to beat on. One of
them contains my email address. If you break all or part of this
cipher system, please email me with the result and how you broke
it. That would be fun and cool. But while cracking it is possible,
can you figure out why
this system is so easy to use (without pencil and paper) as
opposed to a traditional table lookup substitution cipher?
113
14 102 92 11 0012346789 21 83 11 103 11 113 81 82 55 83 123 121
031
102 81 21 102 81 21 102 0101 123 91 31 13 123 22 101 102 21
00123680
That should be plenty of
information for a motivated cipher-nut to crack this cipher. This
is a great illustration of the trade off between security and
usability. This cipher can be done in your head and, once you
learn it, deciphered in your head, but this simplicity makes it
vulnerable to the most basic attack used against substitution
ciphers: frequency analysis. This is where you start guessing
about letters which are most often used. In English the letter E
is the most used letter, so in long blocks of text, that is a good
place to start guessing. Another obvious technique is to look for
anomalies that stand out and could be used as a crib. For example,
in the cipher messages above, there are two obvious outliers.
This brings up the
interesting and controversial topic of
“security-through-obscurity”. This is something that
is much criticized in computer security circles. Since computer
attacks and exploitation attempts are almost always automated,
sole reliance on hiding secrets, rather than securing secrets, is
a big mistake. An example of this is if you keep your passwords in
an unencrypted MS Word file named Holiday_Recipes.doc. It may
sound like hiding a needle in a haystack, but a malicious user
could easily launch a search for the strings “password”
or “username” inside every file on your hard drive.
This example makes the
lameness of security-through-obscurity seem obvious. But wholesale
dismissal of this technique are very short-sighted. Security
through obscurity is widely used in the clandestine services world
(spies and spy tradecraft). It should be a part of most complex,
layered, security systems. Imagine the CIA posting their
encrypted messages to their field agents up on www.cia.gov.
Pretty lame idea right? But by not doing that, the CIA is relying
on security through obscurity. But they are not solely relying on
it. Another example: if security through obscurity is so stupid,
why not make your passwords something like “password”
instead of “P@s5\/\/0rd”? Because security through
obscurity helps the encrypted (or hashed) password be harder to
crack. Despite real world facts like this, hardcore computer geeks
can be quite dismissive of security through obscurity. Please
don't be an idiot and rely on security-through-obscurity to
protect your data; but also don't be afraid to use it as part of a
comprehensive layered security system. Got that out of my system.
|
