The Joy to Be Server-Free

freedomA few months ago, I toyed with the idea of adding a server to my PassLok Privacy app. I reasoned that a server would be able to store users’ Locks so that other users could retrieve them automatically—very much like the General Directory does now, but even more deeply integrated with the program so that users wouldn’t even be aware that a server was being contacted. Everything would be real easy. Seamless. I also reasoned that everyone else was doing it, so why not? (more…)

Attacking the Serpentacci ciphers

spy-02 (1)And I’d be adding Visionnaire and Worm as well. All of these ciphers resist ciphertext-only attacks quite well because the ciphertext they generate looks quite random (increasingly so as the number of letters per operation increases) and trying to decrypt with the wrong key yields a “plaintext” that looks completely random even if the key is off by a single character, but they fall to a known-plaintext attack right away. In this article, I discuss how this would be done, and what can the sender do to counteract the attack. (more…)

An easy way to make good substitution keys

300px-DES-pp.svg (1)Of course, substitution ciphers are completely insecure in this day and age, but the general idea of substitution still has a place in modern cryptography. Substitutions are what give the Serpentacci and Worm ciphers their strength. Computer ciphers can be attacked, in no small measure, because the substitutions built into them are fixed. I have looked around for a simple way to make a scrambled alphabet, which is what a substitution essentially consists of, from a password or key phrase, but typically the method you can find is very crude: start writing every new letter found in the password, and then the rest of the alphabet when you run out of password. This will cause most scrambled alphabets, among other defects, to end in XYZ, since those letters are rare.

In this article I discuss better ways to turn a password into a scrambled alphabet, which are not all that complicated. (more…)

Autokey strikes again!

super_mega_worm_time_limited_free_game_4 (1)Did you know that the actual cipher invented by Blaise de Vigenère, back in the XVI century, is not the one that bears his name? The so-called Vigenère cipher was actually invented a few years earlier by Giovan Battista Bellaso. Vigenère’s own creation is a version of what today we call “autokey” cipher, and it is more secure than Bellaso’s. Of course, today’s computers can break both of them in seconds, but there things we can do to strengthen them to the current standard. Best of all, the resulting ciphers, which I’m calling “Visionnaire” and “Worm” (you will see why), can be done with paper and pencil. Visionnaire has its own article, so I’ll be talking about Worm here. (more…)

The Visionnarie cipher

Blaise-Vigenere.0 (1)The autokey cipher was invented nearly five hundred years ago by Blaise the Vigenère, pictured at left, but was almost immediately forgotten in favor of a much weaker repeating-key cipher invented by Bellaso, once upon a time known as “the undecipherable cipher,”  which Vigenère somehow got credit for. Given how many important secrets were revealed when that cipher was broken, the history of the world might have been quite different if Vigenére’s true creation had been the one people actually used. And this is the Visionnaire cipher: a simple combination of Vigenére’s autokey cipher with a substitution, made quite seamless to the user by means of a Tabula Recta. It turns out to be almost as strong as Worm, and much simpler to do. We can only speculate what might have been if this variation had been used back then. Nothing really prevented it. (more…)

FilePad encryption

Gilbert_VernamThis one is not for paper and pencil, but is based on the same ideas as a bunch of paper and pencil ciphers in this blog. FilePad uses a file as key to encrypt another with extreme security. Here is FilePad, as JavaScript code running on a web page. Now, what’s the use of this, you may ask. Consider this: a 4 TB drive (about $100 in mid-2016) can contain enough bits to encrypt a high-definition video feed (about 1000 kbits/s), continuously, for longer than a year! The trick is that those bits must be truly random, or at least appear to be random so that no cryptanalysis is possible, per Shannon’s criterion. Here’s where FilePad comes in. It takes any file in your computer and scrambles it so its bits are essentially random. Then you can use the scrambled file to encrypt securely another file. (more…)