Wednesday, February 20, 2019

Home Unlabelled Cryptography A short paper on Fully Homomorphic Encryption -- I thought this was both interesting and approachable.

Cryptography A short paper on Fully Homomorphic Encryption -- I thought this was both interesting and approachable.

February 20, 2019

Cryptography A short paper on Fully Homomorphic Encryption -- I thought this was both interesting and approachable.

A short paper on Fully Homomorphic Encryption -- I thought this was both interesting and approachable.
Does anyone recognize this algorithm?
Chrome Key - a Chrome Extension that emulates a Hardware Authentication Device (HAD)

A short paper on Fully Homomorphic Encryption -- I thought this was both interesting and approachable.

Posted: 19 Feb 2019 11:47 AM PST

submitted by /u/ImSupposedToBeCoding
[link] [comments]

Does anyone recognize this algorithm?

Posted: 19 Feb 2019 10:55 PM PST

I was looking around on GitHub and found a purposefully vulnerable password manager someone had made for a HushCon CTF contest. They claim only 3/19 teams were able to hack the password database the program produced given the source. Having taken a look at it, I'm thinking the vulnerability is somewhere in the cipher algorithm itself, and some of the mixing of the state kind of reminds me of RC4 (but RC4 doesn't have a XOR operation as far as I know ).

(https://github.com/HushCon/password_manager/blob/master/passwd_mgr.c)

void encrypt(KEY *key, unsigned char *data, const size_t len) { uint32_t i = 0, t = 0, x = 0, y = 0; uint32_t state[KEYLEN]; memcpy(&state, key->state, sizeof(state)); for (; i < len; i++) { x = (x + 1) % KEYLEN; y = (y + state[x]) % KEYLEN; t = state[x]; state[x] = state[y]; state[y] = t; t = (state[x] + state[y]) % KEYLEN; data[i] = state[t] ^ data[i]; } }

The key derivation is pretty interesting.

void derive_key(KEY *key, unsigned char *pass, const size_t len) { unsigned char buf[BUFLEN] = {0}; size_t buflen = BUFLEN; uint32_t seed = 0; int i = 0; if (len < BUFLEN) buflen = len; memcpy(&buf, pass, buflen); for (; i < BUFLEN - 4; i+=4) seed ^= (uint32_t) buf[i+0] << 0 | (uint32_t) buf[i+1] << 8 | (uint32_t) buf[i+2] << 16 | (uint32_t) buf[i+3] << 24; srand(seed); for (i = 0; i < KEYLEN; i++) key->state[i] = rand() & 0xffff; }

What's going on there? They're serializing the sume of all 'pass' values into 'seed', but then it appears like they're setting 'key->state[i]' to be product of rand(), but what's with the "& 0xffff"?

submitted by /u/kennbr
[link] [comments]

Chrome Key - a Chrome Extension that emulates a Hardware Authentication Device (HAD)

Posted: 19 Feb 2019 09:31 AM PST

submitted by /u/johnmountain
[link] [comments]