US $100 prize for breaking my encryption ...

Hi everyone,

I often heard people saying that private secret encryption is never secure (in other words, easy to crack). But I don't agree. So here is the experiment to find out. I have developed my own encryption algorithm which I have not told anyone (so this is my own secret algorithm).

I have used my algorithm to encrypt an English sentence (so I am not encrypting random bytes) and the encrypted bytes are listed at the end of this post. The encrypted message has 151 bytes.

The first person who can decrypt the original plain text will get US $100. If there are more then one person successfully decrypting the original text, then whoever replies first (to this post) will be the winner. I will also post this same message in Matlab newsgroup and in that case, I will use timestamp in the posted message. If there are more than one person submitting at the same time (in the newsgroup and in Answers), then I will randomly pick a winner.

Have fun.

Hope I will get some response.

Kevin H.

bytes = [126; 198; 205; 64; 15; 190; 87; 2; 23; 245; 12; 229; 157; 31; ...
 78; 102; 128; 20; 192; 119; 6; 43; 23; 145; 180; 95; 125; 76; 121; ...
 80; 28; 7; 76; 209; 57; 24; 199; 221; 13; 44; 35; 45; 31; 25; 246; ...
 31; 124; 175; 80; 225; 5; 56; 139; 11; 77; 173; 86; 17; 137; 7; ...
 253; 18; 211; 166; 52; 131; 123; 22; 70; 171; 121; 74; 15; 253; ...
 30; 29; 155; 242; 132; 100; 236; 141; 12; 195; 181; 60; 218;  ...
 196; 140; 25; 104; 110; 128; 119; 114; 154; 87; 203; 92; 36; ...
 69; 211; 183; 204; 244; 112; 193; 99; 106; 23; 240; 218;  211; ...
 249; 158; 83; 63; 153; 83; 90; 44; 63; 155; 242; 39; 101; 209; ...
 80; 55; 52; 71; 180; 86; 9; 111; 73; 49; 133; 210; 48; 192; ...
 117; 50; 50; 122; 119; 101; 2; 23; 245; 12];

[Jan]

"bytes[151]" is no valid Matlab syntax. So importing your data to Matlab means some extra work to be performed in the editor. In addition I do not see a relation to Matlab. Do you think you are in the right forum? If so, could you please explain why?

[Kevin]

Hi Jan,

Sorry for the Matlab syntax mistake. Shame on me after all these years of Matlab coding. Still get confused with C syntax.

I agree that this is not a strictly Matlab question. But this is algorithm related and it is easy to do in Matlab (actually I code the encryption algorithm in Matlab). This is why I post it in Answers and Matlab newsgroup.

Kevin

[Jan]

I've edited the data, such that it can be copy&pasted and other ones do not have to perform the formatting again.

Answer 1

[Jan]

There is an infinite number of method to produce such a sequence of bytes and of course it is not possible to crack your encryption. But this is not the meaning of "easy or hard to crack". This involves a large number of different non trivial messages. A pattern recognition is not possible for such a small piece of data.

So let me offer a solution:

key = [126, 198, 205, 64, 15, 190, 87, 2];
if isequal(message(1:8), key)   % [EDITED], misplaced parenthesis fixed
  cleartext = ['Standing beneath this serene sky, overlooking these broad ', ...
  'fields now reposing from the labors of the waning year, the mighty ', ...
  'Alleghenies dimly towering before us, the graves of our brethren ', ...
  'beneath our feet, it is with hesitation that I raise my poor voice to ', ...
  'break the eloquent silence of God and Nature. But the duty to which ', ...
  'you have called me must be performed; — grant me, I pray you, your ', ...
  'indulgence and your sympathy'];
else
  error('Cannot decipher your message')
end

There is even an encryption scheme, which creates a sequence of only "iiiiiii..." for the complete Gettysburg Address. But this method is not useful for the general case. In other words: I assume you do not have to pay the 100$, but this does not allow any conclusions about the quality of your enryption algorithm.

[Kevin]

Hi Jan,

Great. I learn something new about Matlab.

First question. I try to run this command (from your post) but I get an error message,

>> key = [126, 198, 205, 64, 15, 190, 87, 2]; >> message(1:8, key) Error using message Invalid input for argument 1 (rhs1): Value must be a string. Error using message Invalid input for argument 1 (rhs1): Value must be a string.

Actually I have not heard of MESSAGE before.

I agree that one encrypted message is not enough to break the algorithm.

What if I post 10 more encrypted messages? Or you need more than 10.

Kevin H.

[Jan]

Sorry for the confusion: "message" is what you called "bytes". And I've fixed a typo also.

The number of required messages depends on the entropy you inflate into the signal. While a ROT13 is recognized after about 2 or 4 times the length of the used alphabet, algorithms like this require millions of bytes:

message = double('hello Bob!');
key     = 127;  % A short 1 byte key, limited to UINT8 values
for k = 1:length(message)
  magic      = mod(floor(cos(k / 17 + k*k + key) * 61476654), 256);
  message(k) = bitxor(message(k), magic);
end

Here the strength of the encryption lies in the infinite number of possible calculations to get the magic byte. So the security is based on keeping the algorithm secret, while the actual key does not offer a serious degree of security: You can check the possible 256 possible keys very fast.

So the first improvement would be to allow floating point values as key. This will increase the number of possible key and a brute force attack will be very expensive already. But if the algorithm is hidden in a black box, the encrypted byte stream will show a periodical behavior, when a constant is used as input.

In opposite to the secret algorithm methods, famous secure encryption methods are known and the strength is based on the entropy provided by the key, not by the algorithm.

Imagine how I store the 4 digits PIN of my credit card in written form: Swap two digits, add a constant to (perhaps other) two digits modulo 10. This algorithm is very easy algorithm, the key (this means which digits and which constant) contains a few bits only. The encrypted number is 1804 and I'm convinced that you cannot obtain the clear text, because here the message length is too short to allow any analysis. But if you ask me to encrypt some provided numbers by the same method, you will reveal my key very soon.

[EDITED] Please note, that the output of COS will depend on the used library and processor. Other floating point effects can influence the results also. So the shown method is not reliable for a productive use.

[Kevin]

Hi Jan,

Thanks for your reply.

On a side note, there is actually a Matlab function called MESSAGE. What a coincidence!

I agree with you that if you have access to a few plain texts and their corresponding encrypted messages, then you can do analysis on them and look for patterns.

But if you only have access to a certain number of encrypted messages, then it is not that easy anymore. Right?

I am open to generating more encrypted messages (even on the order of 100 or 1000 more). Let me know how many you think you need and I will think about it.

Of course the $100 is still on the table.

Kevin