5

I know that inventing one's one crypto always sucks, but the problem is that hand ciphers are usually

  1. very insecure
  2. very slow.

This is an attempt to make a relatively secure, keyable, and modular multi-round cipher by hand.

In each round of encryption the following two steps are done:

  1. The text is permuted by concatenating the reverse of the even-numbered characters to the odd-numbered characters. This is equivalent to writing the first char in the first place, the second in the last place, the third in the second place, the fourth in the second-to-last place, etc and is very fast to do by hand, and can be mentally reversed simply by "zig-zagging" the eyes when reading. (12345 -> 13542)

       T H I S X I S X S E C R E T
=> T I X S S C E T R E X I S H

  2. The text is then added$\mod 26$ by repeating a series of numbers, i.e. the key. The numbers are from 0 to 10 so that they are easy to write underneath the letters and also because encryption can be done in head without memorizing, say, X is the 24th number of the alphabet. I'm especially concerned whether limiting this to numbers from 0 to 10 rather than from 0 to 25 seriously cripples security. (Obviously the digits of $\pi$ is a bad choice for a key but this is just an example)

       T I X S S C E T R E X I S H
   3 1 4 1 5 9 2 6 5 3 5 8 9 7
=> W J A T X J G Z W H C Q B O

This encryption process is continued for 5 to 10 rounds. The reason for the permutation phase is to break patterns that weaken the Vignère cipher.

I have observed the weakness that the first letter is never permuted to another place; thus known-plaintext attacks can easily trivially find the first number of the keystream given the number of rounds. Other than that I haven't found any very serious flaws.

Does this cipher system have any mathematical advantage over older (but slower to compute!) ones such as Vigenère or Playfair?

e-sushi
  • 17,891
  • 12
  • 83
  • 229
ithisa
  • 1,101
  • 9
  • 23
  • I think this is off-topic? FAQ meta – Cryptographeur Oct 30 '13 at 14:07
  • @user8911 Not really. If you would read the accepted answer at meta down to the last line, you would discover that questions which are reasonably scoped — like "A simple block cipher based on the SHA-256 hash function" — are not off-topic. I regard this one to be of similar scope and pretty well defined. Therefore, it's pretty much on-topic from my point of view. – e-sushi Oct 30 '13 at 14:14
  • @e-sushi: fair enough. OP: Even number of rounds leaks parity of first character, since $c_0 = a_0 + r*k_0$ and modulo 26 doesn't disrupt this behaviour as 26 is even. – Cryptographeur Oct 30 '13 at 14:48
  • You might be interested in the Solitaire cipher, a "by-hand" cipher for which the only tool needed is a deck of cards. – Stephen Touset Oct 30 '13 at 19:03
  • That is in fact what I had in mind when I mentioned "very slow" hand ciphers... – ithisa Oct 30 '13 at 19:04
  • We need more information about the key. Is the key a sequence of numbers that are uniformly and independently distributed (each number is uniform of all others)? Is the key re-used for multiple messages? How long is the key? What do you do if the message is longer than the length of available key material? For instance, if the key is a sequence of length 15 (say) for each of the rounds, what do you do if your message is longer than 15 characters long? Do you repeat the key? Do you use a different independent key for each round, or do you use the same in each round? – D.W. Oct 31 '13 at 21:35
  • The key is a repeated word, like in Vigenère. – ithisa Nov 01 '13 at 00:03
  • user54609, I asked about 7 different questions, and you answered about 4 of them. Still wondering about the other 3.... If you're not going to answer requests for clarification, how do you expect to get a good answer? Seems odd to place a bounty but not answer such questions. You should also be editing the question to include these clarifications in the question, so people don't need to read the comment thread. P.S. You might also want to notify me when responding, by including "@D.W." in your response. – D.W. Nov 05 '13 at 07:00
  • You could get a lot better diffusion if, rather than handle each letter independently with "mod 26", you allow a carry over -- i.e., when adding 5 to X and obtaining C, you get a "carry over" that changes the next column from E+3=H to E+3+1=I. – David Cary Nov 12 '13 at 00:31
  • Okay. "Is the key a sequence of numbers that are uniformly and independently distributed (each number is uniform of all others)?" Ideally yes, but in fact the key is just a repeated word in practice to speed up memorization. Key length: variable. We use the same key in each round. – ithisa Nov 12 '13 at 01:17

2 Answers2

5

Given that the permutation is fixed and the key step is independent of the permutation you can reduce this to an ordinary text-substitution cipher.

If the key is as long as the input you have a weak one-time pad, because the per letter change is limited to 10 instead of 26.

However if the key is short then you have a Vigenère cipher (if you "decode" with $key=0$ then it is exactly a Vigenère cipher).

In essence you use 2 transformations: a character scramble ($P$ $P'$) and a "xor" ($X+$ and $X-$).

Your algorithm is $text1=X+(P(text_0),key)$for each phase.

However this is equivalent to $text1= P(X+(text_0,P'(key)))$.

Then the next fase is $text_2= P(X+(P(X+(text_0,P'(key))),P'(key)))$ which can be rewritten to $text2 = P(P(X+(X+(text0,P'(key) ), P'(P'(key))))$ and so on.

Given that P is easily reversible you can extract $X+(text, X+(P'(key), P'(P'(key)) )$.

e-sushi
  • 17,891
  • 12
  • 83
  • 229
ratchet freak
  • 502
  • 2
  • 9
  • No, if I attempt to decode with a null key, eventually the keystream will be mangled and pseudo-non-periodic. Note that the keystream is not permuted in each round. – ithisa Mar 26 '13 at 14:00
  • @EricDong but there s an equivalent keystream that is discoverable by encoding "AAAAA..." – ratchet freak Mar 26 '13 at 14:52
  • Try to decode with the null key to the correct number of rounds, and then decode with the keystream found by encoding AAAAAAA. It is easy to see this does not work. – ithisa Mar 26 '13 at 14:55
  • Actually I was wrong. The keystream is discoverable by encoding "AAAAA...". However, there is little discernable pattern in such a keystream, and avalanche changes happen when the length is changed. Try guessing the key from this keystream: "OAHYCSRLEQTCUCPAECRAOBWYAZCBSFCWAXCUMXAU" – ithisa Mar 26 '13 at 16:12
  • that keystream is enough to decrypt other texts (as in your cipher is vulnerable to chosen and known plaintext attacks) – ratchet freak Mar 26 '13 at 16:41
  • 1
    That keystream is enough to decrypt other texts of the same length. AAAAA does not encrypt to the first 5 letters of AAAAAAAAAAAAA encrypted. – ithisa Mar 26 '13 at 17:30
  • Also, I thought that Vigenère's main weakness was ciphertext-only attacks, not known or chosen plaintext attacks. Also, I don't see how known-plaintext will help. Chosen would certainly help in decryption. – ithisa Mar 26 '13 at 17:33
  • 1
    I like where you're going. Regarding the 0-9 thing, what's wrong with the standard Vigenère approach and using a key word or phrase instead of a key number? And what about trying to strengthen it by shifting the starting point of the transposition based on the plaintext(input) value and round #? I doubt this will lead to a manual cypher as strong as DES, but consider who is your attacker? – John Deters Mar 26 '13 at 21:43
  • 2
    Using a 0-9 key eliminates the need to write or memorize a huge tabula recta. – ithisa Mar 26 '13 at 22:22
3

Let's assume a ciphertext only attack, and compare it to Vigenere. Your scheme is on a quite similar level of security: It might be hard to break it without a computer, but with one it is probably done in seconds. Here's how:

First, your permutation is static and only depends on the number of rounds and the length of the text, therefore you can just reorder straight away (e.g. 1st stays at 1st, 3rd becomes 2nd after the first around and then the second to last in the next round, etc.)

This leaves us with a substitution cipher (modular on the alphabet), where you add a combination of the key digits on each character. If the key is chosen uniform and has the same length of the alphabet, this is really hard to solve, but that's the same for Vigenere: If the key length has the same length as the text, and each digit is chosen from a uniform distribution, then Vigenere is just a OTP. If you just choose numbers 0-9 for Vigenere but without repetition, frequency analysis might still help (at least it can exclude certain messages).

Here's a problem tho: Your key looks like $k_1k_2...k_n$ and we know where each character ends up. In each round, one of the key digits is added to the original letter. But since your permutation each round is fixed, everyone knows which one of the key digits is added.

A simple example for the first letter: If you have 5 rounds, then the first letter will end up as $m_1+5k_1$. Is this a problem since only the first one is static? Yes it is. Here's a really short example, assuming 2 rounds:

  • Message $(m_1,m_2,m_3,m_4)$ , Key $(k_1,k_2,k_3,k_4)$
  • After the first permutation: $(m_1,m_3,m_4,m_2)$
  • After the first round: $(m_1+k_1,m_3+k_2,m_4+k_3,m_2+k_4)$
  • After the 2nd permutation: $(m_1+k_1,m_4+k_3,m_2+k_4,m_3+k_2)$
  • After the second round: $(m_1+2k_1,m_4+k_2+k_3, m_2+k_3+k_4, m3+k_2+k_4)$

So... the problem here is that the remaining letters just are a sum of the original letter + a linear combination of the key digits and this will continue over any number of rounds. At this point a combination of frequency analysis and solving a linear system will give the attacker an advantage.

But coming back to Vigenere: The weakness there lies mostly in the fact that the codeword was shorter than the text and the repetition is leaking. If you happen to repeat a single code word, above mentioned linear system will collapse as well. The math involved is more complicated than calculating the auto correlation for Vigenere, but it is there.

edit: Further details:

As requested, I'll explain why short keys and repetition in this scenario are bad. Let's use the formula from the example above with 2 rounds, with the assumption

  • $k_1 = k_3$ and $k_2=k_4$
  • This leaves us with this ciphertext: $(m_1+2k_1,m_4+k_2+k_1, m_2+k_1+k_2, m3+2 k_2)$

What can we get from this? Let's assume we have a ciphertext "ABCD". At first, we look at the first letter: Since it is constructed from $m_1+2k_1$, we know that $2k_1$ is clearly an even number. Let's see which original letter would be the most likely, such that adding an even number (below 20) would result in the letter "A". If we have a correct guess, this gives us $k_1$. Let's look at the other letters: The second and third letter of the ciphertext both add $k_1+k_2$, so there we can have a guess for the sum of those letters and find a most likely combination. The last letter works just as the first, since it adds $2k_2$. Even if we can not identify the exact letters when looking at them individually, we can work with exclusion: Assuming that $k_1=1$ would mean that $m_1=Y$. Assuming english language, we can pretty much exclude $k_2=3$ from the 3nd letter ($m_2+...$) already, since there are no words which start with "YY" (It was a toy example, no idea if there is a likely plaintext).

One more thing: The distribution of a construction like $m_x+k_1+k_2+k_3+...$ is quite bad, because it is far from uniform. The problem is, that the sum of independent random variables is not uniform distributed: If you throw 2 dice, the chance of getting a sum of 7 is much more likely than a 2 or a 12. (See central limit theorem for the asymptotic behavior: it approximates the normal distribution).

Calculating the exact probabilities is quite difficult, but it is not uniform. Additionally, the modulus 26 makes it even more complex, but it can't even out all the problems.

tylo
  • 12,654
  • 24
  • 39
  • 1
    Could you explain a bit how repetition would be bad? Unlike the Vigenère, crib-dragging and usual attacks on Vigenère don't seem to work. With multiple rounds, I am under the (false) impression that the multiple linear additions combined with the fixed permutation give a random-to-the-human-eye, nonperiodic, keystream. – ithisa Oct 30 '13 at 23:35
  • 1
    The problem lies with the "random to the human eye nonperiodic keystream". This is not a useful security measure, as it comes down to if I can't break my system it has to be secure (e.g. this was the security assumption for the Enigma). I will add a short key example to the answer. Furthermore, there are serious issues with the distribution of they key sums, which I didn't point out before. – tylo Nov 04 '13 at 16:36