Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.python > #82802

Encryption - was Hello World

Date 2014-12-22 14:57 -0500
From Dave Angel <d@davea.name>
Subject Encryption - was Hello World
References (1 earlier) <54971df7$0$30820$b1db1813$ba2d9d20@news.astraweb.com> <54974ed7$0$12986$c3e8da3$5496439d@news.astraweb.com> <roy-2DE8D9.18502021122014@news.panix.com> <m79ghk$o5r$3@reader1.panix.com> <CAPTjJmoJNX2swk-PQyZw8=Z05=kOxhHNdtgpZ2bUEuX0c7+4bw@mail.gmail.com>
Newsgroups comp.lang.python
Message-ID <mailman.17134.1419278249.18130.python-list@python.org> (permalink)

Show all headers | View raw

On 12/22/2014 12:25 PM, Chris Angelico wrote:
> There's one exception. Writing your own crypto is a bad idea if that
> means reimplementing AES... but if you want something that's effective
> on completely different levels, sometimes it's best to write your own.
> I had a project a while ago that needed some encryption work done, and
> I implemented something that I described as "scarily effective". My
> boss demanded that the debug code-execution feature be protected by a
> password that would be strong even if someone could read the source
> code, so I put together something that would hash the incoming
> password, then check to see if the first two and last two bytes of the
> hash were all the same byte value as the current hour-of-week (ranging
> from 0 to 167). This is clearly more secure than simply embedding a
> SHA256 hash in the source code, because you can't possibly
> reverse-engineer it (since you don't even have the full hash). And
> yes, this was 100% effective in convincing my boss that the code
> executor was safely guarded. Since that was the goal, having several
> lines of complex and opaque code was far better than a single line
> that says "if hash(password)=='5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8':
> do stuff", which is way too easy for someone to decode.
>
> And it was, indeed, scarily effective. That lasted for a long time,
> and any time there was a question about security, I could just point
> to that and say "See? Safe."...

I figure I must be misunderstanding something in your explanation, since 
a brute-force password guesser would seem to only need four billion 
tries to (probably) crack that.

1) Are you assuming that the cracker can read the source code, but 
cannot modify the version of the code that is running?

2) Are you really doing something equivalent to:

test = time_calc() - get a one-byte byte-string according to hour of the 
week
encoded_pw = hash(password)
if encoded_pw.startswith(test*2) and encoded_pw.endswith(test*2):
       ---passed---

I can understand that being sufficiently obscure for the pointy haired 
boss, but I figure I've got to be missing something.  A quick test with 
3.2 shows that around a million hashes can be generated per second, so 
checking four billion is only an hour or so.  Since some of them will 
collide, that gives us something better than 50% likelihood of having 
found a useful pw in an hour.  But a few more hours and we'll most 
likely have it.

For that matter, you must have already written such a pw finder.

I'm back to figuring I'm misunderstanding what you're saying.


-- 
DaveA

Back to comp.lang.python | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Hello World Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2014-12-20 23:57 +1100
  Re: Hello World Chris Angelico <rosuav@gmail.com> - 2014-12-21 00:11 +1100
  Re: Hello World Mark Lawrence <breamoreboy@yahoo.co.uk> - 2014-12-20 16:13 +0000
  Re: Hello World Rustom Mody <rustompmody@gmail.com> - 2014-12-20 08:50 -0800
  Re: Hello World Steve Hayes <hayesstw@telkomsa.net> - 2014-12-20 20:39 +0200
  Re: Hello World alister <alister.nospam.ware@ntlworld.com> - 2014-12-20 22:18 +0000
  Re: Hello World CM <cmpython@gmail.com> - 2014-12-20 21:14 -0800
    Re: Hello World Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2014-12-21 16:26 +1100
    Re: Hello World Chris Angelico <rosuav@gmail.com> - 2014-12-21 16:31 +1100
    Re: Hello World Terry Reedy <tjreedy@udel.edu> - 2014-12-21 01:31 -0500
      Re: Hello World wxjmfauth@gmail.com - 2014-12-21 00:07 -0800
    Re: Hello World Chris Angelico <rosuav@gmail.com> - 2014-12-21 17:44 +1100
      Re: Hello World CM <cmpython@gmail.com> - 2014-12-20 23:44 -0800
        Re: Hello World CM <cmpython@gmail.com> - 2014-12-20 23:45 -0800
          Re: Hello World Marko Rauhamaa <marko@pacujo.net> - 2014-12-21 10:26 +0200
        Re: Hello World Chris Angelico <rosuav@gmail.com> - 2014-12-21 18:46 +1100
      Re: Hello World albert@spenarnc.xs4all.nl (Albert van der Horst) - 2015-01-08 12:43 +0000
        Re: Hello World Chris Angelico <rosuav@gmail.com> - 2015-01-08 23:53 +1100
          Re: Hello World albert@spenarnc.xs4all.nl (Albert van der Horst) - 2015-01-08 13:37 +0000
          Re: Hello World Marko Rauhamaa <marko@pacujo.net> - 2015-01-08 16:06 +0200
            Re: Hello World alister <alister.nospam.ware@ntlworld.com> - 2015-01-08 14:21 +0000
              Re: Hello World Marko Rauhamaa <marko@pacujo.net> - 2015-01-08 16:31 +0200
                Re: Hello World alister <alister.nospam.ware@ntlworld.com> - 2015-01-08 15:14 +0000
          Re: Hello World Michael Ströder <michael@stroeder.com> - 2015-01-08 15:11 +0100
          Re: Hello World albert@spenarnc.xs4all.nl (Albert van der Horst) - 2015-01-17 14:51 +0000
            Re: Hello World Chris Angelico <rosuav@gmail.com> - 2015-01-18 01:57 +1100
              Re: Hello World cl@isbd.net - 2015-01-17 15:18 +0000
            Re: Hello World Michael Torrie <torriem@gmail.com> - 2015-01-17 09:29 -0700
              Re: Hello World cl@isbd.net - 2015-01-17 16:47 +0000
                Re: Hello World albert@spenarnc.xs4all.nl (Albert van der Horst) - 2015-01-17 18:06 +0000
                Re: Hello World Michael Ströder <michael@stroeder.com> - 2015-01-17 19:47 +0100
                Re: Hello World Michael Torrie <torriem@gmail.com> - 2015-01-17 19:09 -0700
                Re: Hello World Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2015-01-18 13:37 +1100
                Re: Hello World Roy Smith <roy@panix.com> - 2015-01-17 22:18 -0500
                Re: Hello World Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2015-01-18 14:45 +1100
                Re: Hello World Chris Angelico <rosuav@gmail.com> - 2015-01-18 18:45 +1100
                Re: Hello World Roy Smith <roy@panix.com> - 2015-01-18 07:26 -0500
                Re: Hello World Tim Chase <python.list@tim.thechases.com> - 2015-01-17 21:50 -0600
                Re: Hello World Chris Angelico <rosuav@gmail.com> - 2015-01-18 18:44 +1100
                Re: Hello World Mark Lawrence <breamoreboy@yahoo.co.uk> - 2015-01-17 18:31 +0000
                Re: Hello World Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2015-01-18 10:46 +1100
                Re: Hello World Chris Angelico <rosuav@gmail.com> - 2015-01-18 11:04 +1100
                Re: Hello World Jason Friedman <jsf80238@gmail.com> - 2015-01-17 18:19 -0700
                Re: Hello World Michael Torrie <torriem@gmail.com> - 2015-01-17 19:13 -0700
                Re: Hello World Marko Rauhamaa <marko@pacujo.net> - 2015-01-18 12:03 +0200
                Re: Hello World Michael Ströder <michael@stroeder.com> - 2015-01-18 14:34 +0100
                Re: Hello World Marko Rauhamaa <marko@pacujo.net> - 2015-01-18 18:03 +0200
                Re: Hello World Michael Ströder <michael@stroeder.com> - 2015-01-18 19:39 +0100
                Re: Hello World Chris Angelico <rosuav@gmail.com> - 2015-01-18 21:10 +1100
                Re: Hello World Marko Rauhamaa <marko@pacujo.net> - 2015-01-18 22:50 +0200
                Re: Hello World Michael Ströder <michael@stroeder.com> - 2015-01-18 14:32 +0100
                Re: Hello World Chris Angelico <rosuav@gmail.com> - 2015-01-18 21:00 +1100
                Re: Hello World Michael Ströder <michael@stroeder.com> - 2015-01-18 14:35 +0100
                Re: Hello World Chris Angelico <rosuav@gmail.com> - 2015-01-19 00:57 +1100
                Re: Hello World Michael Ströder <michael@stroeder.com> - 2015-01-18 16:48 +0100
                Re: Hello World Chris Angelico <rosuav@gmail.com> - 2015-01-19 04:08 +1100
                Re: Hello World Michael Ströder <michael@stroeder.com> - 2015-01-18 14:30 +0100
        Re: Hello World Steve Hayes <hayesstw@telkomsa.net> - 2015-01-08 19:02 +0200
          Re: Hello World Chris Angelico <rosuav@gmail.com> - 2015-01-09 04:11 +1100
            Re: Hello World albert@spenarnc.xs4all.nl (Albert van der Horst) - 2015-01-17 15:10 +0000
          Re: Hello World Michael Torrie <torriem@gmail.com> - 2015-01-08 10:53 -0700
            Re: Hello World Grant Edwards <invalid@invalid.invalid> - 2015-01-08 18:57 +0000
    Re: Hello World Devin Jeanpierre <jeanpierreda@gmail.com> - 2015-01-17 16:06 -0800
  Re: Hello World Tony the Tiger <tony@tiger.invalid> - 2014-12-21 19:22 +0000
    Re: Hello World Marko Rauhamaa <marko@pacujo.net> - 2014-12-21 22:02 +0200
    Re: Hello World Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2014-12-22 09:51 +1100
      Re: Hello World Roy Smith <roy@panix.com> - 2014-12-21 18:50 -0500
        Re: Hello World Chris Angelico <rosuav@gmail.com> - 2014-12-22 11:10 +1100
          Re: Hello World Roy Smith <roy@panix.com> - 2014-12-21 19:12 -0500
            Re: Hello World Chris Angelico <rosuav@gmail.com> - 2014-12-22 11:36 +1100
          Re: Hello World mm0fmf <none@mailinator.com> - 2014-12-22 00:20 +0000
            Re: Hello World Tim Chase <python.list@tim.thechases.com> - 2014-12-21 18:47 -0600
            Re: Hello World Mark Lawrence <breamoreboy@yahoo.co.uk> - 2014-12-22 02:56 +0000
          Re: Hello World Marko Rauhamaa <marko@pacujo.net> - 2014-12-22 10:52 +0200
            Re: Hello World Chris Angelico <rosuav@gmail.com> - 2014-12-22 20:01 +1100
        Re: Hello World Grant Edwards <invalid@invalid.invalid> - 2014-12-22 16:23 +0000
          Re: Hello World Chris Angelico <rosuav@gmail.com> - 2014-12-23 04:25 +1100
          Re: Hello World Mark Lawrence <breamoreboy@yahoo.co.uk> - 2014-12-22 18:51 +0000
          Re: Hello World MRAB <python@mrabarnett.plus.com> - 2014-12-22 19:05 +0000
          Re: Hello World Tim Chase <python.list@tim.thechases.com> - 2014-12-22 13:16 -0600
            Re: Hello World Roy Smith <roy@panix.com> - 2014-12-22 19:55 -0500
              Re: Hello World sohcahtoa82@gmail.com - 2014-12-22 17:03 -0800
                Re: Hello World MRAB <python@mrabarnett.plus.com> - 2014-12-23 01:37 +0000
                Re: Hello World Chris Angelico <rosuav@gmail.com> - 2014-12-23 12:39 +1100
                Re: Hello World Mark Lawrence <breamoreboy@yahoo.co.uk> - 2014-12-23 02:36 +0000
                Re: Hello World Dennis Lee Bieber <wlfraed@ix.netcom.com> - 2014-12-23 12:24 -0500
              Re: Hello World Chris Angelico <rosuav@gmail.com> - 2014-12-23 12:03 +1100
          Encryption - was Hello World Dave Angel <d@davea.name> - 2014-12-22 14:57 -0500
          Re: Encryption - was Hello World Chris Angelico <rosuav@gmail.com> - 2014-12-23 09:29 +1100
          Re: Encryption - was Hello World Dave Angel <davea@davea.name> - 2014-12-22 18:22 -0500
      Re: Hello World Rustom Mody <rustompmody@gmail.com> - 2014-12-21 18:37 -0800
      Re: Hello World Steve Hayes <hayesstw@telkomsa.net> - 2014-12-22 08:21 +0200
        Re: Hello World Chris Angelico <rosuav@gmail.com> - 2014-12-22 17:33 +1100
          Re: Hello World Steve Hayes <hayesstw@telkomsa.net> - 2014-12-22 09:46 +0200
            Re: Hello World Chris Angelico <rosuav@gmail.com> - 2014-12-22 18:56 +1100
        Re: Hello World Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2014-12-22 20:18 +1100
          Re: Hello World Marko Rauhamaa <marko@pacujo.net> - 2014-12-22 11:34 +0200
            Re: Hello World Rustom Mody <rustompmody@gmail.com> - 2014-12-22 19:38 -0800
          Re: Hello World Roy Smith <roy@panix.com> - 2014-12-22 08:15 -0500
            Re: Hello World Chris Angelico <rosuav@gmail.com> - 2014-12-23 00:23 +1100
              OFF TOPIC Snow Crash [was Re: Hello World] Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2014-12-23 13:09 +1100
                Re: OFF TOPIC Snow Crash [was Re: Hello World] Grant Edwards <invalid@invalid.invalid> - 2014-12-23 16:20 +0000
                Re: OFF TOPIC Snow Crash [was Re: Hello World] Rustom Mody <rustompmody@gmail.com> - 2014-12-23 08:41 -0800
                Re: OFF TOPIC Snow Crash [was Re: Hello World] Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2014-12-24 12:51 +1100
                Re: OFF TOPIC Snow Crash [was Re: Hello World] Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2014-12-24 14:18 +1100
                Re: OFF TOPIC Snow Crash [was Re: Hello World] alister <alister.nospam.ware@ntlworld.com> - 2014-12-24 11:50 +0000
                Re: OFF TOPIC Snow Crash [was Re: Hello World] alex23 <wuwei23@gmail.com> - 2014-12-26 09:34 +1000
                Re: OFF TOPIC Snow Crash [was Re: Hello World] alex23 <wuwei23@gmail.com> - 2014-12-26 09:27 +1000
                Re: OFF TOPIC Snow Crash [was Re: Hello World] Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2014-12-26 15:13 +1100
                Re: OFF TOPIC Snow Crash [was Re: Hello World] alister <alister.nospam.ware@ntlworld.com> - 2014-12-26 10:03 +0000
            Re: Hello World Marko Rauhamaa <marko@pacujo.net> - 2014-12-22 15:26 +0200
              Re: Hello World Roy Smith <roy@panix.com> - 2014-12-22 08:41 -0500
        Re: Hello World Roy Smith <roy@panix.com> - 2014-12-22 08:13 -0500
          Re: Hello World Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2014-12-23 02:22 +1100
            Re: Hello World Jussi Piitulainen <jpiitula@ling.helsinki.fi> - 2014-12-22 17:36 +0200
              Re: Hello World Chris Warrick <kwpolska@gmail.com> - 2014-12-22 17:03 +0100
            Re: Hello World Skip Montanaro <skip.montanaro@gmail.com> - 2014-12-22 09:39 -0600
              Re: Hello World Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2014-12-23 03:54 +1100
            Re: Hello World Mark Lawrence <breamoreboy@yahoo.co.uk> - 2014-12-22 18:48 +0000
        Re: Hello World Grant Edwards <invalid@invalid.invalid> - 2014-12-22 16:26 +0000
    Re: Hello World Grant Edwards <invalid@invalid.invalid> - 2014-12-22 16:18 +0000
      Re: Hello World alister <alister.nospam.ware@ntlworld.com> - 2014-12-22 19:05 +0000

csiph-web