Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.programming > #4519 > unrolled thread

A new encryption software of mine

Back to article view | Back to comp.programming

Contents

  A new encryption software of mine Mok-Kong Shen <mok-kong.shen@t-online.de> - 2014-06-08 15:45 +0200
    Re: A new encryption software of mine Kaz Kylheku <kaz@kylheku.com> - 2014-06-08 17:49 +0000
    Re: A new encryption software of mine Mok-Kong Shen <mok-kong.shen@t-online.de> - 2014-06-09 09:20 +0200

#4519 — A new encryption software of mine

I have written a new encryption software:

http://s13.zetaboards.com/Crypto/topic/7201673/1/

For critiques and comments I should be very grateful.

M. K. Shen

[toc] | [next] | [standalone]

#4523

On 2014-06-08, Mok-Kong Shen <mok-kong.shen@t-online.de> wrote:
> I have written a new encryption software:
>
> http://s13.zetaboards.com/Crypto/topic/7201673/1/
>
> For critiques and comments I should be very grateful.

Here they are:

- Find a proper place to host your code. A posting in a web-based
  discussion board is not a good place.

- Write a *document* which describes your algorithm and argues
  for its security. Real developers of crypto do not just write code; they
  write papers (in addition to reference implementations, which are
  secondary).

- Your approach is naively weak, and has a dependency on the Python built in
  PRNG, which is not suitable for this kind of use in the first place.
  You're synchronizing PRNG seeds on the two communication ends and performing
  some naive scrambling based on identical PRNG sequences.  This will keep your
  9 year old kid sister from reading your instant messages, but not your
  government.

- Your biggest problem is the following belief, taken directly from your header
  comment:

    "for securing the communication security of communications of
    the targeted users of his software, namely the common people,
    the most overall optimal scheme would be one that is as simple
    as is program-technically feasible (such that users with certain
    minimum programming knowledge would be able to easily thoroughly
    understand/verify the coding)"

  You're saying that the security of someone's communication should be limited
  by the degree to which he or she has software skills: a person only
  deserved crypto whose implementation he or she can understand.  So millions
  of people who don't know anything about programming should have shitty
  security.  This is an extremely wrongheaded principle.  People who have no
  programming knowledge still have economically valuable secrets which make
  them a target for eavesdroppers.

  "Most overall optimal": what does that mean? "optimal" already means "most",
  first of all: when you improve some parameter of a system so that it cannot
  be improved any more, then that system is simply optimal in that parameter;
  it is not "most optimal". What is it that you think you're optimizing?
  As far as I can tell, you're optimizing the speed with which someone can
  obtain a fool's credit card number from an e-mail.

  Your program is *not* actually easy to understand for the common people;
  it does not meet the stated goal. The "minimum programming knowledge"
  among the common people is actually zero!  Though your encryption is not
  sound from a cryptographic point of view, it still requires significant
  programming knowledge to understand. If it were to be widely used, most of
  the users, the common people, would simply be trusting the code without
  understanding it, the same way they trust the AES encryption in their
  browser, and so on.

- Your program has a terribly user-hostile interface. For example, users have
  to specify the alphabet they are using. The program later blows up if a
  character occurs which is not in that alphabet. There is no reason anyone
  would want to use this program in favor of something simple to use, like say
  the AESCrypt utility which integrates with the Windows shell so you can
  just right click on a file, select AES Encrypt from the context menu,
  put a password twice into the dialog and you're done.

[toc] | [prev] | [next] | [standalone]

#4533

Am 08.06.2014 15:45, schrieb Mok-Kong Shen:
> I have written a new encryption software:
>
> http://s13.zetaboards.com/Crypto/topic/7201673/1/
>
> For critiques and comments I should be very grateful.

I like to add that in the prologe and epilogue of the
software document I have given some rationales of the
design, in particular concerning the use of Python's
built-in PRNG. Certainly, these are merely my humble attempts
to justify the design and not any proofs of security of
the scheme. Hopefully, however, that they might eventually
entice certain constructive critiques from the experts,
leading possibly to some feasible improvements and/or
corrections of my design.

M. K. Shen

[toc] | [prev] | [standalone]

Back to top | Article view | comp.programming

csiph-web